Web applications
- Authentication, session management and password reset flows
- Authorization and access control between users and roles
- Injection, cross-site scripting and server-side request forgery
- Business-logic abuse and workflow bypass
Application penetration testing
Web, mobile and API testing that goes past the scanner
Scanners find the obvious. We find the logic flaws, broken access controls and chained issues that let an attacker take over accounts or reach your data.
What we test
Coverage
APIs
- REST and GraphQL endpoints
- Object-level and function-level authorization
- Rate limiting, mass assignment and data exposure
- Token and key handling
Mobile apps
- iOS and Android client analysis
- Local data storage and secrets
- Certificate validation and transport security
- Back-end API abuse through the app
Methodology
Built on recognized standards, driven by experience
Every application is different, so no checklist is enough on its own. We use the OWASP Web Security Testing Guide, the OWASP API Security Top 10, OWASP Mobile Application Security and the OSSTMM (PDF) as a baseline, then go deeper based on how your application actually works.
- Authenticated testing across each user role you provide
- Manipulation of client-side code and locally stored data
- Review of how components talk to each other and to back-end data sources
- Search for privilege-escalation paths
- Review of logging and event handling
- Every finding manually confirmed before it reaches your report
Deliverables
What you receive
- Executive summary written for leadership and auditors
- Technical findings ranked by severity, with evidence and steps to reproduce
- Remediation guidance tailored to your environment
- A readout call to walk your team through the results
- A retest of remediated findings within 45 days, included
FAQ
Common questions
Do you test in production?
We can test production or a staging environment that mirrors it. We agree on testing windows in advance and avoid any exploit that could damage data or take a system offline.
Do you need test accounts?
Yes. Authenticated testing finds the most serious issues, so we ask for accounts for each role in scope.
Can you provide source code review too?
Yes. Combining code review with testing finds issues faster and helps your developers fix root causes. Ask us about it when scoping.
Does this satisfy PCI DSS penetration testing requirements?
Our testing and reports are designed to support PCI DSS requirement 11.4 and similar audit requirements. Let us know your framework when scoping.
Let’s test your application
Tell us about the application, its users and any deadlines, and we’ll scope the right test.