TheZyberSecurity home
Book a scoping call
WAPT

Web Application Pen Testing

Deep manual testing of your web application, its APIs, and the infrastructure behind them — the full OWASP WSTG, plus the business-logic and auth-chain flaws scanners systematically miss.

Scope this engagementIs this for me?
Outcome
OWASP-plus testing for modern web + API stacks.
Timeline
4 phases1 week · 3–5 weeks · 1 week · 3 days
Mapped to
OWASPNIST · PCI DSS 4.0
Includes
Readout + retestFixed criticals and highs re-verified.
Is this for you?

Know before you book.

Deep testing of one web application and its APIs, including the business-logic flaws that automated scanners can't see.

You likely need this if
  • Your product is a web app or SaaS and customers send security questionnaires
  • You handle payments, personal data or multiple customer tenants
  • You've added login, SSO, roles or a public API
  • You need OWASP ASVS evidence for a customer or auditor
Something else may fit better
What to have ready
  • Test accounts for every role, including admin
  • API documentation or a Postman / OpenAPI collection
  • A staging environment that mirrors production

Still not sure? Take the 2-minute check

What you walk away with.

  • Full OWASP ASVS 4.0 Level 2 or 3 coverage report
  • Business-logic flaw enumeration — the category scanners can't see
  • A working exploit chain for every high/critical finding
  • Detection guidance for your WAF and application logs
Scope

What we cover

Agreed in writing before testing starts.

In scope
  • Public application + every authenticated role + admin panel
  • REST / GraphQL / gRPC / WebSocket APIs
  • Authentication, session management, MFA, and SSO flows
  • Business-logic testing — race conditions, coupon abuse, workflow bypass
  • Modern-framework edge cases (SSR/RSC hydration, streaming, edge runtime)
  • Client-side SPA flaws (DOM XSS, prototype pollution)
Not in this engagement
  • Infrastructure-level testing (see Network Pen Testing)
  • Denial-of-service testing (opt-in only)
  • Third-party SaaS integrations owned by external vendors
Approach

How we run it.

  1. 01

    Reconnaissance + mapping

    Full route discovery, endpoint enumeration, tech-stack fingerprinting. A complete target model before a single test fires.

  2. 02

    Enumeration

    Every role mapped independently; the trust boundaries between them drawn. Role escalation and IDOR hide right here.

  3. 03

    Vulnerability Analysis

    Authenticated + unauthenticated passes; AI-assisted coverage across the WSTG; candidate findings confirmed by hand.

  4. 04

    Exploitation — business logic + chains

    Race conditions, checkout tampering, workflow bypass. Individual bugs are often low severity; chained, they're catastrophic. We build the chain and show the blast.

  5. 05

    Post-exploitation

    What the chain reaches — data, adjacent tenants, backend systems.

  6. 06

    Report + WAF guidance

    Findings + reproduction (PoC / Burp files) + WAF and log-detection rules.

For practitioners

Technical detail.

The depth behind the engagement, for the engineer or CISO evaluating us.

Coverage
  • Full OWASP WSTG test cases
  • OWASP ASVS 4.0 Level 2 or 3
  • REST, GraphQL, gRPC and WebSocket APIs
Focus areas
  • Authentication, sessions, MFA and SSO
  • Authorisation and cross-tenant access (IDOR / BOLA)
  • Race conditions and business-logic abuse
Modern stacks
  • SPA and SSR/RSC hydration edge cases
  • Edge runtimes and serverless functions
  • DOM XSS and prototype pollution
Output
  • ASVS coverage matrix
  • Working PoC or Burp files per critical
  • WAF and log detection guidance
Deliverables

What lands in your inbox.

  • WAPT Report (executive + technical + appendices)
  • OWASP ASVS 4.0 coverage matrix (Level 2 or 3)
  • Working PoC scripts / Burp files for every critical finding
  • WAF + logging detection rule recommendations
  • One free retest of critical + high findings within 90 days
Standards mapping

Defensible under audit.

OWASP
Top 10 · 2021ASVS 4.0API Security Top 10WSTG v4.2
NIST
SP 800-115SP 800-53 SI-10, SC-8
PCI DSS 4.0
6.2.36.4.211.3.1
Timeline

From call to report.

  1. 01Scoping

    1 week

  2. 02Testing

    3–5 weeks

  3. 03Reporting

    1 week

  4. 04Retest

    3 days

Questions

Asked before every engagement.

How is this different from a plain pen test?

WAPT goes deep on the web + API surface. If your risk spans network + web + AI, the umbrella Penetration Testing engagement is the better fit. If the crown jewels live in the app, this is the sharp instrument.

Do you test staging or production?

Both, with different rules of engagement per environment. Production tests use rate limits and non-destructive payloads.

Can you test against our WAF?

Yes — with and without WAF paths. We report which rules blocked which attacks, and exactly where the WAF was bypassed.

More in offensive testing

Often paired with.

Penetration Testing

Adversary emulation, not scanner theater.

Learn more

Internal / External Network Pen Testing

Prove what a real attacker could reach.

Learn more

Vulnerability Assessment

See what an attacker sees — before they do.

Learn more
Start here

Ship secure by default.

Scoping call, engagement letter, kickoff — typically all inside 3 weeks. Report within 6–8 weeks of kickoff.

Scope this engagementcontact@thezybersecurity.com
Day 0Scoping callWe learn your systems, deadlines and what “done” looks like.
Within 5 business daysFixed scope & priceA written engagement letter. No surprises later.
Within 2 weeksTesting startsCritical findings reach you within 24 hours of confirmation.