Penetration testing for web apps
Hands-on offensive security testing by a practitioner with 700+ engagements for 200+ clients over 7 years.
Sped up by our own AI agent, so you pay for testing, not padded days.
Services
Every engagement runs to a published method, ends with an independent report and includes a retest of what you fix.
Network, web, API and mobile, tested by hand the way an attacker would.
AWS, Azure, Google Cloud and Kubernetes, reviewed read only against CIS benchmarks.
The code where security decisions live, read by a tester who knows how it gets attacked.
Also available: Vulnerability assessment, Red teaming, Social engineering.
How we test
A thorough test means hundreds of repeatable checks. Our AI agent runs them first, so testing hours go where real attacks happen. The days it saves come off your quote.
Repeat every release or quarter, starting again from scope.
What you get
Leadership gets risk in plain words, engineers get proof and the fix, auditors get scope, method and limits. Pick a reader to see the page they get.
We tested the Example Payments web application and its API from 4 to 12 November. We found nine issues. Two are high risk: a signed-in customer can read and change other customers' orders.
Findings by severity
Fix these first
| Severity | High CVSS 3.1 score 8.1 |
|---|---|
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Affected | GET, PATCH /api/v2/orders/:id |
| Reference | WSTG-ATHZ-04, CWE-639 |
Steps to reproduce
GET /api/v2/orders/10482
Authorization: Bearer <customer B>
200 OK {"order": 10482, "customer": "A"}Recommendation
Load each order by its id and the signed-in customer together. Return 404 when they do not match.
An independent third-party assessment, carried out under written authorisation from Example Payments.
| Targets | app.example.com, api.example.com |
|---|---|
| Roles | Customer, merchant, admin |
| Window | 4 to 12 November |
| Method | OWASP WSTG, OWASP API Security Top 10 |
| Scoring | CVSS 3.1, vector on every finding |
| Out of scope | Denial of service, third-party payment pages |
| Testers | Named in appendix A, with certifications |
Limitations
File upload was not tested. The test account had no upload rights. It is listed as not tested, not as passed.
Four findings were in the retest scope. We retested them on 19 November. Three are fixed. Your team accepted the risk on the fourth.
| Finding | Severity | Result |
|---|---|---|
| 4.1 Orders across customers | High | Fixed |
| 4.2 Admin API without second factor | High | Fixed |
| 4.3 Reset links never expire | Medium | Fixed |
| 4.9 Stack traces in errors | Low | Risk accepted |
The remaining five medium and low findings were outside the retest scope and stay open in the findings register.
Who tests
Cerberon is led by Samyam Ray. Close to 7 years across three seats in security: defending networks and identity, attacking them through VAPT, application, API and cloud assessments, red teaming and social engineering, and now governing them through ISO 27001, SOC 2 and ISO 42001 programmes.
That last seat matters to you. Reports are written knowing what auditors and enterprise buyers look for. No sales team, no juniors learning on your app, no handoffs.
For compliance firms and consultancies
ISO 27001 and SOC 2 consultants, vCISOs and security firms with more work than testers: send us the scope and we deliver the test, the report and the retest, under your brand if you prefer. Partner rates for regular work.
Free scan
Your first scan is free: one web app or API, one mobile app, or up to 5 public IP addresses, with a full report. One per company. See real findings from your own systems before you spend anything.
One free scan and one report per company.
Cerberon AI platform
The same agent we test with runs on your own server: pentest, SAST, DAST, cloud, containers, SCA and SBOMs, every release, with every finding tracked to closure.
A free 30-minute scoping call, then a fixed quote. We reply within one business day.