Web Application Penetration Testing

What is Web Application Penetration Testing?

Web application penetration testing is a systematic security assessment of web applications conducted according to OWASP Web Security Testing Guide (WSTG) 4.2 — an international standard for web application security testing. The scope covers the full OWASP Top 10 list plus additional test categories: business logic, session management, cryptography and server configuration.

Attribute	Value
Methodology	OWASP Web Security Testing Guide (WSTG) 4.2
Scope	OWASP Top 10 + business logic, sessions, cryptography, server configuration
Team certifications	OSWE, OSCP, eWPT
Tools	Burp Suite Pro, OWASP ZAP, SQLMap, Nuclei
Delivery time	5-21 business days (depending on package)
Price	from €3,000 net

nFlo conducts web application penetration testing for companies across Europe, combining automated scanning with manual testing by certified experts. 43% of cyberattacks target web applications — don’t risk a data breach.

Pricing Packages

Package	For whom	Scope	Delivery time	Net price
BASIC	Startup, MVP, small app	1 application up to 20 endpoints. OWASP Top 10, manual + automated testing	5-7 business days	from €3,000
STANDARD	Mid-size company, app with API	1 application up to 50 endpoints + API. Full OWASP WSTG 4.2, role and business logic testing	7-10 business days	from €5,000
ADVANCED	Enterprise, regulated sector	Enterprise application + code review. Full OWASP WSTG 4.2, source code analysis, threat modeling	14-21 business days	from €10,000

Every package includes: Executive Summary report, technical report with CVSS classification, evidence and Proof of Concept for High/Critical vulnerabilities, remediation plan with priorities, presentation meeting to discuss results, re-test after fixes (included) and test completion certificate (on request).

What is an endpoint? A unique URL + HTTP method. For example: GET /users and POST /users are 2 separate endpoints. Login form, registration page, admin panel — each unique view with backend logic counts as an endpoint. Not sure how many endpoints your application has? We’ll help determine this during scoping — free of charge.

Delivery Timelines

Package	From kick-off to report	Express (+25%)
BASIC	5-7 business days	3-4 business days
STANDARD	7-10 business days	5-6 business days
ADVANCED	14-21 business days	10-14 business days

Why nFlo

The Certainty Loop

We don’t leave you with a report full of jargon. Every project concludes with:

1. A meeting where the pentester personally discusses the results
2. A remediation plan with priorities — what to fix first
3. A free re-test that confirms the fixes work

The loop closes — you have certainty that your application is secure.

Re-test After Fixes — Included in Every Package

After your team implements fixes, our pentester verifies their effectiveness. The re-test is available within 14 days of readiness notification and comes at no additional cost.

One Vendor, Full Cycle

After pentesting, we can help with vulnerability remediation (Remediation Support), implement continuous monitoring (Vulnerability Management) or launch a SOC. No need to find another vendor.

Quick Start

BASIC package — results in 5-7 business days from kick-off. Express delivery available for a surcharge.

Critical Threat Notification Within 1 Hour

If during testing we discover a critical vulnerability (CVSS ≥ 9.0) — we don’t wait for the final report. We notify the technical contact within 1 hour with a problem description and temporary mitigation recommendation.

Who Is It For?

This service is for you if:

• You develop web application storing user data
• You have compliance obligations (PCI DSS, GDPR, ISO 27001)
• You’re planning launch and want to ensure application is secure
• You’ve had an incident and want to prevent future ones

Test Scope

Full OWASP WSTG 4.2 methodology — 10 OWASP Top 10 categories + business logic testing, input validation, session management, file operations and API security.

OWASP Top 10 — Full Test List

A01:2021 - Broken Access Control

• IDOR, path traversal, privilege escalation, metadata manipulation (JWT, cookies)

A02:2021 - Cryptographic Failures

• Data in cleartext, weak algorithms, missing HSTS, weak password hashing

A03:2021 - Injection

• SQL, NoSQL, OS Command, LDAP, XXE, SSTI — plus XSS (Reflected, Stored, DOM-based), HTML injection, open redirect, file inclusion (LFI/RFI)

A04:2021 - Insecure Design

• Missing security controls, race conditions, insufficient resource limits

A05:2021 - Security Misconfiguration

• Default credentials, directory listing, stack traces, permissive CORS

A06:2021 - Vulnerable Components

• Outdated libraries/frameworks, known CVEs, unpatched CMS

A07:2021 - Authentication Failures

• Brute force, credential stuffing, session fixation/hijacking, weak password policy, missing MFA, predictable tokens, cookie security (HttpOnly, Secure, SameSite)

A08:2021 - Software and Data Integrity

• Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion

A09:2021 - Logging & Monitoring Failures

• Missing audit logs, no alerting, unprotected logs

A10:2021 - SSRF (Server-Side Request Forgery)

• Internal network scanning, cloud metadata access (AWS, Azure, GCP), protocol smuggling

Business Logic Testing

Payment & Financial: price manipulation, discount code abuse, refund manipulation, race conditions in transactions, currency conversion abuse

Workflow & State: step skipping in multi-step processes, state manipulation, workflow bypass, concurrency issues

Authorization: horizontal/vertical privilege escalation, RBAC bypass

Rate Limiting & Anti-Automation: lack of rate limiting, CAPTCHA bypass, account enumeration, brute force protection

File Operations & API Security

File Upload: unrestricted file upload, type validation bypass, malicious file execution, path traversal, zip slip

File Download: arbitrary file download, path traversal, access control bypass

API Security (OWASP API Top 10): BOLA, broken authentication, excessive data exposure, lack of rate limiting, broken function-level authorization, mass assignment, security misconfiguration, injection, improper assets management, insufficient logging

Methodology

Testing Approach

Approach	Description
Black-Box	No source code access — external attacker perspective
Gray-Box (optional)	With credentials — authenticated user testing, privilege escalation
White-Box (optional)	With source code access — code review + pentest, highest coverage

Tools

Category	Tools
Commercial	Burp Suite Professional, Acunetix, Nessus
Open-Source	OWASP ZAP, Nikto, SQLMap, Nuclei, Arjun
Custom	Custom scripts, exploits, fuzzing tools, custom payloads

Deliverables

Technical Report — for each vulnerability: description, severity (CVSS), affected URLs, Proof-of-Concept, impact, remediation (with example code) and references (OWASP, CWE, CVE).

Executive Summary — top 10 findings, overall risk score, business impact, compliance implications, remediation priority recommendations.

Re-test — verification of fix effectiveness within 14 days of readiness notification, regression testing, final report with closure confirmation. After the 14-day window: 30% of project value.

Engagement Terms

• NDA and Confidentiality — NDA for the duration of cooperation + 3 years (minimum 5 years). All data and test results treated as confidential.
• Professional Liability Insurance — we hold professional liability insurance for IT services. Details available on request.