A web application penetration test is a controlled, authorised attack on your application carried out by a security professional — the same techniques a real attacker would use, but documented and remediated rather than exploited. The goal is simple: find the vulnerabilities in your application before someone malicious does.
What is a web application penetration test?
Unlike an automated vulnerability scan, a penetration test is a hands-on, manual assessment. A tester maps your application, understands its business logic and user roles, then attempts to break authentication, escalate privileges, access other users' data and chain weaknesses into real, demonstrable impact. Automated tools are used only to support that work — never to replace it.
Every engagement at Vesperis Security follows recognised industry standards: the OWASP Web Security Testing Guide (WSTG) for test coverage, the OWASP Top 10 for risk categorisation, and the Penetration Testing Execution Standard (PTES) for how the engagement is run end to end.
What we test
A typical engagement covers the full attack surface of a modern web application:
- Authentication & sessions — login flows, MFA, password reset, JWT and session handling, tested for bypasses, fixation and account takeover.
- Access control & IDOR — horizontal and vertical privilege escalation, insecure direct object references and broken multi-tenant isolation.
- Injection & XSS — SQL injection, command injection, server-side template injection, and stored / reflected / DOM cross-site scripting.
- APIs & GraphQL — broken object-level authorisation, mass assignment and excessive data exposure across REST and GraphQL endpoints.
- Business logic — workflow abuse, race conditions and price or quantity tampering that automated scanners cannot find.
- Configuration & infrastructure — security headers, TLS, CORS, file upload, SSRF and exposed services in the hosting stack.
Our methodology
No black boxes — you know exactly what happens at each stage:
- Scope — we agree targets, accounts and rules of engagement, then issue a fixed-price quote.
- Recon — mapping the application, endpoints, roles and technologies to plan the attack.
- Test & exploit — manual exploitation of every finding to prove real impact.
- Report — severity-rated findings with clear reproduction steps and remediation guidance.
- Retest — once you've fixed the issues, we re-test and confirm, included free.
What you get
The deliverable is a report your team can actually act on — not a rebadged scanner dump. It includes an executive summary for stakeholders, detailed technical findings with proof-of-concept steps, severity and business-impact ratings, and concrete remediation advice mapped to your stack. Once you've remediated, the free retest verifies the fixes and updates the report. Curious what a report looks like? See what's in a penetration test report.
Pricing
Pricing is transparent and fixed: £1,000 per web application, with automatic volume discounts the more applications you test — no hidden day rates. For a full breakdown, see our guide to web application penetration testing costs, or build an instant quote with the calculator.