Web application & API testing
Web application penetration testing
Scanners find the obvious. We find the access control flaws, broken business logic and chained bugs that lead to real data breaches.
Who it is for
- SaaS companies whose customers ask for a recent pentest report
- Teams shipping a new application or a major release
- Organisations handling personal, payment or health data
- Anyone whose app has never been tested by a human
What we cover
Authentication & sessions
Login, MFA, password reset, session handling and SSO integrations.
Access control
Horizontal and vertical privilege escalation, IDOR and multi-tenant data separation.
Injection & input handling
SQL, NoSQL, command and template injection, XSS, SSRF and file upload abuse.
Business logic
Workflow bypasses, race conditions, pricing and quota abuse: the bugs scanners cannot see.
APIs
REST and GraphQL endpoints, including mobile and single-page app backends.
Configuration
Security headers, TLS, CORS, cloud storage exposure and information leakage.
How it works
Scope
A short call to understand the app, its user roles and what matters most to you. You get a fixed quote.
Test
Manual testing using the OWASP Testing Guide and ASVS as a baseline, with tooling to support coverage.
Report
Clear findings with evidence and fixes your developers can act on. Critical issues are flagged the same day.
Retest
We verify your fixes and issue an updated report you can share with customers.
What you get
- Executive summary for leadership and customers
- Technical findings with CVSS ratings, evidence and remediation
- Same-day notification of critical findings
- Debrief call with your developers
- Free retest of remediated findings
- Letter of attestation for customers on request
Frequently asked questions
Can't find your answer? Ask in the form below and we will get back to you as soon as we can.
How long does a web application test take?
Most applications take 3 to 10 days of testing, depending on size, the number of user roles and whether there is an API. We confirm the exact effort in your quote after a scoping call.
Can you test our production environment?
Yes, and we do it carefully. We agree rules of engagement first, avoid destructive tests and can work outside business hours. A staging environment that mirrors production is often the best option.
Do you need our source code?
No. Most tests are black-box or grey-box, meaning we test with valid user accounts but no source code. If you can share code, we can also do a code-assisted review, which usually finds more for the same effort.
Do you test APIs and mobile app backends?
Yes. Share an OpenAPI/Swagger file or a Postman collection if you have one. If not, we map the API from the application traffic.
What does the report look like?
You get a management summary written for non-technical readers, then a technical section with every finding rated by risk. Each finding has evidence, steps to reproduce and clear remediation advice. We walk you through it on a debrief call.
Is a retest included?
Yes. Once you have fixed the issues, we retest the findings rated critical, high and medium within 90 days of the report at no extra cost, and give you an updated report.
Get a fixed quote
A few quick questions so we can scope it properly. No obligation, no hard sell.
Thanks, we have your enquiry.
We will reply as soon as we can. If it is urgent, email hello@redstackd.com.