COVID-19: remote delivery options
We want to reassure our clients that all training and consultancy services will go ahead as scheduled during the current COVID-19 situation. We have adjusted our delivery methods to allow us to provide consultancy services, penetration tests and training remotely where necessary. For more information, please refer to our COVID-19 policy.
What is a web application penetration test?
A web application penetration test aims to identify security issues resulting from insecure development practices in the design, coding and publishing of software or a website.
A web applications test will generally include:
- Testing user authentication to verify that accounts cannot compromise data;
- Assessing the web applications for flaws and vulnerabilities, such as XSS (cross-site scripting);
- Confirming the secure configuration of web browsers and identifying features that can cause vulnerabilities; and
- Safeguarding web server security and database server security.
The vulnerabilities are presented in a format that allows an organisation to assess their relative business risk and the cost of remediation. These can then be resolved in line with the application owner’s budget and risk appetite, inducing a proportionate response to cyber risks.
Speak to an expert
For more information on how our CREST-accredited penetration testing services can help safeguard your organisation, call us now on
+353 (0) 1695 0411, or request a call back using the form below
Get in touch
Did you know?
- Applications and identities are the initial target in 86% of breaches.
- Breaches that start with website and application attacks account for 47% of the breach costs, making application attacks the costliest.
- Out of 338 cases with confirmed breach data: 11.8 billion records were compromised, an average of almost 35 million records per breach.
Lessons learned from a decade of data breaches, F5 Labs
Once an application vulnerability is exploited, attackers will find their way through the network to your data.
These attacks can be used to modify or capture data, steal user credentials or affect the operational performance of your application or website.
The benefits of a web application penetration test
Our penetration tests will help you:
- Gain real-world insight into your vulnerabilities;
- Keep untrusted data separate from commands and queries;
- Develop strong authentication and session management controls;
- Improve access control;
- Discover the most vulnerable route through which an attack can be made; and
- Find any loopholes that could lead to the theft of sensitive data.
Is a web application penetration test right for you?
If you are responsible for a website or web application, you should ask yourself:
- Could your application be exploited to access your network?
- Do you use an off-the-shelf CMS (content management system)? Is it vulnerable to attack?
- Could your identity credentials be hacked, or account privileges escalated?
- Is your API secure?
- Do you process or store payment details on your website?
- Does your application store personally identifiable information at the back-end?
- Can an attacker get direct access to your database using SQL injection?
Our engagement process
Our CREST-accredited penetration testers follow an established methodology based primarily upon the Open Source Security Testing Methodology Manual (OSSTMM). This approach emulates attackers’ techniques using many of the same readily available tools.
- Scoping - Before a test, our account management team will discuss the requirements for your network/infrastructure assessment to define the scope of the test.
- Reconnaissance - IT Governance will enumerate your network assets and identify any holes in your systems where malicious actors could break in.
- Assessment - Using the information identified in the reconnaissance phase, we test the identified hosts for potential vulnerabilities.
- Reporting - The results will be thoroughly analysed by an IT Governance certified tester. A full report will be prepared that sets out the scope of the test and the methodology used along with the risks identified. This will provide your organisation with the ability to produce an accurate threat and risk assessment.
- Re-test - We can provide access to our testers and the raw test data to support and expedite remediation. We can also retest your systems so that you can be sure all the issues have been successfully resolved.
Select your web application penetration test
We offer two levels of penetration test to meet your budget and technical requirements.
Level 1: contact us for a quote
- Identifies the vulnerabilities that leave your IT exposed.
- Combines a series of manual assessments with automated scans, as our team assesses the vulnerability of your network.
- Allows you to evaluate your security posture and make more accurate budgetary decisions.
Please contact us for further information
or to speak to an expert
Contact Us
Level 2: contact us for a quote
- Attempts to exploit the identified vulnerabilities to see whether it’s possible to access your assets and resources.
- Provides a more thorough assessment of your security posture, which enables you to make more accurate decisions about investing in securing your business-critical systems.
Please contact us for further information
or to speak to an expert.
Contact Us