Access control
Unauthorised access to pages, data and functions, including server-side requests (SSRF).
home / services
service · web
Web penetration testing and OWASP Top 10 for applications
We check the most common risk categories in web applications, with reproducible proofs and a fix for every confirmed vulnerability.
what it covers
The categories we check.
Cryptography and sensitive data
Sensitive data in clear text, weak ciphers, exposed secrets.
Injection
Input that changes how a database, system or browser behaves.
Insecure design
Controls missing by design choice, not by mistake.
Security misconfiguration
Default settings, debug features, missing headers.
Vulnerable components
Libraries and frameworks with known vulnerabilities or outdated versions.
Authentication
Sessions, passwords, reset flows, limits on attempts.
Software integrity
Updates and dependencies installed without integrity checks.
Logging and monitoring
Security events that are not recorded.
Exceptional conditions
Errors that leave the system in an unsafe state.
how we work
A fixed method, with a person at the end.
Mapping
Recon lists pages, endpoints, roles and technologies in scope.
Hypotheses per category
For each category, the plan proposes checks with a written reason.
Controlled test
Checks use only actions from the closed list, each one logged.
Review
A person reproduces each vulnerability and assigns the severity.
Report
For each vulnerability: reproduction steps, impact and suggested fix.
included and not included
What you receive, and what is not in the service.
Included
- Report with reproduction steps
- Severity assigned by a person
- Suggested fix for every confirmed vulnerability
- List of what was verified and what was not
Not included
- Testing without a signed authorisation
- Denial-of-service testing
- Social engineering or physical attacks
- Testing of third-party systems
service sheet
To get started.
| Item | Detail |
|---|---|
| Type of test | Black box or gray box, with test roles provided by the client |
| To start, we need | Verified domain, signed scope, at least two test roles |
| Delivery | Report, action log, summary for the manager |
| Price | from €1,500 to €3,500 |
Want an OWASP Top 10 test on your application?
We reply by hand with a written proposal.