Expert service

Web and API testing by real people.

We test your application and its APIs the way an attacker would: every role, every endpoint, and the business logic no scanner understands.

Scope this engagement What we report

Why teams book this test

A customer asked for it.Enterprise buyers and security questionnaires want a recent independent test. You get a third-party report you can send them.
An audit is coming.Reports your ISO 27001 or SOC 2 auditor can use as evidence.
You shipped something risky.A new login, a payment flow, a public API or a second tenant. Prove it holds before an attacker tries.

What we test

Authentication, sessions and password reset flows
Access control between users, roles and tenants
Business logic, payment and workflow abuse
REST and GraphQL APIs, object and function level authorisation
Injection, file upload and server-side request forgery
Client-side issues, including stored and DOM cross-site scripting

How an engagement runs

ScopeA free 30-minute call. Targets, rules, dates.
TestHands-on, to the agreed method.
VerifyEvery finding confirmed with evidence.
ReportImpact and a clear fix for each one.
RetestWe check what you fixed.

Repeat every release or quarter, starting again from scope.

Why experts

What you receive

A human tests intent, chains attacks and signs the report as an independent third party. That is what the platform alone cannot give you.

An executive summary written for leadership and customers
Every finding with evidence, CVSS 3.1 score, impact and a fix your team can follow
An independent third-party report. Reports your ISO 27001 or SOC 2 auditor can use as evidence.
Retesting of fixed findings, agreed in the quote
A walkthrough call with your team

What we report

One report. Every reader covered.

Pick who is reading. Each one gets the page they need, from the same test.

CERBERONWeb and API penetration testConfidential

1Executive summary

We tested the Example Payments web application and its API from 4 to 12 November. We found nine issues. Two are high risk: a signed-in customer can read and change other customers' orders.

Overall riskHigh

Findings by severity

Critical0

High2

Medium3

Low4

Fix these first

Check order ownership on every order request. High
Require a second factor on the admin API. High
Expire password reset links after one use. Medium

CERBERONWeb and API penetration testConfidential

4.1Orders readable and editable across customers

Severity	High CVSS 3.1 score 8.1
Vector	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected	GET, PATCH /api/v2/orders/:id
Reference	WSTG-ATHZ-04, CWE-639

Steps to reproduce

Sign in as customer B.
Request order 10482, which belongs to customer A.
The API returns the order. PATCH changes it.

GET /api/v2/orders/10482
Authorization: Bearer <customer B>

200 OK  {"order": 10482, "customer": "A"}

Recommendation

Load each order by its id and the signed-in customer together. Return 404 when they do not match.

CERBERONWeb and API penetration testConfidential

2Scope and methodology

An independent third-party assessment, carried out under written authorisation from Example Payments.

Targets	app.example.com, api.example.com
Roles	Customer, merchant, admin
Window	4 to 12 November
Method	OWASP WSTG, OWASP API Security Top 10
Scoring	CVSS 3.1, vector on every finding
Out of scope	Denial of service, third-party payment pages
Testers	Named in appendix A, with certifications

Limitations

File upload was not tested. The test account had no upload rights. It is listed as not tested, not as passed.

CERBERONWeb and API penetration testConfidential

6Retest summary

Four findings were in the retest scope. We retested them on 19 November. Three are fixed. Your team accepted the risk on the fourth.

Finding	Severity	Result
4.1 Orders across customers	High	Fixed
4.2 Admin API without second factor	High	Fixed
4.3 Reset links never expire	Medium	Fixed
4.9 Stack traces in errors	Low	Risk accepted

The remaining five medium and low findings were outside the retest scope and stay open in the findings register.

The usual pentest, minus the usual pain.

Typical pentest firm

PriceDay rates that grow with the job
FindingsScanner output with your logo on it
Follow-upBilled as a new engagement
HandoverA PDF in your inbox
Next yearStart again from zero

Cerberon experts

PriceA fixed quote after a 30-minute call
FindingsEvery finding backed by evidence, with what to fix
Follow-upRetest or follow-up agreed in your quote
HandoverA walkthrough call with your team
Next yearKeep testing on your own server with the Cerberon platform

Questions about this service

How is a manual web application test different from a scan?

A scanner finds known patterns. A consultant tests how your application is meant to work and where it breaks, such as one tenant reading another's data or skipping a payment step.

Do you test as authenticated users?

Yes. We test as every role you give us, and across roles, which is where most serious access control issues are found.

What do you need to test our API?

An OpenAPI or Swagger file, a Postman collection or a traffic capture, plus test accounts for each role. GraphQL APIs are covered too, including introspection, query depth and batching.

Tell us what you need tested.

A 30-minute scoping call, then a fixed quote.

Scope an engagement See pricing

Web and API testing by real people.

Why teams book this test

What we test

How an engagement runs

What you receive

One report. Every reader covered.

1Executive summary

4.1Orders readable and editable across customers

2Scope and methodology

6Retest summary

The usual pentest, minus the usual pain.

Questions about this service

Keep reading

Tell us what you need tested.