Skip to main content
VexaroSecurity
Web application pentest

Web application penetration testing

A controlled, manual-first attack on your web application, approached the way a real attacker would. We map coverage to the OWASP Web Security Testing Guide, verify controls against OWASP ASVS, and chain issues into real, exploitable paths that scanners miss.

Scope

What we test

Coverage follows the OWASP Web Security Testing Guide (WSTG v4.2). Section 4 of the guide defines twelve test categories, from authentication and authorisation to business logic and the client side. We set the depth to match your risk and assurance objective, in black-, grey- or white-box mode.

Typical scope
  • Authentication, session management and authorisation (broken access control)
  • Injection, input validation and insecure deserialization
  • Business-logic flaws and insecure design
  • Cryptographic failures and transport security
  • Security misconfiguration and exposed error handling
  • Client-side issues (XSS, DOM, postMessage) and API touch-points
How we work

A manual-first methodology

Automated tools are useful for breadth, but ASVS itself notes they cannot verify the more complex requirements or those tied to business logic and access control. We lead with manual testing and use tooling to assist, following a structured engagement flow.

  1. 1

    Scoping & rules of engagement

    We agree boundaries, the threat model, accounts and the test window, and sign an NDA before any access.

  2. 2

    Mapping & enumeration

    We map the application, its roles and entry points to plan WSTG-driven coverage of every reachable surface.

  3. 3

    Manual testing

    We work through the WSTG categories by hand: authentication, authorisation, injection, business logic and more.

  4. 4

    Exploitation & chaining

    We confirm impact with a proof of concept and chain individually-minor issues into realistic attack paths.

  5. 5

    Reporting & free re-test

    You get a prioritised report; after you remediate, we re-test the fixed issues at no extra charge, within the window set in the Statement of Work.

Deliverables

What you receive

The same deliverable depth as our sample report: an executive summary plus a full entry for every finding, with references mapped to recognised standards so the coverage is auditable.

What you get
  • Executive summary and overall risk posture for decision-makers
  • Each finding: description, impact, evidence, steps to reproduce and remediation
  • Severity scored with CVSS 3.1 and translated into business risk
  • References to CWE, the WSTG test ID and the relevant ASVS requirement
  • Findings framed against the OWASP Top 10 2025 risk categories
  • Free re-test of remediated issues within the window set in the SoW, recorded in an updated report or a re-test summary
Methodology & standards

Grounded in recognised web-security standards

OWASP WSTG v4.2OWASP ASVS 5.0OWASP Top 10 2025PTESCVSS 3.1CWE

We map coverage to OWASP WSTG v4.2 and verify against OWASP ASVS 5.0.0; note that ASVS 5.0 reframed Level 1, so we choose the verification level by risk rather than treating L1 as a black-box pass. Risk is framed against the OWASP Top 10 2025, and findings are scored with CVSS 3.1 (FIRST also publishes v4.0; we state the version applied on each finding).

Test your web application.

Tell us about the application and your goals. We'll suggest the scope and depth, agree the rules with you and deliver the report under NDA. The first consultation is free.