Web Application Penetration Testing
Your web app has vulnerabilities.
Let's find them first.
CREST-accredited penetration testing for web applications and SaaS. Manual OWASP-aligned testing, and not a vulnerability scan.
- CREST-accredited
- Consultant-led testing
- Transparent pricing
Application Security Testing
What our testing covers
We test your application the way an attacker would, probing authentication, access controls and business logic by hand and chaining findings to show where they lead. You get a working list of what's exploitable, in order of business risk, rather than a generic vulnerability count.
If you're preparing for your first assessment, our guide to scoping a web application penetration test covers what to prepare and what to expect.
Typical web application attack surface
- Authentication & session handling
- Access control & user roles
- Injection & input handling
- Business logic & workflows
- APIs & third-party integrations
Why run a pentest?
The findings that cause real damage are usually logic and access control flaws, not the issues a scanner flags. They're only discovered when someone tests the application the way an attacker would.
Who Needs This
Who needs web application penetration testing?
Any organisation whose web applications handle sensitive data or business logic and are used by customers, partners or staff.
Get a Web App PentestSaaS and platform providers
Multi-tenant platforms carry a high blast radius, and access control between tenants is where we most often find serious issues.
Financial services
Portals and trading platforms need testing across every authenticated role, where privilege escalation and IDOR are frequently critical.
Healthcare organisations
Patient data behind web interfaces is tightly regulated, and session management and access control weaknesses are common findings. See healthcare penetration testing for NHS DTAC and DSPT.
Startups with new deployments
Testing before go-live catches authentication, injection and API flaws while they are still cheap to fix.
Our Pentest Methodology
OWASP aligned testing approach
Exploitr's pentest methodology is aligned with the OWASP Web Security Testing Guide (WSTG), Application Security Verification Standard (ASVS) and OWASP Top 10, and tailored to your application's technology stack, authentication model and business logic.
Our penetration testing methodology sets out how every engagement runs, from scoping to debrief.
01
Authentication
MFA bypass, password policy weaknesses and authentication flow flaws.
02
Injection Vulnerabilities
SQL injection, command injection, LDAP injection, XML injection, and server-side template injection across all input vectors.
03
Business Logic Flaws
Race conditions, workflow bypass, price manipulation, payment logic abuse, and other application-specific vulnerabilities.
04
Session Management
Session hijacking, cookie security, token handling, timeout configurations, and cross-site request forgery (CSRF) protections.
05
API Security
REST and GraphQL API testing, rate limiting, authentication mechanisms, data validation, and API-specific vulnerabilities aligned with the OWASP API Top 10.
06
Client-Side Security
Cross-site scripting (XSS), DOM-based vulnerabilities, insecure JavaScript libraries, and client-side logic manipulation.
07
Access Control
Horizontal and vertical privilege escalation, insecure direct object references (IDOR), forced browsing, missing function-level access controls, multi-tenancy and role-based access bypass.
08
Infrastructure & Configuration
Security headers, TLS/SSL configuration, subdomain takeover risks, and server misconfigurations that impact application security.
Testing scope
How we scope testing: authenticated and unauthenticated
Scope is driven by your application's functionality, user roles and risk, not the number of pages. Most assessments combine unauthenticated and authenticated testing.
Unauthenticated testing
Simulates an anonymous attacker with no credentials, covering publicly accessible functionality, input validation, error handling, and anything reachable without an account.Authenticated testing
We test every privilege level your application supports, from standard users to administrators, targeting privilege escalation, IDOR and access controls. We use self-registration where it exists, or sample credentials you provide.White-box (source code)
Where source code or architecture documentation is available, we can incorporate that context into a more informed review.
API Testing Scope
When is the API included in a web application test?
Most web application and mobile app engagements include the API behind the application. Focused API penetration testing is only required where there is no front-end consumer in scope.
