// web & api
Web & API penetration testing
We test your web apps and APIs the way an attacker would — manual-first, mapped to the OWASP WSTG, exercised with your real user roles. The focus is impact: chaining access-control and logic flaws into proven, reproducible breaches, not a scanner dump.
// scope
What's in scope
We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.
- Authentication, session management and account recovery
- Authorization: IDOR, broken access control, multi-tenant isolation
- Injection: SQLi, NoSQLi, command, SSTI, XSS
- Business-logic and workflow abuse
- API-specific: mass assignment, verb tampering, rate limits
- SSRF, open redirect, CORS and request smuggling
- GraphQL introspection, batching and authorization
- JWT / OAuth flows: alg:none, RS256→HS256, scope abuse
- Denial-of-service / stress testing (excluded by default)
- Social engineering of your staff (available as red team)
- Physical access (available as red team)
- Third-party SaaS you don't own (needs their authorization)
// method
How we test it
Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.
- 01
Scope & authorize
We agree in-scope hosts, roles and exclusions in a signed authorization letter before any traffic.
- 02
Recon & map
Enumerate subdomains, endpoints, JS bundles and parameters; reconstruct the real API surface, authenticated and anonymous.
- 03
Exploit
Test each endpoint for its matching bug classes —
?id=→IDOR, URL param→SSRF, login→auth bypass — and chain them. - 04
Validate
Kill false positives against a strict gate. Only proven, reproduced impact makes the report.
- 05
Report & retest
CVSS-scored findings with evidence and fixes, then one free retest to confirm closure.
// deliverables
What you get
A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.
- Executive summary with risk at a glance
- Per-finding writeup: CVSS 3.1/4.0, evidence, reproduction steps, remediation
- Raw request/response traffic for every finding
- Developer-ready fix guidance, not generic advice
- A free retest of every finding after you fix
- A short readout call to walk your team through the report
// faq
Common questions
Do you just run a scanner?
No. Scanners help us cover ground, but every finding is reproduced and proven by a person. We never put unverified scanner output in a report.
How long does a test take?
Most web + API tests run 5–15 person-days depending on roles, endpoints and complexity. We size it precisely once we see the app.
Will you test production?
We can test staging or production. For production we agree safe limits in the scope letter and avoid anything destructive — no DoS, no data damage.
What about GraphQL or JWT?
Both are in scope by default: GraphQL introspection, batching and object-level auth; JWT algorithm confusion, weak secrets and scope abuse.
Ready to scope this?
Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.