Penetration Testing
Web App Pentest: Penetration Testing That Proves What a Logged-In User Can Really Do. Report in 14 Days, Free Retest.
Every role in your application, from the account anyone can register to the administrator, tested by hand for what it can reach, change and take.
Our web app pentest is scoped around the six boundaries where web applications break: access control, authentication and sessions, injection, business logic, file handling and the browser side. Every role is tested against the OWASP Top 10, ASVS and WSTG, and every finding is a reproduced attack path with its business consequence and the PCI DSS, SOC 2, ISO 27001 or NIS2 clause it bears on. Fixed price, report in 14 days, free retest.
- Every role tested with two accounts each, so horizontal and vertical access control are proven
- Each finding carries the request that reproduces it and the clause your auditor will cite
- Written rules of engagement: harmless proofs, agreed windows, a stop condition
Every screen, every role and every endpoint the pages call, mapped before testing starts.
SEE THE DELIVERABLE
See what a useful
penetration test report looks like.
Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.
62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.
Get the sample report
A free PDF. Enter your email and company name, and we’ll email you a download link.
DEFINE YOUR SCOPE
Turn your testing requirements into a clear RFP.
Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.
REQUEST RECEIVED
Your RFP is submitted.
Reference: . Email copies are being sent to and Alexander at Atlant Security. Check your spam folder if needed.
You can also book a call to discuss the scope.
Scopes and leads every web app pentest personally, runs the remediation workshop with your developers and signs the attestation letter your auditor reads.
Connect on LinkedIn01 / THE DETAIL
What a Web App Pentest Actually Tests
A scanner scopes a web application by URL. We scope it by boundary, because every serious web finding is a boundary that failed: between two customers, between a user and an administrator, between input and an interpreter, between the browser and the server.
Access control across roles and tenants
Whether customer A can open customer B’s order by changing a number, whether a viewer can call the editor’s endpoint, whether a trial account can reach a paid feature. Every role, two accounts per role.
Authentication and session flows
Password reset, MFA enrolment and fallback, remember-me cookies, SSO callbacks, session fixation and token lifetime: the flows that hand a stranger a working session.
Injection on the server and in the browser
SQL, NoSQL, OS command and template injection wherever input meets an interpreter, proven with a harmless read. Stored, reflected and DOM-based XSS wherever output meets the page.
Business logic in checkout, pricing and approvals
Prices and quantities trusted from the client, coupons applied twice through a race, approval steps skipped by calling the final endpoint directly, refunds that exceed the payment.
File handling and server-side requests
Upload checks that stop at the extension, downloads that accept a path, parsers fed a crafted file, and URL-import features that reach the admin panel on localhost or the cloud metadata service.
The browser boundary and third-party components
CSP, CORS, cookie flags and security headers as actually served, and every shipped library checked against public exploits. One permissive origin rule turns a small XSS into a stolen session.
02 / THE DETAIL
The Attack Paths That Repeat in Web Applications
These are the findings that recur across the web applications we assess, whatever the framework. Most sit in fully patched code, which is why a scanner reports the application as clean: the weakness is in what the server checks before it answers.
Object IDs trusted straight from the URL
Orders, invoices and documents numbered in sequence, and a server that checks for a valid session and skips the ownership check. Change one digit, read the next customer’s file.
Admin functions hidden in the page, open on the server
The admin menu is hidden from ordinary users while the endpoints behind it answer any authenticated session. The role check lives in the JavaScript bundle.
Password reset flows that trust the browser
A reset link built from the Host header, a token that survives first use, an email address accepted in the reset body, or an MFA prompt a remember-me cookie bypasses.
Prices and totals computed on the client
The cart total, the discount and the currency arrive in the checkout request and are accepted as sent. A negative quantity refunds money that was never paid.
Uploads the server opens, or serves back as HTML
An avatar field that accepts an HTML file and serves it from the application origin, an image resizer fed a crafted file, an import-by-URL feature that reaches 169.254.169.254.
A front-end library two major versions behind
A bundled component with a public exploit, a CORS policy that reflects any origin with credentials, and a CSP that allows inline scripts: one DOM XSS reaches every session.
03 / THE DETAIL
What the Report Has to Prove, and to Whom
A web app pentest report has two readers. The developer wants the request that reproduces the finding, the code it points to and the fix. The auditor wants evidence that the application was tested independently, by a named person, with a method, and that every finding was closed.
