Injection and deserialisation
Testing for SQL, NoSQL, OS command, and object injection issues, including modern deserialisation weaknesses.
Web Application Penetration Testing
Protect the applications your business relies on by identifying weaknesses that scanners and basic reviews routinely miss.
Applications are where your data and business logic live
Web applications underpin revenue, operations, and customer experience. They are also a prime target for attackers. Automated vulnerability scans are not enough to uncover the complex logic flaws and misuse paths that lead to serious compromise.
Cyber Defence’s web application tests combine OWASP-driven analysis with deep manual exploration of roles, workflows, and edge cases, giving you a realistic view of how your applications could be abused.
What we test
Our web application testing typically covers:
• Authentication and session management
• Authorisation and access control
• Input validation and output encoding
• File upload and storage mechanisms
• Business logic and workflow abuse
• Integration points with APIs and third-party services
We test single applications, portfolios of related apps, and complex multi-tenant and multi-role platforms.
OWASP-aligned
OWASP Top 10 and beyond
We assess against the OWASP Top 10 and other relevant industry guidance, but we do not stop there.
Broken authentication
Assessing login, password reset, multi-factor flows, and session handling for weaknesses and abuse paths.
Broken access control
Verifying that users can only access data and actions appropriate to their role, including IDOR and privilege escalation.
Cross-site scripting and CSRF
Testing for reflected, stored, and DOM-based XSS and weak protections against cross-site request forgery.
Security misconfiguration
Identifying insecure headers, verbose error messages, debug endpoints, and weak deployment configurations.
Business logic abuse
Exploring edge cases and workflows that allow users to bypass checks, circumvent limits, or manipulate outcomes.
How we run a web application test
-
1. Scoping and user roles
Agreeing target applications, environments, and user roles to be tested, including test accounts and data handling expectations.
-
2. Mapping and reconnaissance
Enumerating functionality, endpoints, roles, and input vectors to understand application attack surface.
-
3. Vulnerability and logic testing
Combining automated scanning with in-depth manual testing of technical controls and business logic.
-
4. Impact assessment
Assessing how identified weaknesses could be chained to compromise data, accounts, or system integrity.
-
5. Reporting and remediation support
Delivering clear findings and working with your developers to understand and fix root causes.
Protect your business-critical web applications
Whether you run customer portals, internal tools, or multi-tenant SaaS platforms, we will help you define a test that reflects real usage and risk.
Testing that supports secure development
Our consultants provide not only findings, but practical guidance for developers on how to resolve vulnerabilities and avoid similar issues in future releases. We can also support secure SDLC improvements, code review, and integration with SOC365 monitoring.