Skip to content
RootCut
Portal
All services

Web application

One web application

We test one web application in depth, from authentication and session handling to access control, injection and business logic, using the OWASP Web Security Testing Guide as our baseline.

How we test

The web application penetration test assessed the security of the application listed under Scope & dates. Testing was done against the given base URL and covered the application's pages, APIs and user roles that were available during the test. Where test accounts were provided, the application was tested both without and with authentication.

The approach follows the OWASP Web Security Testing Guide (WSTG), and findings are mapped to the OWASP Top 10 where relevant. Automated scanners were used to support coverage; testing was mainly manual and every reported finding was verified manually.

Areas tested

  • Information gathering and configuration: technologies, exposed files and endpoints, HTTP security headers, TLS configuration and error handling.
  • Authentication: login, logout, password reset, multi-factor authentication, account lockout and credential handling.
  • Session management: session token strength, cookie attributes, session expiry and fixation.
  • Authorization: access control between users and roles, including horizontal and vertical privilege escalation and insecure direct object references.
  • Input handling: injection flaws such as SQL, command and template injection, cross-site scripting (XSS), server-side request forgery (SSRF) and file upload handling.
  • Business logic: abuse of the application's intended workflows, such as skipping steps or manipulating values.
  • Client-side security: cross-site request forgery (CSRF), clickjacking, CORS policy and sensitive data in the browser.
  • APIs: the same checks applied to API endpoints used by the application.

Limitations

  • The test is a point-in-time assessment of the application version available during the test dates.
  • Features, roles or environments that were not available or not provided during the test were not covered.
  • The underlying hosting infrastructure was only tested as far as it was reachable through the application.
  • Denial-of-service testing was not performed unless stated in the scope.
  • The absence of a finding does not guarantee that the application is free of vulnerabilities.