Executive Summary
Located at the beginning of the Report and no longer than one page, it is the high-level summary intended for Management.
Flaws that Scanners Miss
Manual Web Application Penetration Test, based on OWASP and OSSTMM
Web Application Penetration Test (WAPT)
The Web Application Penetration Testing service is one of the application security services (Application Security Assessment) offered by ISGroup.
Web applications are now prevalent and increasingly sophisticated, in addition to being critical for all web-based businesses.
Critical components of a web portal, an E-Commerce application, or a web platform will be analyzed.
Using manual techniques and multiple appropriate tools, the tester is able to identify both obvious and hidden vulnerabilities.
As with client/server applications, web applications generally suffer from improper client request handling and a lack of or improper validation and control by the developer.
Given the nature of web applications, they are completely exposed and accessible: this makes "security through obscurity" impossible and imposes the need for resilient application code.
Secondly, web applications process data from HTTP requests, a protocol that allows for multiple encodings and different encapsulations.
Description
A Web Application Penetration Test represents a simulation of an attacker against a site, portal, or web application. Testing initially consists of discovering and identifying all resources exposed on the target.
In parallel, the tester performs an analysis of the business logic to verify that there are no conceptual issues.
At this point, before testing the web applications themselves, the infrastructure is checked for known and unknown vulnerabilities.
Once valid entry points are identified, we proceed with the attack attempt, which aims for the deepest and most extensive compromise possible.
Subsequently, with the aid of tools and manual testing, each parameter is tested with predefined values, and generic attack techniques for the platform in use are attempted.
Given the level of access obtained, we will attempt to perform unauthorized actions, extract data from the backend database, retrieve files or source code from disk, modify information, and, where possible, obtain full control of the machine and neighboring systems.
The Report
You will receive a clear, detailed document divided into three areas.
Vulnerability Details
The technical part that describes in detail the vulnerabilities found and their impact, dedicated to the Security Manager.
Remediation Plan
A technical section with precise instructions on how to resolve the identified issues, dedicated to developers.
How much does it cost
From €5,000 + VAT
For a single web application. The price increases with the number of applications and APIs, user roles and access levels, critical flows to be tested and test environments.
Show your commitment
At the end of the Web Application Penetration Test, you receive a signed document in Italian and English stating the activity, period and scope. Unlike the report, it contains no vulnerabilities or technical details, so you can give it to anyone who requests it without exposing sensitive information. It is included in the service.
Certificate of execution
IT / EN
- Client
- Activity
- Period
- Scope
ISGroup
Web Application Penetration Test
and compliance
PCI DSS
Tests exposed web applications, APIs and authentication in public-facing application tests and penetration tests required by PCI DSS Requirements 6.4.2 and 11.4.
NIS2
Assesses the effectiveness of application cybersecurity measures and identifies exploitable vulnerabilities, as required by NIS2 Article 21(2)(f).
DORA
Tests web applications and APIs for financial services and documents the results for the programme under DORA Articles 24-25.
GDPR
Examines applications processing personal data and produces technical results for the regular testing required by GDPR Article 32(1)(d).
ISO/IEC 27001
Identifies exploitable vulnerabilities in web applications and APIs and documents remediation priorities in support of ISO/IEC 27001:2022 control A.8.8.
OWASP WSTG
Applies structured tests to configuration, identity, authentication, authorisation, sessions, input and application logic following the OWASP WSTG testing areas.
Frequently asked questions about
Web Application Penetration Testing
What does a Web Application Penetration Test check?
A Web Application Penetration Test checks the security of websites, portals, e-commerce platforms and APIs within the agreed scope. The tester maps pages, APIs, roles, flows and entry points, analyses the business logic where relevant and attempts controlled exploitation of vulnerabilities with the agreed user profiles, combining manual testing with tools.
How is it different from an automated scan or a Vulnerability Assessment?
A Web Application Penetration Test adds manual testing and controlled exploitation to vulnerability identification. A Vulnerability Assessment identifies and evaluates vulnerabilities without the same exploitation. For infrastructure and network services the dedicated service is the Network Penetration Test; for iOS and Android apps it is Mobile Application Security Testing.
What is needed to start and how long does the test take?
The duration of the Web Application Penetration Test is stated in the proposal after the scope has been defined. The proposal specifies the applications and APIs involved, test environment and mode, user accounts, roles, critical flows, and the agreed effort or time-box.
How much does a Web Application Penetration Test cost?
A Web Application Penetration Test starts at €5,000 + VAT for a single web application. The price increases with the number of applications and APIs, user roles and access levels, critical flows to be tested and test environments.
What does the report contain and can I see an example?
The technical report describes the vulnerabilities found, their priorities, and a remediation plan; the Professional and Advanced levels also include an executive summary. The full report remains confidential, but a consultant can show an anonymised example during a call. A signed Certificate of execution, without technical details, is also included for delivery to third parties.
Is vulnerability retesting included?
The retest reassesses the reported vulnerabilities after the fixes and indicates whether each one is fully resolved, partially resolved, unresolved or not testable. It is optional for €5,000 projects and included in higher-value projects.
Which methodology do you follow?
The Web Application Penetration Test uses the OWASP guidelines for web application security and PTES as technical references. Scope, testing mode and effort are defined in the proposal for each application.
Shape your security priorities into a tailored proposal