Web Application Penetration Testing
Whether you are approaching a release gate, closing a compliance gap, or responding to a client security mandate, our CREST-certified consultants conduct manual web application security testing that finds what automated tooling cannot: business logic flaws, broken access control chains, and authentication vulnerabilities with direct business impact. Tested application types include customer portals, SaaS products, e-commerce platforms, financial transaction systems, patient record portals, admin dashboards, and mobile app backends.
Web Application Security Testing:
Beyond the Scanner
Automated web application security testing tools find syntax-layer vulnerabilities. Our consultants follow the OWASP Testing Guide v4.2 and OWASP ASVS Level 2 to find the logic-layer vulnerabilities that represent real business risk: the ones that automated scanners are architecturally incapable of detecting.
Business Logic Analysis
We don't stop at XSS. We test whether a user can buy an item for £0.00 by manipulating the checkout flow, access another customer's orders by changing an ID parameter, or escalate from standard user to admin by modifying a JWT claim. These are the vulnerabilities that cause data breaches. Automated scanners cannot find any of them.
OWASP Top 10 & Beyond
We test every OWASP Top 10 (2021) category, A01 Broken Access Control through A10 SSRF, using both automated tooling and targeted manual test cases from the OWASP Testing Guide v4.2. Every finding is mapped to its OWASP category, assigned a CVSS v3.1 score, and verified with proof-of-concept reproduction steps.
Authentication Attacks
Rigorous testing of session management, OAuth flows, and multi-factor authentication implementation. We actively attempt to bypass login portals, hijack active user sessions via JWT manipulation, and exploit flawed password reset mechanisms.
API Security Testing
Modern web apps are powered by APIs. We conduct deep-dive assessments on REST and GraphQL endpoints, testing for excessive data exposure (BOLA/IDOR), mass assignment vulnerabilities, and rate-limiting failures that scanners routinely miss.
Data Integrity & Validation
Ensuring your application correctly sanitises inputs to prevent SQL injection, XSS, data corruption, and server-side compromise across all user-controllable input vectors.
Supply Chain & Ops
Checking for outdated libraries, dependency confusion, and misconfigurations in your serving infrastructure that could provide a foothold for attackers.
Web App Risk Profile
Web applications remain the primary attack vector for modern breaches. 96% of tested applications carry at least one serious vulnerability.
Vulnerability Rate
Of web applications tested have at least one serious vulnerability.
Breach Vector
Of all data breaches start with a web app exploit. The primary vector for data exfiltration and ransomware.
Compliance Frameworks
Testing satisfies PCI DSS v4.0, ISO 27001, SOC 2, GDPR, CE Plus, and NHS DSPT, documented for auditors.
Controls
What We Find That Scanners Cannot.
Anonymised examples from recent web application penetration testing engagements. These are the critical vulnerabilities that automated tools are architecturally incapable of detecting.
Insecure Direct Object Reference (IDOR)
Authenticated users could access any other customer's loan application by incrementing the application_id parameter in /api/v2/applications/{id}. The API performed no authorisation check on the requesting user's ownership of the resource.
JWT Algorithm Confusion
The application accepted JWT tokens signed with the HS256 algorithm using the RSA public key as the HMAC secret, allowing an attacker to forge admin-level tokens using only the public key.
Payment Flow Manipulation
The total_price parameter in the order confirmation POST request was accepted directly from the client and not recalculated server-side, allowing a user to purchase any product for £0.01.
CORS Misconfiguration with Credential Inclusion
The API trusted any origin in CORS headers when credentials were included, allowing a malicious site to make authenticated cross-origin API calls on behalf of a victim user.
When Do Organisations Commission This Test?
Web application penetration testing is typically triggered by one of these six scenarios. If any of these apply, you are in the right place.
Pre-Launch Security Gate
New application or major release approaching go-live and your stakeholders require independent security sign-off.
Compliance Audit Finding
Your ISO 27001, PCI DSS, SOC 2, or Cyber Essentials Plus audit has identified web application testing as a control gap.
Client or Partner Mandate
A client, partner, or enterprise buyer has requested evidence of third-party web application penetration testing.
Scanner Verification
Your automated DAST tooling reported clean and you want human verification before trusting that result.
Post-Incident Assessment
A recent security incident or near-miss has prompted a post-event web application security assessment.
Cyber Insurance Renewal
Your cyber insurance renewal requires evidence of penetration testing activity against internet-facing applications.
Mapped directly to your regulatory controls.
Our CREST-certified report includes a compliance mapping matrix that cross-references our exact technical findings to the specific framework clauses your auditor requires.
