Service
Web applicationpentesting
A researcher tests one web application against a written scope. The work covers how the product behaves for the roles you name, not a generic crawl of the marketing site.
01
Authentication and sessions
Sign-in, session lifetime, logout, password reset, and multi-factor flows that are actually in the product.
02
Access control
Whether each role can reach only the screens and actions it should, including direct requests that skip the interface.
03
Business logic
Workflows that are unique to the product: approvals, tenancy, billing state, and other rules a scanner will not understand.
04
Input and output
Injection classes, unsafe rendering, and file handling where the application accepts them.
05
Configuration
Headers, cookies, exposed administration paths, and verbose errors on the authorised host.
06
Limits
Denial-of-service, social engineering, and hosts you did not authorise are outside the test.
Same engagement, written limits
If the application has an API, it can be included in the same engagement. The quotation names both. Staging is the default environment. Production is tested only when the rules of engagement say so.
Ready to request a test?
Share the application and the reason. We reply in writing. No call is required.