Skip to content

Web application penetration testing

A web application penetration test is a manual, expert-led attack on your web app to find vulnerabilities before criminals do. Mr Cyber tests authentication, access control, business logic and data isolation to the OWASP Web Security Testing Guide, and delivers a fixed-price, audit-ready report with a free retest.

Fixed price from €2,900 · 3 test days · retest included

See my fixed price

Prefer to talk first? Book a call

admin-soehne.example/invoices Sign in #1043 · not yours Admin Editor Viewer Signed in as Viewer GET /invoices/1043 200 OK expected: 403
Signed in as a Viewer, one changed number opens another customer’s invoice.
  • 3–10 test days3 test days in the starting price
  • OWASP WSTG+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • SaaS companies whose enterprise customers ask for a recent pentest report
  • Teams preparing for ISO 27001, SOC 2 or a NIS2 audit
  • Companies launching a new portal, shop or customer platform
  • Products after a major release, rewrite or new authentication flow

What we test

Authentication & sessions

  • Login, registration, password reset, MFA bypass
  • SSO / OAuth 2.0 / OpenID Connect / SAML flows
  • Session handling, token lifetime, logout

Authorisation & multi-tenancy

  • Horizontal & vertical privilege escalation (IDOR, BOLA)
  • Tenant isolation in multi-tenant SaaS
  • Admin functions and role models

Business logic

  • Workflow and state manipulation
  • Price, quantity and limit tampering
  • Race conditions in critical transactions

Injection & input handling

  • SQL/NoSQL injection, command injection
  • Cross-site scripting (stored, reflected, DOM)
  • Server-side request forgery (SSRF), XXE, deserialisation

Files, data & configuration

  • File upload and download abuse, path traversal
  • Sensitive data exposure, error handling
  • Security headers, CORS, TLS, cookie flags

Client side & integrations

  • Third-party scripts and integrations
  • Webhooks and callbacks
  • Content Security Policy effectiveness
See my fixed price

Prefer to talk first? Book a call

How we test your web application. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
3
business days to the report
5
days for the free retest
60

Typically 3–10 testing days, depending on size and roles.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Recon & mapping

    Every role, page and API call charted.

    Test day 1

  3. Phase 3

    Manual testing

    Logins, access rights, input handling and business logic.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • OWASP WSTG
  • OWASP Top 10
  • OWASP ASVS
  • PTES
  • CVSS 3.1

How we test web applications

Every web application pentest starts with understanding what your application does: which data it protects, who its users are and what an attacker would want. We map all functions, roles and data flows, then attack them manually, following the OWASP Web Security Testing Guide (WSTG) as the checklist and our experience as the strategy.

Automated tools support the work (for coverage of known issues), but the findings that matter (access-control flaws, tenant isolation failures, business-logic abuse and chained attacks) come from manual testing.

Grey-box by default

We recommend testing with one or two accounts per role. This lets us test what really matters: can user A read user B’s data? Can a normal user reach admin functions? Can tenant A see tenant B? In a black-box test, much of the budget is spent getting in instead of testing what is behind the login.

Critical findings don’t wait for the report

If we find something critical during testing, for example exposed customer data, you hear from us the same day, with enough detail for your team to start fixing immediately.

Scoring you can act on

Each finding gets a CVSS 3.1 base score (CVSS 4.0 on request) and a business-risk rating that reflects your context. The remediation plan tells your developers what to fix first.

What you get

  • Executive summary for management and auditors
  • Every finding with reproduction steps, evidence and fix guidance
  • CVSS 3.1 scoring plus business-risk rating and prioritised remediation plan
  • Debrief call with your developers
  • Free retest and updated report confirming the fixes

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-014
Risk: High CVSS 3.1 · 8.2 Open · retest included

Admin area reachable without login

app.admin-soehne.example · /admin

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.

Steps to reproduce

  1. Open a private browser window, without logging in.
  2. Go to https://app.admin-soehne.example/admin.
  3. The admin dashboard loads, showing all customers and edit buttons.
GET /admin HTTP/2
Host: app.admin-soehne.example

HTTP/2 200
<title>Admin Dashboard</title> …

Business impact

Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.

Remediation

Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.

OWASP Top 10 2021: A01 Broken Access Control · CWE-306 (Missing Authentication for Critical Function)

Fixed price from

€2,900

3 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does a web application penetration test cost?
Fixed prices start at €2,900 for an application with up to 50 pages and one to three user roles. Larger platforms with many roles, tenants or integrations cost more. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
Do you test in production or staging?
Both work. Staging is ideal if it mirrors production. If we test production, test windows, rate limits and forbidden actions are agreed upfront and nothing destructive happens without your explicit approval.
What do you need from us?
The URL(s) in scope, two test accounts per role (ideally in two tenants for multi-tenant apps), a contact for emergencies and, if available, API docs. That’s it.
Black-box, grey-box or white-box?
We recommend grey-box (test accounts plus some documentation). It finds more in the same time than black-box, which means better value for your budget. White-box with source code access is available as a combination with our code review.
Can we use the report for customers and auditors?
The report is built for ISO 27001, SOC 2 and NIS2 evidence and for enterprise vendor-security questionnaires, with scope, methodology, CVSS ratings, dated results, retest confirmation and a one-page attestation letter. Whether it is accepted is up to your customer or auditor.
We already run an automated scanner. Why do we need this?
Scanners find known technical issues. The critical findings in web apps are usually broken access control and business logic flaws, which only a human tester finds. A pentest complements your scanner.

Related services

NIS2 & Compliance

Web application pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call