What Gets Tested

Testing follows the OWASP Top 10 and OWASP ASVS, but the highest-value work is the manual part: authenticated testing across your real user roles. The main areas are:

  • Access control: insecure direct object references, privilege escalation, and one customer reading another customer's data.
  • Authentication and sessions: login, password reset, MFA, token handling, and session fixation.
  • Injection and input handling: SQL injection, cross-site scripting, command injection, server-side request forgery, and unsafe file upload.
  • Business logic: price or quantity manipulation, workflow bypass, coupon and referral abuse, and race conditions.
  • Configuration: TLS, security headers, exposed admin panels, debug endpoints, and verbose errors.
  • Components: outdated frameworks and libraries with known vulnerabilities.

How the Engagement Works

  1. Scoping call. We agree the assets, user roles, testing window, and rules of engagement, and I send a fixed quote.
  2. Access and authorisation. You provide written permission, test accounts, and any IP allow-listing needed.
  3. Testing. Automated coverage first, then manual testing for the issues scanners cannot find.
  4. Report and walkthrough call. Every finding comes with severity, proof of concept, impact, and a fix your developers can act on.
  5. Free retest. Once you have fixed the findings, I verify them and update the report.

What You Receive

  • An executive summary for management and a technical section for developers.
  • Every finding with a severity rating, proof-of-concept steps, and business impact.
  • Remediation guidance specific to your stack, not generic advice.
  • A walkthrough call with your team.
  • A free retest and an updated report showing which issues are closed.

Pricing

A manual web application penetration test in India typically costs between ₹40,000 and ₹2,00,000, depending on the number of roles, workflows, and endpoints in scope. I quote a fixed price after scoping, and the retest is included. For a full breakdown by test type, read the penetration testing cost guide for India.

Who This Is For

  • SaaS and software companies preparing for enterprise customer security reviews.
  • Fintech, e-commerce, and healthtech platforms handling payments or personal data.
  • Teams preparing for ISO 27001, SOC 2, or PCI DSS audits that expect evidence of technical testing.
  • Any team about to launch a major release or migrate infrastructure.

About the Tester

Engagements are led by Mohd Abdullah Khan, a CEH v12 certified and ISO/IEC 27001:2022 Lead Auditor information security consultant with 3+ years of hands-on offensive security experience. Findings are prioritised by business impact, not by raw scanner output.

Frequently Asked Questions

How long does a web application penetration test take?
A single web application typically takes 3 to 7 business days of testing plus reporting. Larger scopes with many roles or multiple applications usually run 2 to 3 weeks. The timeline is confirmed during scoping.
Do you test production or staging?
Staging is preferred because it removes any risk to live users. Production testing is possible with safeguards agreed up front, such as a defined window and no denial-of-service testing unless it is explicitly in scope.
What do you need from us to start?
Written authorisation, the list of in-scope URLs, test accounts for each user role, and any IP allow-listing required. An API specification or architecture notes help but are not mandatory.
Is a retest included?
Yes. Once your team has fixed the findings, I verify them and provide an updated report at no extra cost.
Can I share the report with auditors or customers?
Yes. The report is yours to share, and I can issue a summary letter confirming the scope, dates, and retest status. Everything is covered by an NDA.