Web Application Penetration Testing
Manual testing against OWASP WSTG and the OWASP Top 10 — broken access control, injection, SSRF, insecure deserialization, authentication failures and business-logic flaws.
Web application penetration testing is a manual assessment of a browser-based app against the OWASP Web Security Testing Guide and the OWASP Top 10. Passeca finds and exploits real vulnerabilities — broken access control, injection, SSRF, insecure deserialization, authentication failures and business-logic flaws — chains them into attack paths, and reports each with evidence and developer-ready remediation.
What concrete vulnerabilities do we test for?
Mapped to the OWASP Top 10. These are vulnerability classes attackers target, including issues automated scanners may miss.
Broken access control
IDOR and forced browsing to other users' resources, missing function-level authorisation, and privilege escalation — consistently the #1 web risk.
Injection (SQLi / XSS)
SQL injection leading to data exfiltration, and reflected, stored and DOM-based cross-site scripting enabling session theft and account takeover.
Server-Side Request Forgery (SSRF)
Forced server-side requests that reach internal services, cloud metadata endpoints and otherwise-unreachable network segments.
Insecure deserialization
Object payloads that execute code or alter control flow on deserialisation, a frequent route to remote code execution.
Authentication failures
Credential stuffing, weak password policy, broken session management, JWT weaknesses and multi-factor-authentication bypass.
Business-logic flaws
Workflow abuse the scanner cannot see — negative quantities, race conditions on transfers, coupon replay and step-skipping.
Methodology for web applications
OWASP WSTG provides the test-case catalogue; PTES provides the engagement framework. Coverage is documented finding-by-finding in the report.
Testing is organised around the OWASP Top 10 risk categories and the OWASP Web Security Testing Guide (WSTG) checklist. Each engagement covers information gathering, configuration and deployment, identity management, authentication, authorisation, session management, input-validation and output-encoding, and business-logic testing.
We work authenticated and unauthenticated, across user roles, to find access-control and privilege-escalation flaws that only surface when multiple roles are exercised. Business-logic testing is manual throughout — no scanner can reason about your workflows.
Example findings from real (anonymised) web tests
The classes of issues Passeca repeatedly finds in production web applications. Severity is graded by CVSS combined with business impact.
IDOR on order API permitted reading other customers' invoices
An authenticated user could enumerate order IDs and download any invoice in the system, exposing personal and financial data.
Stored XSS in profile bio escaped the CSP and ran admin context
A stored payload in a user profile executed in an administrator's browser when the profile was reviewed, enabling full admin-account takeover.
SSRF reached cloud metadata, yielding temporary credentials
A URL-import feature fetched attacker-controlled endpoints; chained to the cloud metadata service it exposed short-lived IAM credentials.
JWT accepted the 'none' algorithm, bypassing signature checks
A legacy token-validation path accepted unsigned tokens, allowing an attacker to forge arbitrary claims including roles.
Findings are anonymised and paraphrased. Specific reproduction steps are reserved for the engagement report.
How long does a web app pentest take, and what does it cost?
Driven by the number of distinct application areas, user roles, and whether source code is provided (white-box finds more, faster).
| Engagement size | Typical duration | Price band |
|---|---|---|
| Focused — single app, few roles | 3–5 days | Price on request |
| Standard — multi-role SaaS app | 1–2 weeks | Price on request |
| Complex — multi-app estate, white-box | 2+ weeks | Price on request |
For a precise estimate, use the free pentest scoping tool.
What's in the report?
Built for developers, leadership and auditors in a single document.
- Executive summary — risk in business terms for leadership.
- Graded findings — CVSS and business impact per finding.
- Reproduction steps & evidence — so developers can reproduce and confirm fixes.
- Developer-ready remediation — prioritised, with references to secure patterns.
- Compliance mapping — to PCI DSS, ISO 27001, SOC 2, DORA and NIS2 testing requirements.
- Remediation retest — fixes retested within the engagement window.
Which compliance requirements does this satisfy?
A web application penetration test is evidence for multiple regimes at once.
| Framework | Relevant requirement | How the pentest maps |
|---|---|---|
| PCI DSS | Req. 11.4 | Annual application & network penetration testing |
| ISO 27001:2022 | A.8.25 / A.8.29 | Acquisition & technical-vulnerability testing |
| SOC 2 | CC4.1 | Monitoring of system performance & security |
| DORA | Art. 24–25 | Digital operational resilience testing |
| NIS2 | Art. 21 | Risk-based security measures, evidenced |
Web application pentest, answered
Scoping, methodology, frequency and compliance for web application testing.
What is web application penetration testing?
Which methodology is used for web app pentests?
What is the difference between automated scanning and manual web testing?
Do you need source code to test a web application?
Does web app pentest satisfy PCI DSS, ISO 27001 and SOC 2?
How often should a web application be penetration tested?
List your app areas and roles — get a day estimate
The free pentest scoping tool converts your application surface into a day estimate and price band, then hands to Passeca's offensive-security team for a precise quote.
Related