Contact Us

Contact Us

Please get in touch using the form below

I prefer to be contacted by:
View our privacy policy
Learn how open source threat intelligence can be used to defend against cyber-attacks. Join our webinar on August 4th.

Definition

What is web application testing?

Web applications play a vital role in business success and are an attractive target for cybercriminals. Web application penetration testing is the process of proactively identifying applications for vulnerabilities, such as those that could lead to the loss of sensitive user and financial information.

Redscan’s CREST-certified web app pen testing team, which includes Certified Web Application Testers (CCT APP), are hugely experienced at performing web application security testing and website security testing and can help your organisation to identify and remediate a wide range of risks.

Vulnerabilities

Web application vulnerabilities

Redscan’s web application penetration testing service can be commissioned to assess both proprietary web applications developed in-house as well as those from third party vendors.

Testing includes assessing applications for vulnerabilities listed in the OWASP Top 10, the Open Web Application Security Project’s ten most critical application security risks. Our web application security testing team will help to identify vulnerabilities including:

  • Injection flaws
  • Authentication weaknesses
  • Poor session management
  • Broken access controls
  • Security misconfigurations
  • Database interaction errors
  • Input validation problems
  • Flaws in application logic

Methodology

Our web application security testing methodology

Web application pen testing can be both authenticated and unauthenticated. The web application penetration testing methodology below outlines how Redscan approaches a ‘blackbox’ unauthenticated assessment where few details are shared with the tester in advance of an assessment taking place.

01. Scoping
02. Reconnaissance and intelligence gathering
03. Vulnerability discovery
04. Exploitation
05. Reporting and debrief
01.

Scoping

Redscan’s web app pen testing experts work with you to define any websites and applications in scope and devise an appropriate testing strategy.

02.

Reconnaissance and intelligence gathering

Our web application penetration testers use the latest intelligence gathering techniques to uncover security and technical information about the websites and applications in-scope.

03.

Vulnerability discovery

Our web application penetration testers use their offensive security expertise and knowledge of the latest hacking tools to identify exploitable security vulnerabilities.

04.

Exploitation

Once vulnerabilities have been identified, our pen testers develop and execute a plan to exploit them, but in a safe way that avoids damage and disruption.

05.

Reporting and debrief

Once a web application security test is complete, our testers document key findings and supply prioritised remediation guidance to help address any identified exposures.

Request a web app pen test quote

Get in touch

What our customers say

4.8/5 - based on 49 Reviews
“The penetration testing that Redscan performed provided some very credible findings and outlined clear improvements that we were able to implement. The whole process raised the bar of our cyber security defences.”
Head of Cyber Security
Specialist Bank
"Redscan gave us the professional service and quick turnaround that we needed to meet our tight deadlines."
IT Manager
EVIA (formerly WMBA)
“Redscan’s hands on approach identified security flaws that had previously been overlooked by other vendors.”  
Technical Operations Manager
Spread Betting Firm
"Should I need any security testing again in the future, Redscan would be my first port of call!"
Project Analyst/Developer
STM Life
“We have been very impressed by the quality of Redscan’s engagement, communication and reporting. We will not hesitate to use them for any future testing requirements.”      
Information Security Officer
White Oak (formerly LDF)
“Redscan has given us a third party stamp of approval for our IT security and the reassurance to know we are as secure as possible.”
IT Manager
EVIA (formerly WMBA)

Types of penetration test

Network infrastructure testing

Network infrastructure testing

Redscan rigorously investigates your network to identify and exploit a wide range of security vulnerabilities. This enables us to establish if assets such as data can be compromised, classify the risks posed to your overall cyber security, prioritise vulnerabilities to be addressed, and recommend actions to mitigate risks identified.

Wireless testing

Wireless testing

Unsecured wireless networks can enable attackers to enter your network and steal valuable data. Wireless penetration testing identifies vulnerabilities, quantifies the damage these could cause and determines how they should be remediated.

Application and API security review

Application and API security review

Vulnerabilities contained within software are commonly exploited by cybercriminals and are easily introduced by under-pressure programmers. Redscan’s ethical hackers conduct automated and manual penetration tests to assess backend application logic and software and API source code.