| Factor | Included in the web application price | Adds testing time | Scoped as API testing |
|---|---|---|---|
| User roles | The roles in scope are tested in the application and in its API together. | Each additional role adds access control paths to test, so testing time grows with the number of roles. | Roles alone do not create separate API scope. |
| Tenants | Tenant isolation is tested in the application and in its API together. | Each additional tenant and tenancy boundary adds testing time. Multi-tenant products are usually scoped as SaaS testing. | Tenants alone do not create separate API scope. |
| Authentication methods | Authentication the API shares with the application, such as login, sessions, tokens or single sign-on. | Additional authentication flows, such as MFA or several identity providers, add testing time. | Authentication used only by the API, such as partner API keys, client credentials or mutual TLS, is scoped as API testing. |
| Endpoints | Endpoints the application's own front end calls, tested through the application. | A larger or more complex application, or a GraphQL or multi-service backend, adds testing time. | Endpoints the front end does not call, such as public, partner, internal or admin APIs, are scoped as API testing based on their number and complexity. Endpoints called only by a mobile app belong to mobile application testing. |
| Integrations | Integrations the application depends on, such as identity providers, payment callbacks and inbound webhooks. | Each additional integration, and any custom handling of third-party data, adds testing time. | An API you provide for customers or partners to build against is scoped as API testing. |
| Business logic | Standard forms, dashboards and create, read, update and delete functions. | Multi-step workflows, approvals, payments and custom rules add testing time in proportion to their complexity. | Business logic alone does not create separate API scope. |
Pricing
From £2,100
for web application penetration testing
Not sure where your application fits? A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Reply within one business day
Pricing Examples
| Unauthenticated testing One website or application, public pages only, about 2 to 3 days | £2,100 - £3,150 |
| Small web application Up to 2 user roles and standard functionality, including the API behind it | £3,150 - £4,200 |
| Multi-role business application 3 or more roles, multi-step workflows, several integrations or a more complex backend | £4,200 - £6,300 |
| Enterprise platform Fine-grained permissions, complex business rules, and multi-tenant SaaS platforms | £6,300 - £9,450+ |
Indicative ranges only. Additional roles, modules and complex business logic add testing time. Your exact price is confirmed after a short scoping conversation.
Compare all our penetration testing services.
What's Included
- Fixed-price proposal agreed before testing starts, excluding VAT
- Typical testing time: 2 to 6 days, depending on user roles, functionality and application size. Complex platforms take longer
- Manual, consultant-led testing. Not automated scans
- Report within 2 business days of testing completion
- Free focused retesting included to verify remediation
- Debrief call with the consultant who tested your application
Reporting
Pentest reports built for technical and executive teams
Every engagement produces a report for two audiences: technical teams who need the detail to fix issues, and business stakeholders who need to understand the risk.
- Executive summary: A concise overview of risk, critical findings, and recommended next steps, written for non-technical stakeholders.
- Technical findings: Each vulnerability documented with a severity rating, reproduction steps, affected component, CVSS score, and remediation guidance.
- Live findings in the Exploitr platform: View findings as they're logged during testing, track remediation progress, and request retests from the finding itself.
Ready to secure your web application?
Get a fixed-price quote. Our team will review your application's scope and provide a tailored testing proposal that fits your timeline and budget.
Common Questions
Web application penetration testing: frequently asked questions
Web application penetration testing starts from £2,100 for a 2-day unauthenticated test of one site or application, and from £3,150 for an authenticated test of a small application, with most engagements costing between £2,100 and £6,300 and complex platforms from £6,300 to £9,450+. The main cost drivers are the number of user roles, how much authenticated functionality is in scope and the complexity of the business logic.
Our penetration testing pricing guide compares costs across every service.
Most web application pentests take 2-6 days depending on the scope and complexity of the application, and complex platforms with many roles and modules can take longer. Testing can be performed against development, staging, or production environments.
Reports are delivered within 2 business days of testing completion. For a full walkthrough of what happens from scope agreement through to report delivery, see what to expect during a web application pentest.
Whilst penetration testing comes with an inherent risk, we use safe testing techniques and coordinate with your team to minimise any potential impact.
Testing is typically performed in non-production environments, though production testing can be conducted with appropriate safeguards in place.
Yes. The API endpoints your application's own front end calls are tested through the application and included in the price, using the same user roles as the application. A larger application, or a GraphQL or multi-service backend, adds testing time.
An API that partners or customers call, authentication used only by the API (such as API keys or mutual TLS), and endpoints the front end never calls are scoped as API testing and priced in the same quote. See when API testing is included for the full breakdown.
For API-only products, we offer dedicated API penetration testing.
Yes, we test web applications regardless of platform, including CMS sites such as WordPress, e-commerce platforms such as Shopify, custom applications in any language, and single-page applications built with React, Angular or Vue.
The approach is tailored to the platform. For WordPress, we focus on plugins, themes, authentication and CMS misconfiguration. For Shopify, on custom app logic, integrations and checkout flows. For custom applications and SPAs, on the full application surface, including the API backend and client-side logic.
For a simple brochure or CMS site, a 2-day unauthenticated test from £2,100 is usually the right size, and we confirm the fixed price in your proposal.
Annual testing at minimum, with additional testing after major releases, significant feature additions, or architectural changes.
Many organisations benefit from continuous testing through our Pentest as a Service offering.
We recommend scheduling a web application penetration test at least 4-6 weeks before a product launch or major release. This allows time for testing, reporting, and remediation of any critical vulnerabilities that may be discovered.
If your timeline is shorter, we can discuss expedited testing options. Schedule a scoping call to discuss your product, launch timeline, and testing needs.