VAPT Service

Web Application VAPT

Security assessment of web applications — authentication, access control, injection, business logic, session management and application configuration, aligned to the OWASP Top 10 and the OWASP Web Security Testing Guide.

Progress 0% 0 of 0 answered 0 mandatory pending

Please note

Do not enter live passwords, API keys or production credentials in this form. Credentials are shared separately through an approved secure channel.
Only the URLs and functionality listed in the approved scope are tested. Fields marked * are required to begin testing.
This is a controlled, defined-scope assessment — not a red-team engagement.

1 Assessment Details

Mandatory

Organization name *

Technical contact for scope clarifications *

Target start date *

Services required *

Vulnerability Assessment Penetration Testing Retest only

What does the application do, and which functionality is most critical? *

3 Application Inventory and Counts

Drives effort

Enter approximate counts — leave blank or zero where not applicable. The number of applications feeds the timeline estimate in section 7.

Application counts *

Application

Applications in scope

Screens / pages

Languages or localisations

Interfaces

API endpoints

Admin or back-office panels

File upload features

Integrations

Payment or transaction flows

Third-party integrations

SSO / SAML / OAuth integrations

Application URLs and environments in scope *

Only the URLs listed in the approved scope are tested.

Is API testing included in this scope? *

Yes No Not sure

API documentation available

Environment in scope *

Production Environment UAT / Test Discussed during Scope Call

4 Data Sensitivity and Standards

Drives severity ratings

What kind of data does the application handle? *

This decides how serious a finding is, so an approximate answer is fine. Anything unusual can go in the notes below.

Standards and compliance requirements to be referenced

5 How We Test

The same approach every time, adjusted to what your application actually does. Nothing here needs an answer — it is what you are buying.

How the assessment runs

We start by agreeing exactly what is in scope and getting access. We then explore the application the way a user would, to understand what it does and where the sensitive parts are. Automated scanning covers the whole application quickly, and every result is checked by hand before it reaches your report — scanners produce a lot of false alarms and none of them go into the report unverified. The bulk of the time is manual testing, which is where the findings that matter come from. Anything we find is reproduced, evidenced, rated, and written up with clear instructions for fixing it. Once your team has made the fixes, we retest and update each finding.

What we look for

Whether someone can get in without valid credentials, or stay logged in when they should not. Whether one user can reach another user's data, or use functions meant for administrators. Whether data typed into the application can be used to attack the system behind it. How files are uploaded and handled, how data is protected in transit and at rest, and what the application reveals in its error messages.

We also test the business logic — whether steps in a process can be skipped, prices or quantities changed, discounts reused, or a transaction repeated. Automated tools cannot find these, and they are often the most damaging.

What we will not do

This is a controlled assessment, not a red-team exercise. We stay within the agreed scope and testing window, we do only the minimum needed to prove a finding is real, we avoid touching sensitive data unnecessarily, and we never run anything destructive or anything that would take your service offline.

6 Vulnerability Risk Classification

Severity	Description
Critical	May result in complete application, database, server or administrative compromise. Immediate remediation is recommended.
High	May result in significant unauthorized access, sensitive-data exposure, account takeover or privilege escalation.
Medium	May affect application security under specific conditions, or may require limited access or user interaction.
Low	Limited direct security impact; remediated as part of security-improvement activities.
Informational	Security observation, configuration improvement or best-practice recommendation without direct exploitability.

After retesting each finding is marked Closed, Open, Partially Fixed, Risk Accepted or Not Retested.

7 Timeline Estimate

The number of applications is carried over from section 3 automatically.

Timeline inputs

Number of web applications

Parallel testing teams

Number of retests

One retest is included as standard. Increase this only if additional retest cycles are required.

Estimated duration 0 working days

Testing0

Retest0

Subject to final scope review, access availability and resource confirmation. The final timeline is confirmed after the complete scope has been reviewed and understood.

Save and Export Response

Responses are stored in this browser until exported or cleared.