Web Application Penetration Testing

Web Application Penetration Testing – service by Suvendu Dash

Web application penetration testing is a manual, attacker-style assessment of your web app. I look for the vulnerabilities that automated scanners miss, such as broken access control, business logic flaws and chained issues, and show you exactly how each one could be exploited and fixed.

I spent five years securing fintech products at INDmoney and have reported vulnerabilities to more than 30 companies, including Apple, Microsoft and OpenAI. I test your application the same way.

What I test

  • Authentication and sessions: login, password reset, MFA, SSO/OAuth flows and session handling.
  • Access control: IDOR, privilege escalation and horizontal or vertical access to other users’ data.
  • Injection: SQL, NoSQL, command, template and other server-side injection.
  • Client-side issues: XSS, CSRF, clickjacking, CORS and postMessage problems.
  • Server-side request and file handling: SSRF, path traversal, file upload and XXE.
  • Business logic: payment, coupon, workflow and rate-limit abuse that only a human tester finds.
  • Configuration: security headers, TLS, exposed admin panels, debug endpoints and information leaks.

How I work

Testing follows the OWASP Web Security Testing Guide and covers the OWASP Top 10, but it is not a checklist exercise.

  1. Scoping: we agree the target URLs, user roles, test accounts and testing window.
  2. Reconnaissance and mapping: I map every function, role and API call the application exposes.
  3. Manual testing: each function is tested for the issues above, with tools such as Burp Suite used to support, not replace, manual work.
  4. Exploitation and validation: every finding is confirmed with a safe proof of concept, so there are no false positives.
  5. Reporting and retest: you get the report, a walkthrough if you want one, and a retest once fixes are in place.

What you get

  • An executive summary written for non-technical stakeholders.
  • Every finding with severity (CVSS), impact, step-by-step reproduction and evidence.
  • Clear, developer-friendly remediation advice for each issue.
  • A retest to confirm the fixes work.

Related services

Most web apps sit on top of an API, so many clients combine this with API penetration testing and a secure code review.

Get started

Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Contact me to discuss your web application.