Understand Your Risk With A Web Application Penetration Test
A web application penetration test is the best way to identify weaknesses within your application. At Triaxiom we test for all of the OWASP Top-10 critical security flaws, as well as other potential vulnerabilities.
Whats Included in a Web Application Penetration Test
A web application penetration test is an in-depth penetration test on both the unauthenticated and authenticated portions of your website. The engineer will test for all of the OWASP Top-10 critical security flaws, as well as a variety of other potential vulnerabilities based on security best practice. Activities include:
- Website mapping techniques such as spidering
- Directory enumeration
- Automated and manual tests for injection flaws on all input fields
- Directory traversal testing
- Malicious file upload and remote code execution
- Password attacks and testing for vulnerabilities in the authentication mechanisms
- Session attacks, including hijacking, fixation, and spoofing attempts
- Other tests depending on specific site content and languages
Our Web Application Penetration Test Process
Our first step is to jump on a quick call with you and one of our lead engineers to understand your organization’s needs and to scope the penetration test. Within a few hours following this call, you will have a proposal with pricing information and next steps.
Our Proposal will have everything you need to make a decision, including scope, our detailed methodology for the in-scope assessments, pricing information, and the biography of a lead engineer who will be directly involved with your assessment.
Should you choose to move forward with Triaxiom, we will provide the required contracts to get the project started. Once contracts are signed, we will assign a project manager to your account that will work with you to schedule the kick-off call and execution of the assessment.
On the kickoff call, we will review the Rules of Engagement document that will govern the project. It will include all project contracts, the rules the team will follow during testing, the testing schedule, and allow you to provide the necessary technical details to facilitate your assessment.
Once we are on the same page, we will get started. While execution times vary depending on the scope, on average, most projects take one to two weeks of active testing to complete.
All of our assessments go through two rounds of Quality Assurance to ensure our reports and tests meet the highest standards. This includes a technical QA process to ensure our methodology was followed and all evidence was properly collected/analyzed. This is followed by a thorough documentation QA to ensure our reports are consistent and actionable.
Once the reports are complete, we will share them with you via our secure portal. Finally, we will jump on a deliverable presentation to meet with your team to review all findings and answer any questions you may have.
At Triaxiom Security, our primary goal is to make your organization more secure. As part of that, any findings identified during our test that you wish to remediate can be included in a one-time retest within 90 days of report delivery, free of charge. The team will validate that your remediation efforts were effective and will update the reports to reflect your heightened security posture.
Web App Pen Test Deliverables
Each client engagement concludes with a comprehensive report that clearly outlines your organization’s security posture and testing results. Key features of the report include:
- Executive summary highlighting strengths, risks, and takeaways
- Detailed results from the internal penetration testing
- Clear descriptions of risks, affected systems, evidence, and prioritized remediation recommendations
- Visual summaries and a risk rating scale
- Roadmap to gradually improve security posture
Web Application Pen Test FAQs
At the end of the day, penetration testing companies should base the cost of an assessment on the time it takes an engineer to do the required work. Using some basic questions, we can estimate the time required to perform a thorough assessment. For example, if you have a small web application with only one user role, an assessment would cost ~$12,000. But on the other hand, if your web application has multiple roles to test and a significant number of unique pages/forms, that takes longer for an engineer to adequately evaluate, and might cost closer to $23,000.
Much like cost, the time required to perform an web application penetration test can vary by the size of the application. With that said, most web application penetration tests take around one to two weeks.
At Triaxiom Security, we do everything we can to give you a holistic view of your risk by emulating the real-world attacks you are likely to face. However, we also understand the impact that outages can cause and do everything we can to avoid any disruptions. We do not exploit any denial-of-service vulnerabilities and do not perform any stress/load testing.
With that said, there is always a small chance of accounts getting locked out or an unstable sytem experiencing an outage. When that happens, we stop all testing, figure out what caused the issue, and work with you to identify any root causes of instability and adapt our testing going forward to meet your needs.
Our engineers have industry leading certifications including:
- PCI Qualified Security Assessor (QSA)
- Certified Information Systems Security Professional (CISSP)
- Certified Ethical Hacker (C|EH)
- Offensive Security Certified Professional (OSCP)
- Offensive Security Web Expert (OSWE)
- GIAC Security Essentials Certified (GSEC)
- GIAC Certified Incident Handler (GCIH)
- GIAC Web Application Penetration Tester (GWAPT)
Get A Web App Pen Test Quote
Find and fix vulnerabilities that ACTUALLY impact your business and compliance goals faster.
