Web applications are among the main targets of cyber attacks, since they are reachable over the Internet and frequently process or store sensitive information belonging to clients, partners and employees.
Beyond data protection, many Web applications are essential to company operations and must remain continuously available. A successfully exploited vulnerability can lead to information leakage, service downtime, fraud, compromise of user accounts and many other business impacts.
The goal of a Web Application Pentest is to identify vulnerabilities before they can be exploited by criminals, allowing fixes to be applied proactively and significantly reducing the risk of security incidents.
Depending on the agreed scope, the assessment of Web applications may include:
APIs are responsible for the communication between Web applications, mobile applications, internal systems and third-party services. In many cases they concentrate all the business logic, authentication, authorisation and access to the information of the organisation.
Even when a Web application appears to be protected, a vulnerable API can allow an attacker to access sensitive data, bypass access controls or perform unauthorised operations directly through the exposed endpoints.
For that reason APIs have become one of the main targets of modern attacks and should be assessed with the same depth applied to Web applications.
In most current systems, Web applications and APIs work together. While the Web application is the interface used by people, the APIs are responsible for processing requests, applying business rules and accessing information. Whenever both are part of the agreed scope, the two layers are assessed together to provide a broader view of the attack surface.
Depending on the agreed scope, the assessment of APIs may include:
The assessment of Web applications is based on the OWASP Web Security Testing Guide (WSTG) and on the vulnerabilities described in the OWASP Top 10.
The assessment of APIs follows the recommendations of the OWASP API Security Top 10, one of the main international references for API security testing.
Most of the work is carried out manually by specialists, with automated tools used only to support reconnaissance, mapping and initial checks.
This approach makes it possible to identify vulnerabilities that automated scanners usually miss, particularly flaws related to authentication, authorisation, access control, business logic, tenant isolation and validation of the rules implemented by the application.
All tests are executed in a controlled manner, within the scope authorised by the company, seeking to minimise impact on normal application operation.
At the end of the assessment we deliver a technical report and an executive report containing everything needed to support the remediation of the vulnerabilities identified.
The report includes:
Alongside the technical report we also provide a Penetration Test Attestation Letter, a document that certifies the tests were carried out and can be used as evidence in audits, compliance processes, vendor approval and with clients and business partners.