Ours carries both. Every finding carries its OWASP Top 10 category and ASVS requirement, and the clause it bears on: PCI DSS Requirement 11.4 for an application in card-data scope, SOC 2 criteria CC7.1 and CC4.1, ISO/IEC 27001:2022 Annex A 8.8 and A 8.29, HIPAA 164.308(a)(8) for a patient portal, GDPR Article 32(1)(d) and NIS2 Article 21 for European operators. The method follows NIST SP 800-115, which a customer citing NIST SP 800-53 CA-8 expects to see named. The retest and the signed attestation letter close the evidence file.
Financial entities testing under DORA Article 25 are covered on the DORA compliance page, and designated entities face the separate TLPT regime.
04 / THE DETAIL
Rules of Engagement for Live Web Applications
Most web app pentests touch production, or a staging copy of it. Before anything is touched, both sides sign rules a product owner and a risk committee can read.
- Data stays intact. Injection is proven with a harmless read. We never run a payload that writes, deletes or locks, and denial-of-service techniques stay outside the scope.
- Side effects are contained. Anything that sends email or SMS, places an order, charges a card or fires a webhook runs against test accounts you nominate, inside agreed windows.
- A named contact and a stop condition. One escalation contact on each side, reachable throughout, and a written condition under which testing halts at once.
- Evidence handling. Any personal data encountered in a response is redacted at capture, held encrypted for the engagement only, and destroyed on a documented date.
- Platform boundary respected. Your code and configuration are the target. The hosting provider, CDN, payment processor and identity provider are tested at the integration you control, inside the testing rules AWS, Azure and Google Cloud publish.
05 / THE DETAIL
How the Engagement Runs
Five steps. The price is fixed in writing at the first, and the report lands within fourteen days of the start of the third.
Scoping call
Which application, which roles, which environment, and what your auditor or customer is asking for. Fixed price and timeline in writing within 24 hours.
Rules of engagement
Test accounts for every role, the environment for each kind of test, the windows, the harmless-proof rule for injection, contacts on both sides and a written stop condition.
Manual testing
Senior-led. Every role against every function, attack paths chained end to end inside the agreed scope. Tools for breadth, a person for authorisation and business logic.
Report and workshop
Findings register with the request that reproduces each issue, fixes with code examples, an executive summary with compliance mapping, and a live remediation session with your developers.
Retest and attestation
Free retest after you fix, then an attestation letter signed by a named qualified individual, written for your auditor and your customers’ security questionnaires.
06 / PRICING
Web App Pentest Pricing
One application with all its roles is a fixed price. Related scopes go into one proposal with volume pricing, and you approve the total before anything starts.
| Scope | What is covered | Testing | Price |
|---|---|---|---|
| Web application | 1 application, all roles, OWASP Top 10 and ASVS | 7-10 days | From $5,000 |
| API behind the application | Up to 50 endpoints, authorisation-focused | 5-7 days | From $4,000 |
| SaaS multi-tenant platform | Tenant isolation, roles, SSO, integration tokens | 10-14 days | From $6,000 |
| Mobile app plus its API | iOS or Android with the API it calls | 10-14 days | From $6,000 |
| Cloud infrastructure | One AWS, Azure or GCP environment | 7-10 days | From $6,000 |
| External network perimeter | Internet-facing ranges, DNS, mail, remote access | 5-7 days | From $4,000 |
Every scope includes the findings register with reproducing requests, the executive summary with compliance mapping, the remediation workshop, one free retest and the attestation letter. All published scopes are on the pricing page.
For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.
07 / THE DETAIL
Web App Pentest or Vulnerability Scan
Two controls that get bought as if they were one. NIST SP 800-53 lists them separately, RA-5 for scanning and CA-8 for penetration testing.
The scanning control has its own page: vulnerability assessment. Most clients run both, the scan on a schedule and the pentest yearly and after a major release.
08 / THE DETAIL
Who Commissions a Web App Pentest
09 / THE DETAIL
Find Out What a Self-Registered Account Can Reach
One scoping call. Bring the URL, the list of roles and your auditor’s evidence request. You leave with a scope written as questions, a fixed price and a date for the report.
Scope My Web App Pentest10 / THE DETAIL
Book the Scoping Call
Choose a time for your scoping call.
11 / FAQ
Web App Pentest FAQ
What is a web app pentest?
How is a web app pentest different from a vulnerability scan?
Which regulations and frameworks expect a web app pentest?
Do you test production or staging?
What do you need from us before testing starts?
Do you test single-page applications built with React, Angular, Vue or Next.js?
Is the API behind the application included?
How long does a web app pentest take?
What does a web app pentest cost?
What is in the report, and what happens after it?
12 / THE DETAIL
Related Services
Penetration testing - Network pentest - API pentest - SaaS pentest - Mobile app pentest - Cloud pentest - Vulnerability assessment - SOC 2 - PCI DSS compliance - SaaS virtual CISO - continuous AI penetration testing on Pentestas