When login does not equal protection

  1. A company provided its customers with invoices and orders via an online portal, protected by individual logins. The interface appeared secure, the user guidance well thought out.</p

  2. During our penetration test, we specifically manipulated a URL that was used internally to retrieve invoices. Without logging in, we were able to retrieve sensitive data from other customers, including names, addresses and complete payment information.</p

  3. The application responded normally. No alarm was triggered and no error was displayed. Internal security checks had also not detected the vulnerability. The reason for this was a lack of access control in the backend. This error was not visible via the user interface, but could have serious consequences in an emergency.</p

  4. Such vulnerabilities develop quickly and often remain undetected for years. Our web application penetration test helps you to identify and eliminate these risks at an early stage before they are exploited by attackers.</p

What is a web application penetration test?

A web application penetration test, also known as a web pentest, is a security-related check of a web application using targeted manual tests. The aim is to identify critical vulnerabilities in the application before they can be exploited by attackers.

Instead of relying on automated tests, in a web application penetration test we carry out targeted manual attacks in the active application, just as a real attacker would do, only in a controlled and fully documented manner.

Our experts test for, among other things

  • SQL injection
  • Cross Site Scripting (XSS)
  • Broken authentication
  • Remote Code Execution (RCE)
  • Missing access controls
  • Logic errors in APIs

We are guided by proven security standards such as the OWASP Top 10 for web applications, but we also check for current threats such as HTTP request smuggling, desynchronization attacks or complex API vulnerabilities.

A professional web application penetration test not only provides a list of technical vulnerabilities, but also a comprehensive risk analysis with clear proofs of concept (PoCs) for the reproducibility of the vulnerabilities found as well as concrete recommendations for securing your web application.

Web applications are now central components of many business processes and therefore a popular target for cyber attacks. A web
application penetration test helps to identify security vulnerabilities in your application at an early stage before they can be exploited by attackers.

Through targeted tests under realistic conditions, we check how well your application is protected against typical attack methods.
This allows vulnerabilities to be systematically eliminated before they become an actual risk.

A web application penetration test supports you in this:

  • Identify and close security gaps at an early stage
  • Avoid data loss, system failures and reputational damage
  • Ensure compliance with security standards such as BSI IT-Grundschutz, ISO 27001, PCI DSS or GDPR
  • Build trust with customers, partners and auditors
  • Objectively review and continuously improve your security measures

Whether in the development phase or during ongoing operations, regular penetration tests increase the security of your web application
in the long term and sustainably.

Our penetration test uncovers security-relevant vulnerabilities in your web application, regardless of whether it is a simple website, a complex web store or an API interface. We follow recognized security guidelines such as the OWASP Top 10 and specifically test the following areas:

Typical areas of application:

  • Website: e.g. company presentations, content platforms, CMS systems
  • Webshop: e.g. e-commerce platforms with login, shopping cart and payment processing
  • Marketplace / portal / platform: e.g. customer portals, job exchanges, SaaS platforms
  • Webservice / API: e.g. REST or GraphQL interfaces for mobile apps, integrations

We follow the OWASP Testing Guide to identify vulnerabilities in all relevant layers, functions and usage scenarios of your web application. Our methodology combines targeted manual testing with the supplementary use of automated tools - this allows us to achieve a high level of testing depth and efficiency at the same time.

We simulate real attacks under controlled conditions and ensure that even complex vulnerabilities such as logic errors, access control problems or API misuse are detected.

  • Determine the test objectives, functions, user roles and access areas
  • Define sensitive areas that are excluded from the test
  • Capture visible and hidden functionalities
  • Analysis of URLs, parameters, APIs, technologies and rights
  • Automated scans for broad coverage of standard problems
  • Manual tests for the detection of complex, context-related vulnerabilities
  • Validation & prioritization of all findings. No unnecessary false positives
  • Targeted attempts to exploit vulnerabilities
  • Creating comprehensible proof-of-concepts with clear documentation
  • Executive summary
  • Technical report incl. risk classification (CVSS)
  • Recommendations for immediate measures & sustainable improvements
  • On request: Joint final meeting & post-test to confirm closed gaps