Web Application Penetration Testing

Web Application Penetration Testing – service by Suvendu Dash

Web application penetration testing is a manual, attacker-style assessment of your web app. I look for the vulnerabilities that automated scanners miss, such as broken access control, business logic flaws and chained issues, and show you exactly how each one could be exploited and fixed.

I spent five years securing fintech products at INDmoney and have reported vulnerabilities to more than 30 companies, including Apple, Microsoft and OpenAI. I test your application the same way.

Web application penetration testing in India

I am based in India and work with startups, fintech and SaaS companies across the country, as well as clients abroad. Testing is scheduled in IST, so issues can be discussed with your developers the same day.

For Indian businesses, a web application penetration test also helps you show due diligence for the frameworks you follow, such as the RBI cyber security guidelines for regulated entities, SEBI’s cybersecurity and cyber resilience framework, or your data protection duties under the Digital Personal Data Protection (DPDP) Act, 2023. Findings are mapped to the OWASP Top 10 and OWASP ASVS, so your auditors and engineers can both use the report. See all my cybersecurity services in India.

What I test

  • Authentication and sessions: login, password reset, MFA, SSO/OAuth flows and session handling.
  • Access control: IDOR, privilege escalation and horizontal or vertical access to other users’ data.
  • Injection: SQL, NoSQL, command, template and other server-side injection.
  • Client-side issues: XSS, CSRF, clickjacking, CORS and postMessage problems.
  • Server-side request and file handling: SSRF, path traversal, file upload and XXE.
  • Business logic: payment, coupon, workflow and rate-limit abuse that only a human tester finds.
  • Configuration: security headers, TLS, exposed admin panels, debug endpoints and information leaks.

How I work

Testing follows the OWASP Web Security Testing Guide and covers the OWASP Top 10, but it is not a checklist exercise.

  1. Scoping: we agree the target URLs, user roles, test accounts and testing window.
  2. Reconnaissance and mapping: I map every function, role and API call the application exposes.
  3. Manual testing: each function is tested for the issues above, with tools such as Burp Suite used to support, not replace, manual work.
  4. Exploitation and validation: every finding is confirmed with a safe proof of concept, so there are no false positives.
  5. Reporting and retest: you get the report, a walkthrough if you want one, and a retest once fixes are in place.

What you get

  • An executive summary written for non-technical stakeholders.
  • Every finding with severity (CVSS), impact, step-by-step reproduction and evidence.
  • Clear, developer-friendly remediation advice for each issue.
  • A retest to confirm the fixes work.

Related services

Most web apps sit on top of an API, so many clients combine this with API penetration testing and a secure code review.

Get started

Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Contact me to discuss your web application.