Web Application Testing
Quoted on scope, fixed price. Includes the Vexil platform and a hand-verified retest.
Teams who have had us test their systems
- Selip & Stylianou, LLP
What this covers
Your web app is your storefront, your product, and your customers' first experience of your business. It's also the most exposed attack surface you have. We test SPAs, server-rendered apps, GraphQL backends, and legacy monoliths against the OWASP Testing Guide and ASVS standards. Every test is a mix of automated scanning (Burp Suite Pro, Nuclei, Semgrep) and manual exploitation - we don't just flag "possible XSS," we demonstrate it with a working proof-of-concept. You get a findings report organized by endpoint, a prioritized fix roadmap your sprint team can execute, and direct access to the tester who found each issue. Professional tier includes a free re-test after remediation.
- Ship features without the fear of introducing critical bugs
- Pass penetration-test requirements in enterprise vendor assessments
- Get findings your dev team can actually reproduce and fix in-sprint
- Build a security reputation that helps close bigger deals
Scope
What gets tested
Ten areas, agreed on the scoping call and written into the rules of engagement before anything starts.
Authentication & Authorization
Login, password reset, MFA bypass, OAuth/OIDC misconfigurations, JWT analysis, role escalation, horizontal and vertical access control.
Input Validation & Injection
SQLi, NoSQLi, command injection, SSTI, XXE, LDAP injection, header injection, and deserialization across all user-facing inputs.
Session Management
Token generation weakness, missing secure flags, cookie attributes, logout handling, session fixation, and concurrent session policies.
API Endpoints
REST, GraphQL, WebSocket - BOLA/IDOR, mass assignment, rate limiting, introspection leaks, batch query abuse, subscription exhaustion.
Client-Side Security
XSS (reflected, stored, DOM-based), CSP bypass, CORS misconfigurations, CSRF, clickjacking, postMessage manipulation.
File Upload & Storage
Malicious upload bypass, path traversal, S3 bucket exposure, content-type validation, server-side image processing bugs.
Business Logic Flaws
Checkout price manipulation, coupon abuse, 2FA bypass, workflow logic, race conditions in critical flows.
Multi-Step Attack Chains
Chaining auth bypass with IDOR, injection with privilege escalation - real attack paths, not isolated findings.
OWASP Top 10, ASVS & WSTG
Full coverage aligned to OWASP Testing Guide v4.2 and Application Security Verification Standard.
SANS Top 25 & CWE Top 25
Most dangerous software errors and common weakness enumeration - actively exploited in the wild.
Why a scan is not a test
What a scanner misses here
For part of it. But the problems that cost you money sit behind a login, and a scanner cannot log in as two people and compare what they see. A person can.
Scanner
Finds what is there
- Reflected XSS in obvious parameters
- Known CVEs in the framework
- Missing security headers
- Outdated JavaScript libraries
- Directory listings left switched on
Fast, and worth running.
Tester
Finds what is broken
- An id in a URL that returns someone else’s invoice
- A checkout that trusts the price the browser sent
- A reset link that still works a week later
- An admin page that only hides its link
- Two low findings chained into account takeover
This is where the real risk is.
We run both, in that order. Tool output is kept separate from what a tester wrote, so you always know which is which.
Book a Free ConsultationMethodology
How the work is done
Repeatable, documented, and tracked as coverage inside the platform so you can see what has been looked at.
- 01
Recon & Map
Crawl every endpoint, parameter, and user role. Build an auth matrix and data-flow map - typically a 1-hour walkthrough call.
- 02
Scan & Exploit
Deep manual analysis of your application logic. We find vulnerabilities automated tools miss, chain low-severity issues into real attack paths, and validate every finding by hand.
- 03
Report & Triage
Findings sorted by exploitability, not just CVSS. Each includes reproduction steps, a fix recommendation, and a severity rating your team agrees on.
- 04
Re-test & Sign Off
Post-remediation verification of every fix. Updated report confirming resolved findings, ready to share with customers.
Why it matters
What you get out of it
OWASP Top 10 & Beyond
Full coverage of injection, broken auth, sensitive data exposure, XXE, access control, misconfigurations, XSS, deserialization, known vulns, and logging gaps.
Business Logic Testing
We find the flaws scanners can't: coupon abuse, price manipulation, 2FA bypass, race conditions in checkout, and privilege escalation chains.
Auth & Session Deep-Dive
JWT analysis, OAuth2/OIDC misconfigurations, session fixation, weak password policies, MFA bypass testing, and role-based access control validation.
Dev-Ready Reproduction
Every finding includes a cURL command, request/response pair, and suggested fix in framework-specific terms (Express, Django, Rails, Laravel, Next.js).
