Security engagement
Web application penetration test
Automated scanners find the shallow end. A real web-app penetration test follows your data through the app — where input lands, what trusts what, where the client checks are only cosmetic — and proves each finding with a working exploitation path inside the agreed scope.
from $5,000 · quoted in writing after scope
Who it is for
For product teams shipping a web app or API who need an authorized, scoped test before launch, after a major change, or to satisfy a customer or investor security review.
What is in scope
- Authentication, session handling, and access control — including vertical and horizontal privilege escalation
- IDOR and BOLA across object identifiers, plus mass-assignment and parameter tampering
- Injection classes: SQLi, NoSQLi, command injection, SSTI, and XSS (reflected, stored, DOM)
- SSRF, request smuggling and desync, and race conditions where the app has check-then-act logic
- Business-logic abuse the scanner cannot model: workflow skips, replay, and abuse of trusted flows
- Client-side and API authorization gaps — replaying a "guarded" request straight to the server
What you get
- Authenticated and unauthenticated testing within the agreed scope
- Severity-rated findings with reproducible proof-of-concept for each
- A clear narrative of the impact in plain terms, not just a CVSS score
- Concrete remediation guidance your engineers can act on
- A retest of fixes after remediation
Frequently asked
What is the difference between a web-app penetration test and a scanner run?
A scanner enumerates payloads; a penetration test chains them. Most serious issues — broken access control, IDOR, business-logic abuse — are invisible to a scanner because they require understanding what the app is supposed to do and then doing it wrong on purpose.
Do you need production access?
Not necessarily. A staging environment that mirrors production is usually preferable. The rules of engagement, targets, and any exclusions are agreed in writing before testing begins.
How is the test scoped and authorized?
Every engagement is scoped and authorized in writing first: targets, rules of engagement, testing windows, and out-of-scope items. Nothing is tested outside that scope, and findings stay between us.
Scope it in one message
Send the targets, the commit and the timeline. You get the rules of engagement and a fixed price.
References available on request. No client names or numbers are published without written consent. Part of an ongoing relationship instead? See the full service list.