PCI DSS v4.0
Bespoke software security and web-facing application penetration testing
ISO 27001:2022
Management of technical vulnerabilities
SOC 2 Type II
Detection and monitoring of security events
GDPR
Appropriate technical measures for data protection
Cyber Essentials Plus
Web application security testing requirements
NHS DSPT
Security testing of systems processing patient data
DORA
ICT testing requirements for financial entities
Globally Accredited Consultants
All testing is conducted by CREST-certified professionals.
Engagement Workflow
Structured to minimise operational friction and maximise the value of the testing window.
Scoping & Mapping
We build a comprehensive attack surface map of all entry points, APIs, and roles during a 30-minute scoping call.
Threat Recon
Mapping high-risk business logic flows and authentication mechanisms before a single payload is sent.
Manual Exploitation
Systematic testing of OWASP Top 10 and complex privilege escalation chains. Criticals reported immediately.
Report & Retest
Encrypted delivery of your Executive and Technical reports, followed by a debrief call and free 90-day retest.
Choose Your Testing Scope
The level of access we're given determines the depth and focus of the engagement. Select the model that matches your threat scenario.
All engagements follow CREST and OWASP methodologies.
Grey Box Business Case
Proactive security testing is no longer just an IT requirement. Our reports are built to satisfy three core mandates:
Regulatory & Compliance
Mandatory evidence for ISO 27001 (Annex A.9), PCI DSS (Req 11.3), GDPR Art 32, and NHS DSPT frameworks.
Enterprise Sales Enablement
Satisfy procurement hurdles, vendor risk assessments, and enterprise customer security questionnaires with CREST-accredited evidence.
Cyber Insurance
Reduce premiums and ensure policy payouts by demonstrating proactive security posture to underwriters.
300% ROI of Prevention
For every £1 spent on testing, organisations avoid an average of £3 in breach costs.
What You Get
Every web application penetration test includes the following deliverables, formatted for both technical teams and non-technical stakeholders.
Reports and findings are delivered live via our penetration testing online portal with role-based access. Also available in PDF and DOCX formats.
Close the Loop.
After the Test.
Your web application penetration test identifies what is exploitable today. We feed those exact findings into our 24/7 Managed SOC and EdgeProtect attack surface management, building custom detection rules for your application's specific attack surface and continuously monitoring your external perimeter for new exposures between annual tests.
Explore Defensive ServicesEdgeProtect ASM
Continuous attack surface monitoring of your web application perimeter and external exposures.
24/7 SOC Monitoring
Custom detection rules tuned to the specific findings from your penetration test.
Internal Network Testing
Pair with internal infrastructure testing for complete security posture coverage.
SSO Assessment
Identity provider misconfiguration review for apps using single sign-on.
Full Penetration Testing Catalogue
Comprehensive penetration testing services tailored to your environment.
Internal Testing
Post-perimeter assessments targeting Active Directory, lateral movement, privilege escalation, and segmentation validation from inside your network.
The best time to test your defences is now.
Join the high-growth companies relying on Precursor for continuous offensive and defensive security.
Frequently Asked Questions
Common questions about this service, methodologies, and deliverables.
Web application penetration testing typically costs between £3,750 and £8,750 depending on application complexity, number of user roles, and scope. A standard single web application test for a small-to-medium application averages £3,750-£6,250 for 3-5 days of testing covering OWASP Top 10, business logic flaws, and API security. Complex applications with multiple user roles, extensive functionality, or custom frameworks typically cost £6,250-£8,750. Multi-application testing (customer portal, admin portal, mobile app backend) ranges £8,750-£13,750+. We provide fixed-price quotes after a scoping call to understand your application architecture and testing requirements.
A vulnerability scan is an automated process that identifies known software vulnerabilities by matching versions and configurations against a database of CVEs. A web application penetration test involves a human tester who understands your application's business logic and actively attempts to exploit vulnerabilities, including flaws that have no CVE entry because they arise from the way your specific application is designed. Scans produce high volumes of findings (many false positives). Penetration tests produce a smaller number of confirmed, exploitable vulnerabilities with proof-of-concept evidence and specific remediation steps. For compliance purposes, most frameworks (PCI DSS, ISO 27001) distinguish between vulnerability scanning and penetration testing. Only a manual penetration test satisfies the requirement for independent security testing.
