Key points
- Authenticated testing across every role — most serious findings only exist behind a login.
- Business-logic abuse is tested by hand; scanners cannot find a checkout that accepts a negative quantity.
- Mapped to OWASP ASVS and the OWASP Top 10 for evidence you can hand to a customer or an auditor.
- Free retest of every fixed finding within 30 days.
Most breaches in web applications are not exotic. They are an object ID that can be incremented, a password reset token that never expires, an admin route protected only by the UI not rendering a link, or a file upload that trusts the content-type header. These are found by a human with an account and a proxy, not by a nightly scan.
What the engagement covers
Access control and authorisation
Horizontal and vertical privilege escalation, IDOR across every object reference, tenant isolation in multi-tenant products, and forced browsing to routes the interface hides.
Authentication and session handling
Password reset and email-change flows, MFA bypass, session fixation and invalidation, token lifetime and revocation, OAuth and SSO misconfiguration, and account enumeration.
Injection and input handling
SQL, NoSQL, template, command and LDAP injection, XSS in all three contexts, XXE, deserialisation, and file upload handling that leads to code execution.
Server-side and infrastructure flaws
SSRF into cloud metadata, path traversal, request smuggling, cache poisoning, exposed debug and admin interfaces, and misconfigured CORS and security headers.
Business logic
Race conditions in payment and inventory flows, coupon and pricing manipulation, workflow steps that can be skipped or replayed, and rate limits that only exist on the front end.
Client-side security
DOM XSS, prototype pollution, postMessage handling, third-party script exposure, and secrets shipped inside the JavaScript bundle.
How it runs
-
01
Scope and rules of engagement
URLs, roles, test accounts, test window and written authorisation. Destructive testing is opt-in only.
-
02
Mapping and threat model
Every route, parameter and role is enumerated, then ranked by what an attacker would actually want.
-
03
Manual testing
Tool-assisted but human-driven testing across the full ASVS control set relevant to your application type.
-
04
Exploitation and impact proof
Confirmed exploitation with the smallest safe proof of concept — enough to prove impact, never enough to damage data.
-
05
Report and walkthrough
Findings ranked by exploitability and business impact, delivered with a live remediation session.
-
06
Free retest
Fixes verified and the report reissued with closure status within 30 days.
What you receive
- Executive summary and risk narrative for non-technical stakeholders
- Findings with CVSS 4.0 scoring, evidence, requests and reproduction steps
- Framework-specific remediation guidance your developers can merge
- OWASP ASVS coverage matrix at the verification level you need
- Remediation walkthrough call
- Retest report and attestation letter
Who this is for
- SaaS platforms with multi-tenant data
- E-commerce and marketplace products
- Teams answering enterprise security reviews
- Pre-launch products handling money or PII
Questions about this engagement
Black box or grey box?
Grey box by default: credentials for every role plus architecture context. It finds more real issues per rupee than pretending not to know how the application is built.
Can you test in production?
Yes, with agreed limits — no denial-of-service testing, no bulk data extraction, and a nominated contact reachable during the test window. Staging is safer where it mirrors production.
Will this satisfy our enterprise customer's security questionnaire?
The report, the ASVS coverage matrix and the attestation letter are written for exactly that use. Tell me which framework the customer references and the mapping is included.
What if you find nothing critical?
That happens on mature products, and the report says so plainly. You still get the coverage matrix, the medium and low findings, and hardening recommendations — evidence of diligence is part of the deliverable.