Researcher-led security testing · India
Web application penetration testing
A scanner can identify some common weaknesses, but it does not understand who should be allowed to approve an action, see a customer record, or access another workspace. Wisp Security provides researcher-led web application penetration testing for teams in India, with attention to the roles, data boundaries, and workflows that make your product different.
What the assessment covers
Access control and tenant boundaries
Test whether users can read or change resources beyond their permissions. Multi-role and multi-tenant applications need representative accounts so restrictions can be assessed across actual workflows.
Authentication and session handling
Review sign-in, password reset, session lifecycle, and sensitive account changes. Testing considers both unauthenticated access and behavior after a user signs in.
Input and browser security
Investigate injection risks, cross-site scripting, file handling, and request protections where relevant to the application. Potential issues are validated in the agreed testing environment.
Business logic
Examine the order and authorization of important actions, such as invitations, approvals, exports, and changes to account settings. We focus on outcomes that could expose data or bypass intended controls.
How we test
We begin with your application map, roles, and highest-risk workflows. Testing combines unauthenticated review with authenticated exploration rather than stopping at the login screen. The OWASP Web Security Testing Guide provides a useful reference for coverage, while the agreed scope determines what is tested. Evidence and limitations are recorded alongside the findings.
Testing reference: OWASP Web Security Testing Guide.
What to prepare
- In-scope application URLs and a representative staging environment where available.
- Accounts for the relevant user, administrator, and tenant roles.
- A walkthrough of critical workflows and any separate API or integration boundaries.
- Testing windows, excluded actions, and a technical contact for environment questions.
What you receive
- A prioritized report describing affected pages, requests, roles, and prerequisites.
- Reproducible evidence explaining the security boundary crossed and its impact.
- Remediation guidance engineers can use to address the underlying cause.
Custom scope and pricing, agreed up front. See what affects a pentest quote.
Questions about web application penetration testing
- Does a web pentest include authenticated testing?
- Yes, when the relevant roles and credentials are included in the agreed scope. Testing with multiple accounts helps assess access control and workflows that a public-only review cannot reach.
- Can you assess a SaaS application?
- Yes. For a SaaS web application, we agree on tenant boundaries, account roles, and critical workflows. Related API endpoints can be included explicitly in the engagement.
- When should we arrange a web application security assessment?
- Useful points include before launch, after significant authentication or permissions changes, before a major release, or when a customer requests an independent security review.
Related application security services
Android penetration testing
Assess the Android app, its platform interactions, and the way it handles sensitive data.
API penetration testing
Review the server-side permissions and data boundaries behind your web or Android application.
Vulnerability assessment & VAPT
Identify application weaknesses, validate findings, and give engineering a prioritized remediation plan.
Contact
Let's scope it
Tell us what you’re building and where you need a closer look. We’ll work with you to define the right scope.
Remote pentesting for teams in India · custom scope and pricing
hello@wisp-security.com