CI/CD Integration Support
We help you integrate DAST scanning into your pipeline so regressions are caught automatically after our engagement ends.
Re-test Guarantee
Verification testing is included - we confirm every patch before you close the ticket.
What you receive
Delivered in the platform as the work happens, and exportable as a document whenever you need one.
- Executive summary - 2-page risk overview for leadership and board
- Technical findings report - each vuln with CVSS, proof-of-concept cURL, and fix guidance
- Auth matrix - visual map of every role, endpoint, and permission tested
- Remediation roadmap - findings grouped by sprint size (small/medium/large)
- Video walkthrough - screen-share deep-dive of every high and critical finding
- Re-test report - verification confirmation after fixes
Standards we test against
Coverage is tracked against these inside the platform, so “what did you actually check” has an answer.
- OWASP Top 10
- OWASP ASVS
- OWASP WSTG
- CWE Top 25
- SANS Top 25
- PCI-DSS
- NIST CSF
In their words
What clients said about web application testing
Cybersecly conducted a thorough penetration test of our web application and APIs. Their team identified several critical security weaknesses that had been missed during previous assessments and provided clear remediation guidance. The final report was well-structured, actionable, and helped us improve our overall security posture significantly.
Head of Information Security, financial services
Named and attributed on request, with the client’s permission. Most testing work is covered by an NDA, so we publish the role and the sector rather than the company.
The anatomy of a finding
This is one finding.
Not a report. One finding, with every field it carries and why each field is there. Yours will look like this.
Vexil · Finding
Published- Titlewhat it is, in your engineers’ words
The checkout accepts a price the browser sent.
- Affected assetthe specific endpoint of the application
The basket total is recalculated only in the client.
- POST /checkout/confirm
- Severitycomputed from the vector, never chosen by hand
- high
- CVSS 3.1 · 6.5
- AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CWE-602
- Evidencethe request, the response and screenshots, attached to the finding
An order for £249.00 completed at £2.49 and reached the fulfilment queue.
- "unitPrice": 2.49
- Impactwhat it costs you, not what the CVE says
Every order is priceable by the customer placing it. The loss is direct, ongoing and invisible until reconciliation.
- Remediationfor your stack, not “apply vendor patches”
Price the basket server-side from the catalogue at confirmation and ignore any price in the request body.
- Retesta tester’s verdict, not your self-assessment
Retest passed. Verified by hand, recorded with the date and the tester.
This is the format, not a client’s work - it is written against the demonstration environment we run for the purpose, and a real finding also carries screenshots of the issue alongside the request and response. We don’t publish client findings, redacted or otherwise. If you want to see a real one, email us and we’ll send a redacted sample.
Pricing
What changes the price
Every engagement is quoted on scope rather than hours. These are the four things that move it, and they are what we work through on the call.
Applications
How many
Size
Pages and user journeys
User roles
How many to test
Authentication
SSO, MFA, tenancy
Delivered on the Vexil platform
Each finding lands with the request and response that prove it, so an engineer reproduces it without a call. Assign it to whoever owns that route, and ask for a retest when it is fixed.
See the platformFAQ
Questions about web application testing
Do you test SPAs and JavaScript-heavy apps, or just server-rendered pages?
We test both - and everything in between. SPAs get special attention on API endpoints, JWT handling, and client-side state management. We use Burp Suite Pro with DOM-traversing crawls and manually test every API call the SPA makes. React, Vue, Angular, Svelte - we have testers who know each framework.
Will this slow down our CI/CD pipeline?
The manual engagement runs alongside your normal sprints - we schedule testing windows that work around your release cycle. After the engagement, we help you integrate automated DAST into CI/CD so regressions are caught at build time, not on the next pen test.
Do you test staging or production?
We strongly prefer staging - it gives us more freedom to test aggressively. If only production is available, we run rate-limited, non-destructive tests during agreed low-traffic windows. We always brief your on-call team before testing begins.
What if our app uses micro-frontends or has a complex architecture?
Those are our favourite engagements. We map every micro-frontend, BFF (backend-for-frontend), and shared service. Scope and price follow the number of distinct applications, which is one of the things the scoping call establishes.
How do we know the fixes actually work?
A re-test is included in the engagement. After your team marks findings as resolved, we re-test every one and issue a confirmation report. If something is still open, we flag it with updated reproduction steps and you can request another retest from the same screen.
Can you test behind our SSO or VPN?
Yes. We can test authenticated areas using test accounts, VPN access, or even on-site if needed. We'll set up access during the scoping call. We treat your credentials with the same care as our own - all test data is purged after the engagement.
Scope your web application testing engagement.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform against your own scope.