Application Security
Web application pentest, run by an adversary.
Hybrid manual and tooled testing of your web apps, APIs, and auth flows. OWASP WSTG v4.2 is the floor, the depth comes from operator-built business-logic abuse cases that no standard covers.
What we test
Every layer of the application.
Coverage maps to OWASP WSTG v4.2, ASVS v4.0.3, the API Security Top 10, and the CWE Top 25, then goes further by hand. Authorization and business logic get the deepest push, because that's where the real breaches live.
Information Gathering
Subdomain enumeration, CT-log review, exposed dev branches, GitHub/GitLab secret leakage, and framework version fingerprinting.
Configuration & Deployment
Security headers, CSP and CORS, TLS and cipher posture, backup files, exposed .git, and forgotten debug endpoints.
Identity & Authentication
Login, registration, MFA, SSO and OAuth flows, password reset, plus username enumeration and timing attacks on auth endpoints.
Authorization
IDOR/BOLA across every role pair, horizontal and vertical privilege escalation, forced-browse enumeration, and cross-tenant exposure on multi-tenant SaaS.
Session Management
Cookie attributes (SameSite, HttpOnly, Secure), JWT algorithm confusion and alg:none, token entropy, and logout invalidation across devices.
Input Validation
SQLi, NoSQLi, LDAP, command and template injection; SSRF including blind and cloud-metadata abuse; XXE, deserialization, and prototype pollution.
Error Handling
Stack-trace leakage, verbose ORM errors, debug pages, and error responses that leak state as an oracle.
Cryptography
JWT algorithm substitution, padding oracles, weak randomness, and key storage, KMS usage, and rotation.
Business Logic
Workflow bypass and skip-step abuse, race conditions on coupon/refund/withdraw endpoints, TOCTOU, and multi-step privilege chains.
Client-Side
DOM XSS, postMessage abuse, CSP bypass, prototype pollution, and client-side template injection.
API Testing
REST, GraphQL, and gRPC. Mass assignment, BOLA/BOPLA, rate-limit bypass, GraphQL introspection, alias abuse, and query-depth DoS.
How it works
Manual-led, evidence-first.
Tools find the obvious. Operators find the rest. Every engagement runs the same disciplined path, and everything is triaged by hand.
Recon & mapping
We enumerate the real attack surface, subdomains, endpoints, roles, and APIs, so testing is driven by how the app actually works, not a generic checklist.
Manual + tooled testing
Burp, Semgrep, and hand testing across all WSTG phases. Authorization and business logic get the deepest push, with abuse cases built for your specific workflows.
Exploit & prove
Every finding is reproduced and shipped with a curl or Burp project you can replay in minutes, never a raw scanner claim you have to take on faith.
Report & retest
WSTG-mapped findings with clear remediation guidance, then a retest to confirm the fixes actually hold, signed off by the named operator who tested.
What you get
Deliverables you can act on.
Executive Summary
Board-ready PDF: risk register, trend, and the headline finding, in plain language.
Technical Report
Full WSTG-mapped findings with reproduction steps and operator notes.
Remediation Pack
JIRA-ready CSV with CVSS, CWE, and suggested fix snippets.
Detection Recipes
Sigma and Splunk rules for every exploit chain we landed.
Live Findings Stream
A shared Slack channel, findings posted as we land them, not weeks after.
Retest Letter
Signed letter confirming fixes verified by the named operator who tested.
FAQ
Questions, answered.
What's in scope for an application test?
Do you test against production or staging?
Do you need credentials or test accounts?
Which standards do you follow?
Is a retest included?
Brief us on the application.
Tell us what you need tested. An operator replies within one business day.