Web application penetration testing: what it proves, and how long that lasts.
A good pentest finds what scanners can't: broken business logic, chained weaknesses, authorization gaps. It also describes one version of your app, on the days it was tested. This guide covers how to scope a web app pentest, what to expect from it, and how to keep its findings true after the next release.
Web Application Penetration Testing Methodology, Phase by Phase
Most providers follow the OWASP Web Security Testing Guide or a close variant. The phases are consistent; depth and skill vary a lot.
Reconnaissance
Map domains, subdomains, technologies and exposed services.
Automation handles it wellApplication mapping
Crawl routes, parameters, roles and workflows; build the attack surface model.
Automation helps; a human decidesAuthentication & session
Login, MFA, password reset, session fixation, token handling and logout.
Automation helps; a human decidesAuthorization
Horizontal and vertical access: can one user act as another, or as an admin?
Where human testers earn their feeInput handling
Injection, XSS, SSRF, deserialization, file upload and template injection.
Automation handles it wellBusiness logic
Workflow skips, race conditions, price and quantity tampering, abuse of features.
Where human testers earn their feeChaining & impact
Combine low-severity issues into a path to real impact, and prove it.
Where human testers earn their feeReporting & retest
Findings with reproduction steps, severity and fixes, then a retest of remediations.
Automation helps; a human decidesPenetration Testing vs Vulnerability Scanning vs Continuous Validation
Three approaches that answer different questions. Most programs need a pentest and at least one of the others.
Generalized by approach. Individual products and providers vary.
How Fast Does a Web App Pentest Go Stale?
One year of a typical SaaS release cycle. The orange bar is the share of today's application that the last pentest actually tested. Play it through.
Illustrative model · assumes weekly releases and a mid-year pentest · 20 s replay
Business Logic Example: A Discount Applied Twice
Every request is valid. Every response is a 200. The flaw is in the order of the steps, which is exactly what scanners don't model and good pentesters look for first.
Illustrative finding · synthetic data
How to Scope a Web Application Penetration Test
Most disappointing pentests were scoped badly, not tested badly. Settle these six things before the engagement starts.
Testing safely in production →Applications and routes
Exact hostnames, paths and APIs in scope, and anything explicitly out, such as third-party payment pages.
Accounts for every role
At least two accounts per role, including admin, so horizontal and vertical access can both be tested.
Environment
Production or a staging copy that matches it. Agree on what test data testers may create and change.
Testing approach
Black, grey or white box. Grey box with documentation usually gives the most value per tester-day.
Rules of engagement
Testing windows, rate limits, prohibited techniques, emergency contacts and how to stop the test.
Retest terms
How long you have to fix findings, how many retests are included and what evidence closes a finding.
Eight Questions to Ask a Web App Pentest Provider
Ask for a redacted sample report before you sign. It answers half of these on its own.
Web Application Pentest Standards and Compliance Drivers
The methodologies providers test against, and the requirements that usually trigger the engagement.
OWASP Web Security Testing Guide (WSTG)
The most widely referenced test catalog for web applications, organized by category with test IDs.
OWASP Top 10 (2021)
The ten most critical web application security risks, led by broken access control.
PTES and NIST SP 800-115
General penetration testing frameworks covering planning, execution and reporting.
OWASP ASVS
Testable security requirements, useful for defining what "passed" means at each assurance level.
PCI DSS v4.0
Requires regular penetration testing of in-scope applications and after significant changes.
SOC 2 and ISO/IEC 27001
Pentest reports are common evidence for vulnerability management and technical testing controls.
Summaries are for orientation only. Confirm specific requirements with your assessor.
Keep Pentest Findings True Between Engagements
Hayrok doesn't replace your pentesters. It turns their findings into scenarios that rerun on every release, validates the routine attack paths continuously, and hands the next engagement a validated starting point so human time goes to what only humans find.
Findings become scenarios
Import pentest findings; each becomes a scenario that reruns until the fix is proven.
Every release, every role
Authorization and known attack paths are validated as each role on every deploy.
Regressions caught early
A fixed finding that comes back opens as a validated finding, not a surprise next year.
A better next engagement
Testers start from a current, validated picture and spend their days on novel logic.
Evidence between reports
Evidence Fabric keeps replayable proof for auditors in the months between pentests.
Web Application Penetration Testing FAQ
An authorized, simulated attack on a web application by security testers, who try to find and exploit weaknesses in authentication, authorization, input handling, session management and business logic, then report what they could do and how to fix it.