Penetration Testing

Web Application Penetration Test

We manually test your web applications, such as online banking, customer portals or e-commerce sites. We clearly demonstrate how an attacker could access data or transactions.

Schedule a Meeting All services in this area

What it is

A web application penetration test examines the live application manually from an attacker's perspective. Session management, authorization and input handling are tested separately for each user role. Business logic flaws in steps such as payments, approvals or limits are also checked. The method follows OWASP WSTG and ASVS, with automated scanning used only as support.

Scope

Login, password reset, multi-factor authentication and session management flows
Whether a user can access another user's data
Input handling vulnerabilities such as injection, XSS and file upload
Business logic steps such as payments, approvals, limits and campaigns
APIs and third-party integrations used by the application
Server, TLS and security header configuration

The need

When organizations need it

Before launching a new customer portal, online banking service or payment flow.
When your financial regulator requires the annual independent penetration test.
When a corporate customer requests an independent test report on your application before contracting.

Method

How we work

Scope and roles

We define the domains, flows and test accounts for each role together.
Mapping

We map the application's pages, API calls and workflows.
Manual testing

We manually test authorization, input and business logic in each role. We demonstrate the combined impact of low-risk findings.
Report and retest

We rank findings by impact and CVSS score, and retest after corrections.

Outcome

What you have at the end

You see step by step which user can access which data and transactions without authorization. The results of corrections are documented by retesting.

Frequently asked questions

How is this different from an automated vulnerability scan?

Scanners look for known vulnerability patterns. Authorization and business logic flaws, such as one customer accessing another customer's record, are found only by manual testing.

Is the test performed in the production environment?

Both are possible, but a test environment similar to production is preferred. In production, steps that may change data are performed only with your approval and test accounts.

How long does the test take?

The duration depends on the application's size, number of roles and flow complexity. We provide a clear schedule after reviewing the scope.

Penetration Testing