WEB APPLICATION PENETRATION TESTING

OVERVIEW

Krypsys provides manual security testing of web applications, portals and browser-based services to identify weaknesses that could affect users, data or application functionality.

Testing is carried out by experienced security consultants and is tailored to the individual application. Automated tooling is used where it adds value, but the work is driven by hands-on testing of how the application behaves in practice.

Particular attention is given to authentication, authorisation, session management and business logic. Where an application supports different users, roles or privilege levels, we test whether those boundaries can be bypassed and whether users are able to access information or functionality outside their intended permissions.

We also examine how application workflows can be manipulated outside the normal user interface. This can include modifying requests, changing hidden or client-controlled values, accessing functions directly, altering object references or bypassing controls that are enforced only within the frontend.

Testing is informed by established industry guidance, including the OWASP Web Security Testing Guide, while remaining focused on the functionality and risks specific to the application.

TYPICAL AREAS COVERED

• Authentication and account management
• Authorisation and access control
• Session management
• Multi-factor authentication
• Password reset and account recovery
• Input validation
• Injection vulnerabilities
• File upload and download functionality
• Sensitive data exposure
• Application configuration
• Client-side security controls
• Business logic weaknesses
• Privilege separation
• Abuse of application workflows
• Interaction with backend services and APIs

Where supporting APIs form an important part of the application, these can be included within the engagement or tested separately as part of a dedicated API penetration test.

All findings are manually validated before being reported, with sufficient technical detail for development and support teams to reproduce the issue, understand its impact and address it. Retesting is available once remediation has been completed.