We test your application like an attacker who has time on their hands: technically, along the way from the browser into the database, and logically, along your workflows. A scanner does not know your discount rules.
OWASP Top 10 as the basis, ASVS for depth
Every finding with payload and PoC
Critical findings reported immediately
The path of a request, and where it breaks open
The four hotspots are the places where we find something most often.
Someone else's ID in the parameter, and the response contains someone else's data. The most common finding in API-first applications.
3
Injection and input
SQLi, template and command injection, XSS, SSRF, file uploads.
4
Business logic
Race conditions, illegal state changes, prices and bookings that can be manipulated.
Technology and logic are two different tests
Technology
Automated coverage as the background noise
Known vulnerability classes, outdated libraries
Token handling, headers, transport security
Repeatable and comparable over time
Logic
Can only be found by hand, no tool understands your business
Is this user allowed to trigger this step, and to do so in this order?
What happens when two requests arrive at the same time?
Prices, quotas, cancellations, approvals, role models
What your developers get
The exact payloads we used to trigger the bug
Screenshots or short videos of the attack path
The path step by step, reproducible locally
A prioritisation instead of an alphabetical list
We deliver the test and the technical evidence. Certification and legal advice are not part of it.
Process
01
Scoping and architecture
Capture the role models, endpoints, auth flows, APIs and the critical workflows.
02
Recon and mapping
Collect UI flows, parameters, tokens, endpoints and feature toggles, both by hand and with automated tools.
03
Technical attacks
Go through the four hotspots systematically, confirm the findings and exploit them.
04
Logic and workflows
Run workflows against what they were meant to do: order, concurrency, limit values, prices.
05
Reporting
Reproducible findings with PoC, prioritisation and technical recommendations for the fix.
Standards
The OWASP Top 10 are the basis; the systematic depth comes from the OWASP ASVS 5.0: its 17 chapters, from authentication and authorisation through input validation and cryptography all the way to logging, are gone through chapter by chapter. The report is therefore suitable as evidence in audits.
Duration
A reliable test usually takes 5 to 14 days. What tips the balance is the number of user roles, the amount of dynamic input and complex workflows such as payment or file upload. A monolithic application is a different matter from a microservice architecture with fifty endpoints. The estimate is ready after the scoping call.
Critical findings go out immediately
Full database access or code execution will not wait until the final report. In that case you receive a phone call or a short message from us and can start patching while we continue testing. This applies even when the finding has nothing to do with the focus we agreed on beforehand.
Why web apps are so rewarding
Many entry points
Every function, every parameter and every API route can become an entry point.
More than technology
Many vulnerabilities are not in the code but in the workflow: pricing, booking logic, role models.
API-first means attacker-first
Modern applications break down into frontend, API and backends. The more parts, the more transitions where permissions are checked incorrectly.
Frequently asked questions
Isn't an automated scan enough?
For known vulnerability classes it is a good start. But it knows neither your roles nor your workflows. Whether two discount codes that are supposed to exclude each other can be combined is only noticed by someone who has understood the application.
What is different with API-first applications and SPAs?
The logic sits in the frontend, the data comes through the API. The focus is therefore on BOLA and BFLA, the security of your JWT tokens and openly reachable documentation endpoints such as Swagger files.
Do we get reproducible examples?
Yes. A finding without a proof of concept is worthless to developers. You get the concrete payloads, the way there and supporting material, so your team can recreate the bug locally and verify the fix.
Do you test according to OWASP?
The OWASP Top 10 are the baseline. For depth we work with the ASVS and go through its categories systematically, instead of just ticking off the well-known names.
What sets you apart from a large agency?
You talk to the people who do the testing. We take the time to understand your business model, because that is exactly where the logic flaws are, and after the test we are available for a conversation with your developers.
Do you also test the API without a user interface?
Yes, and with API-first applications that is the more important part. The endpoints are addressed in isolation, without going through the frontend, which anyone can bypass in the browser anyway.
Want to know where your application breaks open?
In a free initial call we agree roles, environment and scope. Afterwards you receive a written quote.
