Offensive Security
Web Application Penetration Test
Authenticated, manual testing of web applications against the OWASP Web Security Testing Guide and ASVS, including business-logic and access-control flaws.
Testing only starts after we receive written authorisation from the system owner and both sides sign off the scope and rules of engagement.
Overview
We test your web application the way a determined attacker would, going beyond automated scanners to the logic and authorisation flaws that cause real breaches.
What you get
- Executive summary for leadership
- Technical report with CVSS v3.1-rated findings
- Proof-of-concept evidence and reproduction steps
- Prioritised remediation guidance for your team
- Debrief session and one retest of fixed findings
How we work
- 01Scoping and rules of engagement: targets, test windows, accounts and signed authorisation
- 02Reconnaissance and attack-surface mapping
- 03Manual testing supported by tooling, exploiting findings safely to prove impact
- 04Reporting: risk-rated findings with evidence and fix guidance
- 05Debrief with your team, then a retest of the fixes
More Offensive Security services
- API Penetration TestTesting of REST and GraphQL APIs against the OWASP API Security Top 10: broken object-level authorisation, authentication, rate limiting and token handling.
- Mobile Application Penetration TestStatic and dynamic testing of iOS and Android apps against OWASP MASVS and MASTG: data storage, transport security, reverse engineering and backend APIs.
- Network Penetration TestExternal and internal infrastructure testing following PTES: exposed services, Active Directory attack paths, lateral movement and network segmentation.
- Cloud Penetration TestAdversarial testing of AWS, Azure and GCP environments: IAM privilege escalation, exposed storage and services, and cross-account trust abuse.
- Red Team & Social EngineeringObjective-based adversary simulation mapped to MITRE ATT&CK, including phishing campaigns and assumed-breach scenarios, to test detection and response.
- Remediation RetestVerification testing of fixed findings from a previous penetration test, with an updated report and an attestation letter for customers and auditors.
Have a project to scope?
Tell us your objectives and constraints. We reply within one business day.