Web Application
Penetration Testing
Find security gaps in your web app, including login, permissions, and business logic. Get verified findings and clear steps to fix them.
Overview
Test the app attackers target most.
We follow the OWASP Web Security Testing Guide. Every finding is manually verified, scored with CVSS v3.1, and delivered with clear reproduction steps. We re-test your fixes free within 60 days.
Coverage
What we test.
Comprehensive coverage of the vulnerability classes that matter for modern web applications.
- Authentication & session management
- Authorisation & access control (IDOR)
- Injection (SQL, NoSQL, command)
- Cross-site scripting (XSS) & CSRF
- Business-logic & workflow abuse
- Server-side request forgery (SSRF)
- Insecure deserialisation & file upload
- Security misconfiguration & headers
FAQ
Web application penetration testing FAQ
Scope, cost, and what happens next.
How much does a web application penetration test cost?
A web application penetration test typically costs €2,000–3,500 for a small single application, €4,000–7,000 for a medium application with multiple roles, and €8,000+ for large enterprise platforms. Use our online estimator for a tailored figure.
How long does a web application penetration test take?
Most take between 3 and 10 working days of active testing, plus reporting. A small application is usually 3–5 days; a complex platform is 5–10 days or more.
What is the difference between black-box, grey-box, and white-box testing?
Black-box uses no prior knowledge, simulating an external attacker. Grey-box uses limited information and standard accounts, finding more issues for the same budget. White-box adds documentation and source-code access for the deepest coverage.
How often should we run a web application penetration test?
At least once a year, and after any major release or change to authentication, authorisation, or payment flows. ISO 27001, SOC 2, and PCI DSS all expect regular testing.
Do you provide a certificate or attestation letter?
Yes — a detailed technical report, an executive summary, and a summary attestation letter for customers and auditors, plus a free retest within 60 days.
What do you need from us to scope the test?
Usually the application URL(s), a short description of user roles and key features, and whether you want grey-box (test accounts) or black-box. We turn that into a fixed scope and quote within a day.
More questions about this service
Do you test production or staging?
Either — we prefer a staging environment that mirrors production where possible, and agree rules of engagement for any testing against live systems.
Who carries out the testing?
Experienced, certified penetration testers — never an automated scan handed off as a report. Every finding is manually verified.
Is our data kept confidential?
Yes — we work under NDA, handle all findings securely, and can sign your data-protection terms before any engagement.
How quickly can you start?
Typically within 1–3 weeks of scoping, depending on availability and your preferred window.
Related services
Explore more.
Ready to test your web app?
Tell us what you’re working on. We’ll help you work out the next step.
Book a short call Send an email