Home / Knowledge hub / Web application penetration testing
Knowledge hub
Web application penetration testing
A pentest focused on a web app, its APIs and the logic behind them.
What it means
Web application penetration testing is a security test of a website or web app, together with the APIs behind it. The tester looks for vulnerabilities, proves the important ones by exploiting them under agreed rules, and reports what was found and how to fix it. The test is carried out with written permission, within a defined scope.
It differs from a network test, which looks at servers and ports. Here the target is the application itself: sign-in, sessions, forms, access rules, file uploads and the business rules that make your product yours. It is the right test when the thing you most need to protect is the product itself.
Why it matters
Your web app is the part of the business customers and attackers can both reach from anywhere. It holds the data, takes the payments and runs the workflows. A flaw here can mean leaked records, taken accounts or money moved the wrong way.
Customers and auditors also ask for it. Security questionnaires, enterprise contracts and frameworks such as PCI DSS often expect regular application testing. A report with proof of what was exploited shows that the test went beyond a list of possible problems.
How it shows up
Typical coverage follows the OWASP Top 10: injection, broken access control, authentication and session flaws, misconfiguration, vulnerable components and server-side request forgery. A good test adds the logic of your own product, such as coupons, roles, approvals and multi-step flows.
Mistakes repeat: testing only the public pages, giving no accounts, leaving the APIs out of scope, and treating the report as the end. Provide accounts, list every environment and API, and plan the fix and retest. Agree the scope first.
Questions people ask
Web application penetration testing, answered
How is it different from a vulnerability scan?
A scan looks for known issues using automated checks and reports possibilities. A pentest confirms which are real by exploiting them and also looks for logic flaws a scan cannot recognise.
Many teams use both.
How long does a web app pentest take?
It depends on size: the number of features, roles and APIs. A small app may take days, a large one weeks.
Ask for the method and the scope before the price.
Should the APIs be in scope?
Yes. Modern web apps are thin clients over APIs, and API endpoints often expose more than the interface shows.
A test of the pages alone misses much of the real surface.
Do we need to test again after fixing?
Yes. A fix should be confirmed against the exact flaw that was reported.
Otherwise you only know that someone changed the code, not that the weakness is gone.
How often should we test?
At least before major releases and after significant changes, and often enough to satisfy customers' and regulators' expectations.
Many teams add continuous or scheduled testing between full tests.
Sources
Where this comes from
Related
Terms that sit next to this one
API penetration testing
A pentest aimed at your API's endpoints, auth, data access and business rules.
OWASP Top 10
A widely used list of the ten most critical web application risks.
Penetration test scope
The written list of what a pentest may and may not touch.
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Which parts of your app got tested?
We find vulnerabilities in web apps and their APIs using black-box, grey-box and white-box testing, and report only what we actually exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.