Web application penetration testing
We test your web application the way an attacker would: signed in and signed out, at every permission level, against the logic that makes your product work. Scanners find the obvious issues. We find the access control and business logic flaws that lead to real breaches.
What we test
Every engagement is scoped to your environment. These are the areas a web application testing engagement covers as standard.
Access control
Whether one customer can see or change another customer's data. We check every role against everything it should not reach.
Authentication and sessions
Login, password reset, MFA, single sign-on and how sessions start, expire and end.
Input handling
Injection and cross-site scripting risks in every form, parameter and upload the application accepts.
Business logic
Prices, discounts, approval flows and multi-step processes, used in ways the developers did not expect.
The APIs behind the app
The endpoints your front end relies on are covered in the same engagement.
Configuration
Security headers, error messages, exposed admin areas and leftover debug features.
How deep we go
Choose how much access we start with. We will recommend one on the scoping call, based on what you want to learn.
Black box
We start with only the address, the way an outside attacker would.
Grey box
We test with real accounts at each role. This finds the most serious issues, and it is what most clients choose.
White box
With access to source code, we confirm root causes and reach issues that are hard to find from outside.
From first call to clean exit
Every engagement follows the same five steps. Our penetration testing process page explains each one in detail.
- Day 0
Scoping call
A free call to understand what you want tested and why: the applications, networks or APIs, your deadlines and any compliance requirement behind the test. You get a written quote with the scope, timeline and deliverables set out.
- Before testing
NDA and rules of engagement
We sign a mutual NDA, or work under yours, then agree the rules of engagement: targets, testing windows, contacts, and anything that must not be touched. Testing can start within 48 hours of the scope being signed.
- Testing
Hands-on testing
Our testers combine tools with manual testing, following OWASP, PTES and NIST SP 800-115. If we confirm a critical issue, we tell you straight away instead of waiting for the report.
- Report
Report and walkthrough
Every finding is reproduced by a tester before it goes in the report, with severity, evidence and a fix written for your stack. We walk your team through the results and answer questions.
- After
Retest and clean exit
When you have fixed the issues, we can retest and issue an updated report. When the engagement ends, we remove test accounts, credentials and working files, and confirm it in writing on request.
Findings your developers can act on
Each finding explains what is wrong, what an attacker could do with it, and how to fix it in your stack. No raw scanner output, and nothing we have not reproduced ourselves.
Single-use discount could be applied more than once
- Affected area
- Checkout, discount codes
- Impact
- A shopper could apply the same single-use code several times and reduce an order well below its real price.
- Fix
- Record the code as used in the same step that applies it, and reject repeat requests for the same basket.
An illustrative example. Client names, systems and data are always kept confidential.
What we need from you
- The application address and the environment to test (staging or production)
- Two test accounts for each user role
- Any API documentation you have
- Testing windows, and anything that must not be touched
What you receive
- An executive summary written for non-technical readers
- Each finding with a CVSS severity, evidence and steps to reproduce
- Fixes written for your stack, in the order to apply them
- Critical issues reported to you as soon as we confirm them
Questions about web application penetration testing
How long does a web application penetration test take?
Most single applications take one to two weeks of testing, depending on the number of roles, features and integrations. Your quote sets out the timeline, and testing can start within 48 hours of the scope being signed.
Do you test in production?
We can. Most clients prefer a staging environment that mirrors production, so testing never affects customers. If we test production, we agree testing windows and avoid anything that could disrupt the service.
Is this different from a vulnerability scan?
Yes. A scan lists known weaknesses automatically. A penetration test shows which ones can really be exploited, and finds the access control and logic flaws scanners cannot see. We use scanners too, but every finding in your report has been confirmed by a tester.
Will the report satisfy our auditor or customer?
The report is written to support SOC 2, ISO 27001 and PCI DSS evidence requests and customer security questionnaires. It states the scope, dates, method and results clearly.
Do you check that our fixes work?
Ask for a retest when we quote. We confirm each fix and issue an updated report showing what is resolved.
Further reading
Guides from the Krylo Security blog.
Penetration testing explained
Read the guide ↗Penetration testing in the SSDLC
Read the guide ↗E-commerce security best practices
Read the guide ↗Other penetration tests
API penetration testing
REST, GraphQL and partner APIs tested for broken authorization, data exposure and abuse, against the OWASP API Security Top 10.
Mobile app penetration testing
iOS and Android apps tested on real devices against OWASP MASVS, together with the APIs and backend they depend on.
Network penetration testing
Your internet-facing perimeter and internal network, including Active Directory and cloud hosts, tested from outside and from within.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.