Home / Services / Web application and API penetration testing
Every app has a side entrance.
Web application penetration testing finds the flaws scanners walk past: access controls that don’t check who’s asking, logins that can be bypassed and business logic that does whatever an attacker asks. A certified tester tries it by hand, signed in and signed out.
What scanners walk past.
Broken access controls
Change one number in a link and see somebody else’s account. A scanner can’t tell your data from a customer’s.
Login and session flaws
Password resets, multi-factor prompts and sessions that can be bypassed, replayed or kept alive.
Business logic
Discounts applied twice, approvals skipped, goods paid for at the wrong price. Only a person spots these.
How the job runs.
Map it
We use the app the way your users do and find the pages, roles and API calls nobody listed.
Attack it signed out
Everything someone with no account could try.
Attack it signed in
Every role you give us, reaching for what the next role up can see.
Prove it and retest
Each finding comes with the steps to repeat it and the fix. We retest once you’ve fixed it.
When to call us.
- Before a launch or a major release
- After significant code changes
- Every year for any customer-facing app
- When a customer’s due diligence or your insurer asks for evidence
- For PCI DSS 11.4, ISO 27001 and GDPR evidence
On its own or all year?
It’s part of the baseline in every year-round plan, and tested again when it changes.
Partners: A web app test before a client launch leads naturally into remediation and secure development work. Sell it under your brand.
Questions.
Do you test APIs too?
Yes. APIs get the same access control and logic testing, whether they sit behind your app or are used by your partners.
Will testing affect our live site?
We agree the scope and rules of engagement in writing before we start. If you’d rather, we test a staging copy instead of production.
Find the side entrance first.
Tell us about the app and a technical account manager will scope the job with you.