Web application penetration testing

Why a web pentest goes beyond a scanner

Automated tools find outdated versions and missing headers. The findings that cause real breaches — one user seeing another's data, a coupon applied endlessly, an invite that grants admin access — depend on understanding what the application is supposed to allow. That is expert work, and it is where we spend the testing time.

What we test

• Authentication and session: login, MFA, password reset, SSO/OAuth, session expiry and revocation.
• Authorization: horizontal and vertical access across users, roles and tenants (BOLA/IDOR, privilege escalation).
• Business logic: payments, coupons, limits, approval flows, race conditions.
• Injection and input handling: SQL/NoSQL, XSS, template injection, file upload, deserialisation.
• Integrations and server side: SSRF, webhooks, cloud storage, CORS and headers.
• Data exposure: responses returning more than the UI shows, logs, files and reachable backups.

Coverage guided by the OWASP Top 10, OWASP WSTG and ASVS, as black, grey or white box — we recommend grey box for the best coverage per testing day.

How it works

1. Scoping (one call): we learn the features, roles and environment. Fixed-price proposal within 24 hours.
2. Preparation: NDA, rules of engagement, per-role test accounts and a testing window.
3. Testing: reconnaissance, manual analysis and controlled exploitation. Critical findings are reported immediately.
4. Reporting: executive summary, findings with severity, evidence and remediation for your stack.
5. Retest: we validate the fixes and issue an updated report.

Typical web application findings

• A regular user reading other customers' orders, invoices or documents.
• An invite or role change that grants admin privileges.
• Password reset or email change flows that allow account takeover.
• Coupons, limits and balances manipulable through race conditions.
• File uploads that accept executables or expose other users' files.
• Internal functions reachable without authentication because they were only hidden in the UI.

Every finding comes with a proof of concept and its business impact.

A pentest that holds up in audits

The report includes scope, dates, methodology, justified severity and retest evidence — what auditors and customers look for under SOC 2 (CC4.1, CC7.1), ISO 27001 (A.8.8, A.8.29), PCI DSS 4.0 (requirement 11.4), HIPAA, GDPR (Art. 32), NIS2 and DORA. We also issue an attestation letter you can share with customers without exposing technical detail.

Why Pentest Machine

• The founder runs tests and owns quality. 20+ years of experience, an international career at six of the world's largest companies and talks at OWASP AppSec USA, Black Hat and several BSides. He takes part in testing and reviews every report before delivery.
• Only senior specialists attack. In-house tooling and AI speed up repetitive work; deciding what to exploit and how to chain it stays human.
• Commercial transparency. Fixed price within 24h, NDA before scoping, retest included and invoicing in the US, EU or Brazil.
• A report for three audiences: the board, developers and auditors.

What you get

• Technical report and executive summary (EN, PT or ES).
• A reproducible proof of concept and business impact for every finding.
• Justified severity (CVSS adjusted to context).
• A walkthrough session with your developers.
• Retest included, plus an attestation letter for customers and audits (SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR).

Frequently asked questions

Further reading

• How much does a penetration test cost in 2026
• What is penetration testing? Types explained
• JWT and OAuth mistakes we keep finding
• Checklist for hiring a pentest

Other services