A standard web application penetration test takes 3-5 business days of testing time, with the full engagement (scoping to report delivery) typically completed within 10-15 business days. Timeline depends on application complexity: a simple web application with two user roles typically takes 3 days; a complex SaaS platform with multiple user tiers, extensive API surface, and custom authentication flows may require 5-7 days. We provide a detailed timeline at scoping. Urgent pre-launch testing can often be accommodated within 5-7 business days.
Yes. PCI DSS v4.0 Requirement 6.2.4 mandates security testing of bespoke and custom software, and Requirement 11.4.2 specifically requires penetration testing of web-facing applications. A web application penetration test conducted by a qualified, independent third party satisfies both requirements. We provide a CREST-certified test certificate and executive summary formatted for direct submission to your Qualified Security Assessor (QSA). If you require penetration testing as part of a broader PCI DSS scoping exercise, see our dedicated PCI DSS compliance testing service.
Automated scanners excel at finding common syntax-based vulnerabilities (XSS, SQL injection patterns) but miss business logic flaws that require human reasoning. Scanners might flag 100+ potential issues (many false positives), but manual testers identify the 5-10 critical issues that actually matter: 'Can User A access User B's orders by changing an ID?', 'Can I purchase items for £0.00 by manipulating the checkout flow?', or 'Can I escalate from basic user to admin by modifying JWT claims?'. These logic vulnerabilities represent 60-70% of critical security issues in modern web applications but are completely invisible to automated tools that only understand syntax, not business context.
If we discover critical vulnerabilities during testing, we keep going. We exploit them to verify the full extent of the risk — that is how you understand the real-world impact. Critical findings are surfaced immediately via the live portal so your team can see them as we work. All findings remain confidential and are delivered via our penetration testing portal with role-based access controls.
Professional penetration testing is designed to be non-destructive and safe: (1) All testing is conducted under signed legal agreement defining scope, rules of engagement, and liability, (2) We use read-only exploitation techniques wherever possible (testing for vulnerabilities without triggering them destructively), (3) Test accounts and dummy data are used instead of real customer information, (4) We maintain detailed testing logs for full audit trail and accountability, (5) CREST certification requires demonstrated competency in safe testing practices, and (6) We carry professional indemnity insurance covering any unintended damage. In 10+ years of testing, we have never caused application downtime or data loss when following agreed testing procedures.
We recommend testing in a staging or UAT environment that mirrors production to avoid any risk to live users. If production testing is required (no staging environment exists, or testing must validate production-specific configurations), we use test accounts, non-destructive payloads, and coordinate timing with your team to minimise impact. We never exfiltrate customer data, store sensitive information, or access data beyond what is necessary to demonstrate vulnerability impact. All testing activities are logged, and findings are delivered via an encrypted portal with role-based access controls. For sensitive production testing, we can conduct testing during maintenance windows or low-traffic periods.
For most organisations commissioning their first web application test, the choice of testing approach depends on what you want to simulate. For web applications, we generally recommend Grey Box (authenticated) testing. Providing credentials allows us to test the deeper logic of the application as a logged-in user, which is where 90% of critical vulnerabilities (IDOR, privilege escalation, business logic flaws) are found. Black box testing simulates an external attacker with zero knowledge, useful for testing login security and public-facing surfaces. White box testing includes source code review, identifying vulnerabilities in code logic before deployment.
Yes, if the web application communicates with an API, we test the API endpoints exercised by the application during normal web browsing. However, this only covers APIs actively used by the web interface. For a dedicated, comprehensive API assessment (covering unlinked endpoints, authentication flows, rate limiting, and OWASP API Top 10), we recommend our dedicated API penetration testing service.
Yes. Our CREST-certified web application penetration testing report is specifically structured to satisfy third-party auditors across ISO 27001:2022 (Annex A.8.8), PCI DSS v4.0 (Requirements 6.2.4 and 11.4.2), SOC 2 Type II (CC7.1), GDPR Article 32, and Cyber Essentials Plus. The report includes an executive summary written for non-technical reviewers, CVSS-scored technical findings, and a compliance mapping section that explicitly cross-references which findings are relevant to each framework. We can also provide a Letter of Attestation if your auditor requires an independent confirmation of testing scope and CREST accreditation status.
Yes. We provide website penetration testing and web application security assessment for all types of web-based systems: from marketing websites and CMS platforms (WordPress, Drupal, Craft CMS) to complex web applications including SaaS platforms, customer portals, e-commerce sites, and financial transaction systems. Website penetration testing for a straightforward site with limited functionality typically costs £3,750 to £6,250. A comprehensive web application penetration test for a complex, multi-role platform costs £3,750 to £8,750. We recommend a scoping call to confirm the right test type and pricing for your specific system.