Authentication and sessions
Everything between the login form and the signed-in page.
- Password, OTP and social login flows
- Password reset and account recovery
- Session fixation, timeout and logout
- Multi-factor bypass paths
Protonyte tests web applications and customer portals by hand for companies in the United States, the UK, Canada and the Gulf. We work through the OWASP Web Security Testing Guide, then go past it into your own business rules - the checkout that can be re-ordered, the invoice that belongs to another tenant, the admin page one request away. Every finding comes with the request that proves it, and one free retest once you have fixed it.
A web application penetration test is a controlled attack on your own site, run by a person rather than a product. We are given a set of accounts, or none at all, and we try to reach data and actions that those accounts should never have.
Automated scanning is part of it, but only the first hour. A scanner can tell you a field reflects input. It cannot tell you that order number 10043 belongs to another company, that a coupon can be applied twice if the second request arrives first, or that the password-reset token never expires. Those are the findings that end up in the summary your board reads.
The structure follows the OWASP Web Security Testing Guide, so nothing is skipped. The depth comes from what your application does for a living.
Everything between the login form and the signed-in page.
The single most common serious finding we report.
Where untrusted text reaches an interpreter.
The part no scanner has any idea about.
Where your server fetches or opens something on a visitor’s say-so.
The details that turn a small bug into a big one.
We agree the application, the accounts, the test window and what is off limits, in writing, before anything is touched.
Every page, parameter, role and request is walked and recorded, so the test covers the application rather than its home page.
The long part. Manual testing against the map, then careful exploitation to establish what the issue is actually worth.
Written for two readers: the person who signs and the person who fixes. Each finding carries evidence and a fix.
Included. We attack the fixes the same way and say plainly whether the risk is closed.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows OWASP Web Security Testing Guide, OWASP Top 10, OWASP ASVS, PTES and NIST SP 800-115, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our penetration testing service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
A single application with two or three user roles is usually one to two weeks of testing, plus a few days for the report. Size, the number of roles and how much of the functionality is behind a paywall are what move that number. You get the exact timeline during scoping, before anything is agreed.
Either, and we will tell you which we would prefer for your case. Staging is safer and is usually right when the application handles live money or patient data; production is more honest, because staging is rarely configured the same way. If we test production we avoid destructive techniques and agree a window.
The address of the application, one working account for each role, and a signed authorisation to test. If the application is behind a WAF or an IP allow list we will ask to be let through, because testing the WAF is a different exercise from testing the application.
No. A scan lists what a tool recognises. A penetration test has a person try to use those weaknesses, chain them together and reach something that matters. The findings that cost companies money - access control and business logic - are almost never found by a scanner.
Yes. After the retest we issue a closure summary stating what was tested, when, and that the findings were fixed. That is the document enterprise buyers and ISO 27001 or PCI DSS auditors normally ask for.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.