Web application penetration testing icon

Web application penetration testing

CREST approved web application penetration testing by our world-leading cybersecurity experts.

Always available

Always available

Available to hackers 24x7 and brim-full of data, web applications present a tempting target. Our penetration testing relies on the manual exploitation of vulnerabilities so you get the assessment of business risk that only an expert tester can provide. We combine this with the use of the best automated tools.

All assessments are followed by a comprehensive report, with both non-technical and technical descriptions, alongside recommendations for remediation.

Visibility of risks

Visibility of risks

We provide full visibility of the risks.

  • Unauthorised access past authentication controls to escalate privileges
  • Introduction of malicious code
  • Manipulation of the application’s function
  • Defacing of the website or causing disruption
  • Authentication testing
  • Gaining access to the hosting infrastructure
Testing the cycle

Testing the cycle

Securing an application is about the full life-cycle – from development, through the in-life processes right through to de-commissioning. The testing will involve any DevOps methodology that is used by your company. The four areas are:

  • IAST: Interactive Application Security Testing
  • SAST: Static Application Security Testing
  • RAST: Run-Time Application Security Testing
  • DAST: Dynamic Application Security Testing

Our testing methodologies

We tailor penetration testing to your specific web application and have developed robust, yet flexible testing methodologies that will give you peace of mind. The tests are carried out from both the authenticated and un-authenticated perspective and will offer an evaluation of the application's security posture from both valid users and unauthorised users.

  • Scoping and planning
  • Application mapping
  • Automated vulnerability assessment
  • Fault injection testing/fuzzing
  • Authentication testing
  • Session handling/authorisation testing
  • Cross-site request forgery (CSRF)/Clickjacking checks
  • Cookie security
  • Information disclosure observations
  • Post exploitation evidence
  • Report
  • Debrief

Our accreditations

Crest
Check
Cyber essentials
ISO 27001
CEH Accreditation
CCISO Accreditation
CISSP Accreditation
CRISC Accreditation
OSCE Accreditation
OSCP Accreditation