Web application pentest
We test your application with and without login, role by role, to find what a malicious user could access, change or bypass, and show how to fix it.
- InputForms, parameters and uploads
- IdentityLogin, password recovery and session
- Access across rolesWhat each role reads and changesExample: a regular role opens another client's order by changing the number in the URL.
- Business rulesOrders, approvals and payments out of sequence
- Data and integrationsData exposure and third-party calls
What is a web application pentest?
A web application pentest is a specialized security assessment designed to identify vulnerabilities in web applications, APIs and internet-facing systems. The goal is to find exploitable flaws before real attackers take advantage of them.
Technologies we assess
- React
- Next.js
- Node.js
- PHP
- Java
- .NET
- Python
- AWS
- Azure
- Kubernetes
- REST APIs
- GraphQL
You know what is exploitable and what to fix first.
Every finding comes with evidence, a justified severity, the impact the test demonstrated or the potential one when exploitation was not taken further, and the recommended fix.
- Executive report
- A strategic summary for leadership and decision-making.
- Technical report
- Complete technical detail with evidence and reproduction steps.
- Remediation plan
- Recommendations prioritized by risk and impact.
- Retest of fixes
- Validation of the applied fixes, when included in the contracted scope.
From reconnaissance to report
Manual testing supported by tools, referencing the OWASP Testing Guide and PTES.
- 01
Reconnaissance
Mapping the attack surface and technology stack.
- 02
Analysis
Automated testing backed by manual validation.
- 03
Controlled exploitation
Safe validation of the real impact of each vulnerability.
- 04
Documentation
Delivery of executive and technical reports.
Vulnerabilities tested
Vulnerability classes assessed, based on the OWASP Top 10 and the OWASP Testing Guide.
- 01SQL Injection
- 02Cross-Site Scripting (XSS)
- 03Broken Authentication
- 04Broken Access Control
- 05SSRF
- 06CSRF
- 07XXE
- 08Business Logic Flaws
- 09REST and GraphQL APIs
- 10Sensitive Data Exposure
- 11Misconfiguration
- 12Vulnerable Components
Frequently asked questions
What is the difference between a pentest and a vulnerability scan?
A vulnerability scan is automated and flags potential vulnerabilities. A pentest involves specialized manual analysis to validate real-world exploitation and business impact.
Does the pentest follow OWASP?
Yes. We follow the OWASP Top 10, the OWASP Testing Guide and internationally recognized methodologies.
Do you test APIs?
Yes. We test REST, GraphQL and SOAP APIs, including authentication, authorization and business-rule validation.
Can the pentest affect production?
Tests are controlled and planned to minimize impact. For critical environments, we recommend testing in staging.
Do you sign an NDA?
Yes. An NDA can be signed before any sensitive information is shared.
How long does the project take?
The timeline depends on the scope of the application and is estimated in the proposal, before you commit.
Related articles
Tell us about the application.
With the address, the environment and the goal of the test, we define scope, effort and timeline.
- Hours
- Monday to Friday, 9am to 6pm
- Confidentiality
- NDA before any sensitive information
- +55 (15) 99745-2589
Request a proposal
We reply during business hours, Monday to Friday, 9am to 6pm (BRT).