Web Application Security Assessment
A grey-box vulnerability assessment and penetration test of your web applications, admin portals, and the APIs behind them, led by manual testing rather than a scanner.
Your application holds data your customers trust you with, and the last security review was an automated scan nobody read past the summary. Broken access control, business logic abuse, and API weaknesses do not appear in a scanner's output, and they are where real breaches begin.
What the assessment covers
AZRE Consulting performs a comprehensive vulnerability assessment and penetration test of the in-scope web applications and their supporting APIs, combining deep manual testing with targeted automated analysis. The aim is to identify vulnerabilities, misconfigurations, and business logic weaknesses that automated scanning cannot detect.
- Applications: public-facing web applications, admin portals, and the APIs that support them
- User roles: unauthenticated visitor, registered user, and any elevated role such as a delegate or authorised representative
- API surface: REST APIs supporting the application, including endpoints shared with a mobile backend
- Environment: staging or pilot for primary testing, followed by targeted validation of environment-dependent findings against production
- Access model: grey box, with credentials for each role so authorization can be tested across roles rather than guessed at
Key testing areas
- Attack surface mapping: enumeration of reachable endpoints, parameters, application components, and supporting infrastructure across authenticated and unauthenticated contexts
- Authentication, session, and token handling: login, registration, password reset, MFA and OTP flows, token issuance and refresh, session fixation and invalidation, and concurrent-session controls
- Authorization and access control: horizontal and vertical privilege escalation, role-based access control validation, cross-role testing of shared backend endpoints, and multi-tenant isolation
- Business logic and abuse cases: workflow and state-transition abuse, price and value tampering, race conditions, replay, and rate-limit bypass on sensitive operations
- API security: testing aligned with the OWASP API Security Top 10, including broken object-level and function-level authorization, mass assignment, excessive data exposure, and input validation
- Injection and server-side flaws: SQL and NoSQL injection, command injection, SSRF, XXE, insecure deserialization, and file upload handling
- Client-side security: cross-site scripting, CSRF, clickjacking, CORS policy, and security headers
Methodology
All activities follow recognised application security and risk management frameworks, including OWASP ASVS, the OWASP Top 10, the OWASP API Security Top 10, NIST SP 800-53 and SP 800-115, and the security control expectations defined under ISO/IEC 27001 and SOC 2. Testing combines deep manual exploration with targeted automated analysis, and every finding is manually validated to eliminate false positives.
How the engagement runs
The engagement follows a four-step process designed to fit existing engineering workflows without operational friction or downtime.
- Alignment and onboarding: a dedicated engagement lead and a testing team matched to your technology stack; a kick-off to align on scope, business logic, and no-go zones; and the secure handover of credentials, environments, and access allowances
- Active testing and live collaboration: deep manual testing alongside automated analysis, in constant contact with your technical leads; any critical or high-risk finding is reported immediately so remediation can begin in parallel
- Analysis and technical debrief: a comprehensive preliminary report with proof-of-concept evidence and actionable hardening recommendations, followed by a findings walkthrough with the engineering and product teams
- Verification and closure: targeted re-testing once fixes are implemented, confirming that vulnerabilities are resolved and no regressions were introduced, then the final certified report and archival of all project data
- Immediate notification of every critical or high-risk finding, during testing
- Preliminary report with proof-of-concept evidence for each finding
- Risk-rated findings with actionable hardening recommendations
- Findings walkthrough with your engineering and product teams
- Targeted re-test of every remediated finding
- Final certified report
The outcome
You know which weaknesses an attacker could actually exploit, what each one would reach, and that every fix has been verified rather than assumed.
Start with a conversation, not a proposal.
Tell us what is happening in the business. If we are the wrong firm for it, we will say so and point you somewhere better. If we are the right firm, you will leave the conversation with a clearer read on the problem than you came in with.
Start a conversation