Remote working assessment

Remote working assessment

If your organisation is embracing mass remote working for the first time, it’s important to ensure that it is doing so securely. Ensure your networks, applications and devices are protected and fully secured with a custom remote working security assessment.

Web application security testing

Web application security testing

Web applications play a vital role in business success and are an attractive target for cybercriminals. Redscan’s ethical hacking services include website and web app penetration testing to identify vulnerabilities including SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Social engineering

Social engineering

People continue to be one of the weakest links in an organisation’s cyber security. Redscan’s social engineering pen test service includes a range of email phishing engagements designed to assess the ability of your systems and personnel to detect and respond to a simulated attack exercise.

Mobile security testing

Mobile security testing

Mobile app usage is on the rise, with more and more companies enabling customers to conveniently access their services via tablets and smartphones. Redscan carries out in-depth mobile application assessments based on the latest development frameworks and security testing tools.

Firewall configuration review

Firewall configuration review

Firewall rule sets can quickly become outdated. Redscan’s penetration testers can detect unsafe configurations and recommend changes to optimise security and throughput.

Expertise

Our security qualifications

FAQ

Frequently asked questions about web app pen testing

What is web application penetration testing?

A web application penetration test is a type of ethical hacking engagement designed to assess the architecture, design and configuration of web applications. Assessments are conducted to identify cyber security risks that could lead to unauthorised access and/or data exposure.

Who performs a web application penetration test?

Redscan web application penetration testing is performed by a team of CREST CCT APP certified professionals that have a deep understanding of the latest tactics and techniques that adversaries use to compromise web applications.

What information is needed to scope a web app pen test?

The information needed to help scope a web application security test typically includes the number and types of web applications to be tested, number of static and dynamic pages, number of input fields and whether the test will be authenticated or unauthenticated (where login credentials are unknown/known).

Which web application security testing tools are used?

Penetration testing for web applications not only requires knowledge of the latest web application security testing tools but also a deep understanding of how to use them most effectively. To assess web app security, ethical hackers leverage a range of specialist tools. These range from specialist pen testing platforms (such as Cobalt Strike, Metasploit Pro and Kali Linux), to networking tools (such as Wireshark), and custom-developed tools and exploits written using Python, Java and PowerShell.

How long does it take to perform a a web application security test?

The time it takes an ethical hacker to complete a web application penetration test depends on the scope of the test. Factors influencing the duration include the number and type of web apps assessed, plus the number of static or dynamic pages and input fields.

What happens at the end of a web app pen test?

After each web application security test, the ethical hacker(s) assigned to the test will produce a custom written report, detailing any weaknesses identified, associated risk levels and recommended remedial actions.

How much does a web application penetration test cost?

The cost of a web application penetration test is determined by the number of days it takes an ethical hacker to fulfil the agreed scope of the engagement. To receive a pen test quotation, your organisation will need to complete a pre-evaluation questionnaire, although Redscan’s experts can support you with this.

Why choose Redscan?

A trusted partner for pen testing

  • One of the highest accredited UK pentesting companies
  • A deep understanding of how hackers operate
  • In-depth threat analysis and advice you can trust
  • Complete post-test care for effective risk remediation
  • Multi award-winning offensive security services
  • Avg. >9/10 customer satisfaction, 95% retention rate

            

Get a quick quote

Complete the form for a prompt response from our team.

I prefer to be contacted by:
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
13th July 2020
‘123456’ still the most popular online password

An analysis of over a billion breached credentials has revealed that one in every 142 people uses the password '123456', increasing their vulnerability to hackers.

7th July 2020
Significant rise in volume and size of fines for data breaches predicted
A new study has suggested that the number and value of fines for data breaches will increase dramatically between now and 2025. This is thought to be because employees have access to more data than ever before.
26th June 2020
One million phishing scams reported to NCSC in just two months
The UK’s National Cyber Security Centre (NCSC) has received one million reports of scam emails since launching its new reporting service in April. More than half of online scams reported were fake cryptocurrency investment lures.