What we test
Web Application Penetration Testing
Authenticated testing of a web application against the logic an attacker would actually abuse: who can reach what, whose data is whose, and what happens when a request arrives out of order.
Who asks for this
The most common first test for a software company. It is what an auditor expects to see when the product is the system, and what an enterprise security reviewer means when they ask whether the application has been tested.
What the test covers
- Authentication, session handling, password reset and multi-factor bypass paths
- Authorization between roles and between tenants, tested with real accounts rather than assumed
- Business logic: ordering, pricing, quota, state transitions and workflow steps that can be skipped
- Injection and deserialization across the request surface, including file upload handling
- Client-side issues that lead to account takeover rather than a self-inflicted alert box
- Secrets and data exposure in responses, source maps, error pages and build artifacts
What this test typically finds
Classes of finding, not a severity table. These are the issues that recur on this surface.
Cross-tenant access
An identifier in a URL or body that is trusted rather than checked against the session. The single most common serious finding in multi-tenant software, and the one enterprise buyers ask about by name.
Privilege escalation inside the product
A member account reaching an admin-only operation because the check lives in the interface rather than the endpoint.
Workflow steps that can be skipped
A multi-step process where step three can be called directly, bypassing the validation or payment in step two.
Password reset and session weaknesses
Tokens that do not expire, do not bind to a single account, or survive a password change.
Questions people ask
How long does a web application penetration test take?
Testing runs three to five business days for a typical software product, with the report following. Scope size drives it more than anything else: the number of distinct roles and the number of workflows that change state matter more than page count.
Do you test production or staging?
Staging, when it genuinely mirrors production. A staging environment with different authentication or seeded data produces findings that do not apply, which is worse than not testing. Where only production exists, testing is scoped and scheduled to avoid destructive operations.
What is the difference between a web application pen test and a vulnerability scan?
A scan checks for known vulnerabilities in known software. A penetration test includes that and then tests the logic unique to your application, which no scanner has a signature for. Cross-tenant data access is the standard example: a scanner cannot find it because it does not know what a tenant is in your product.
Related surfaces
Get a scoped price without a discovery call
Tell us what is in scope and what your audit needs. You get a fixed price and a date, not a quote after two meetings.