Web application penetration testing
We assess access controls, account security and business logic in web applications and agreed APIs, showing how weaknesses affect customer data and actions.
01 / ASSESSMENT
A penetration test validates vulnerabilities under controlled conditions. Using OWASP WSTG, assess authentication, sessions, authorisation, business logic and APIs. Manually confirm scanner findings and demonstrate data impact with the minimum necessary evidence.
PRACTICAL SCENARIOS / TTP
TTPs are an adversary’s tactics, techniques and procedures. We analyse these approaches and select scenarios for your environment and the scope agreed in writing, connecting each assessment result to practical defensive guidance.
Assess BOLA/IDOR, access to another user’s object, and BFLA, access to an unauthorised function. Validate server controls with test accounts across customers and roles. Explain exactly which information or actions become exposed.
Review SSO, OAuth/OIDC flows, password recovery and MFA together. Assess token lifetime, intended audience and revocation after logout. Identify situations where one weak workflow undermines the entire account.
Scope may cover race conditions, SSRF, file uploads and proxy boundaries. Manually assess price, limit and workflow errors that scanners can miss. Findings include reproduction conditions and criteria for verifying a fix.
02 / OUTCOMES
Work proceeds under the system owner’s written authorisation, a contract and a confidentiality agreement. Assets, methods, timing, stop conditions and data handling are defined before work begins.
Send your requirements through CyberTrust. We will clarify asset count, assessment depth and expected outcomes with you, then set out timing and pricing in the proposal.