Web Application and API Penetration Testing
Every web application and API penetration test is performed by senior ethical hackers; retesting of remediated findings is included as standard.
What is tested and why it matters
Understanding the attack surface before defining the scope.
Web applications and APIs are the primary interface between an organisation and its users, partners, and third-party systems. A vulnerability in an authentication flow, a data validation gap in an API endpoint, or a misconfigured trust boundary can expose sensitive data, disrupt operations, or provide an attacker with a foothold for lateral movement. Standard automated scans identify known patterns but miss business logic flaws, chained attack paths, and context-specific weaknesses in how endpoints interact. Manual penetration testing by experienced ethical hackers confirms exploitability, documents preconditions, and provides remediation guidance that addresses the root cause rather than the symptom.
Who needs this assessment
Organisations that benefit most.
This service is designed for organisations that handle sensitive data, operate critical systems, or must demonstrate security assurance to clients, regulators, or partners.
Organisations that operate customer-facing web applications or client portals
SaaS providers and e-commerce platforms exposing business logic through APIs
Financial services organisations with partner integrations and payment flows
Development teams preparing a release for production and seeking third-party security validation before deployment
Organisations pursuing ISO 27001, PCI-DSS, or NIS2 compliance that require evidence of application-level testing
Healthcare organisations and government service providers handling citizen or patient data through regulated digital interfaces
Where these assessments are relevant
- Financial services: customer portals, payment processing, and cloud-hosted transaction infrastructure.
- SaaS and technology: application validation before production deployment or enterprise procurement.
- Healthcare: digital systems handling patient data, clinical records, and connected medical devices.
- Retail and e-commerce: web applications processing transactions, customer accounts, and payment data.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering technical findings, severity ratings, evidence, and remediation guidance. Reports are delivered through the Pentrox Portal and are available for download at any time.
- A prioritised list of confirmed vulnerabilities with severity ratings, evidence, and remediation guidance
- Validation of authentication, authorisation, and session handling controls against OWASP ASVS
- Insight into chained attack paths that automated tools do not detect
- A report structured for both technical teams and executive leadership, delivered within five business days after completion of testing
- Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from reconnaissance through verified remediation.
Each phase builds on the previous one. Reconnaissance informs targeted testing, manual analysis confirms automated findings, and quality review ensures every reported vulnerability is reproducible and accurately rated.
Reconnaissance and mapping
The attack surface is mapped: endpoints, parameters, authentication mechanisms, and trust boundaries. API documentation is reviewed where available.
OWASP WSTG Section 4.1 (Information Gathering), PTES (Intelligence Gathering)Automated scanning
Automated scans using Burp Suite and Nessus identify known vulnerability patterns, TLS issues, and HTTP header weaknesses. Every automated finding is manually verified to eliminate false positives.
OWASP Top 10, OWASP API Security Top 10Manual testing and exploitation
Hands-on testing using Burp Suite Professional as an intercepting proxy. Authentication flows, authorisation boundaries, business logic, and data serialisation are tested from both authenticated and unauthenticated perspectives.
OWASP WSTG (full coverage), OWASP ASVS, PTES (Vulnerability Analysis, Exploitation)Reporting and quality review
Findings are documented with evidence, reproduction steps, severity rating, and remediation guidance. Every report undergoes internal quality review by a second senior tester before delivery.
OWASP ASVS (verification mapping), OWASP Risk Rating Methodology (severity rating)Retesting and verification
After remediation, each finding is retested and updated with its new status. Results are published through the Pentrox Portal. Retest cycles repeat until resolved.
PTES (Post-Exploitation, Reporting)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact systems, endpoints, and testing approach before the assessment begins. The lists below reflect the standard scope for a web and API penetration test.
In scope
- Authentication and session management testing
- Authorisation and access control validation across user roles
- Business logic testing for application-specific workflows
- API endpoint enumeration, parameter manipulation, and data serialisation testing
- Input validation and injection testing (SQL, XSS, command injection, SSRF)
- HTTP header hardening, cookie flags, and CORS configuration review
- File upload handling and secrets management assessment
- TLS configuration and transport security validation
- CMS websites (WordPress, Drupal, Umbraco, Sitecore): plugins and themes, admin panel, user roles and update status
Out of scope
- Denial-of-service (DoS) testing unless explicitly agreed in the statement of work
- Social engineering of the client organisation
- Physical security testing
- Testing of third-party services outside the agreed scope boundary
What you receive
- Executive summary Severity distribution, risk overview, and remediation priorities written for leadership.
- Detailed findings Each vulnerability documented with evidence, reproduction steps, OWASP risk rating, and remediation guidance.
- Technical conclusion Patterns, control gaps, and structural recommendations beyond individual fixes.
- Scope and strategy description Goals, test approach, and scope boundaries for audit traceability.
- Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Retest report Verification results after remediation, documenting each finding with its updated status.
Read more
Web application penetration testing in the Netherlands
The Dutch frameworks that ask for the test, what the report must contain, and indicative cost.
Blind SQL injection: DNS exfiltration
A field note from a real web application assessment: how a blind SQL injection leaked customer data over DNS, and the same-day fix.
How long does a penetration test take?
Testing days per service, the steps from the first call to the retest, and what stretches the calendar.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a web and API penetration test depends on the size of the application, the number of interfaces under test, and the testing approach. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Number of pages, forms, and API endpoints under test
- Testing approach (white box, grey box, or black box)
- Number of user roles and privilege levels to validate
- Whether application and API documentation is available (user guides, OpenAPI, GraphQL schema)
- Whether testing is performed in a production or non-production environment
Actual duration is confirmed during scoping and depends on test approach and environment access. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every web and API assessment.
These operational standards apply to every web and API assessment Pentrox delivers, regardless of scope or testing approach.
Senior-led testing
Every assessment is performed or supervised by experienced ethical hackers.
Pentrox does not delegate assessments to junior testers. Pentesters hold industry-standard certifications (OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES, BSCP) and every report passes internal quality review before delivery.
Beyond automated scanning
Business logic flaws and chained attack paths that scanners miss.
The manual testing phase confirms exploitability, documents preconditions, and identifies trust boundary violations. Automated scan results are verified to remove false positives before reporting.
Direct access to the tester
No account managers between the client and the security expert.
Critical or blocking findings are escalated immediately through the channel agreed at kickoff. Remediation can begin before the final report is delivered.
Portal-delivered results
Findings visible in real time, not buried in a PDF delivered weeks later.
The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Two-factor authentication and role-based access control are enforced on every account.
Retest included
Verification that fixes are effective, at no additional cost.
Remediated findings are flagged through the Portal and scheduled for verification. Each finding is re-evaluated individually. Retest cycles repeat until all findings are resolved.
Frequently asked questions
Practical answers for security teams and procurement officers.
Is the methodology aligned with OWASP?
The assessment follows the OWASP Web Security Testing Guide (WSTG), the OWASP API Security Top 10, and the OWASP Application Security Verification Standard (ASVS). Testing is further aligned with the Penetration Testing Execution Standard (PTES). Standards references are documented in the report.
Is retesting included, and at what cost?
Retesting of remediated findings is included as standard with every assessment. There are no additional charges for verifying that fixes have been implemented correctly. The retest process is managed through the Pentrox Portal, where the client can flag remediated findings and request a retest.
What clearances do the testers hold?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers with extensive hands-on experience.
Can this report be used as audit evidence for ISO 27001 or PCI-DSS?
The report is structured for audit traceability, with a clear scope description, named standards, severity ratings, and remediation status per finding. Penetration test reports structured in this format are routinely used as supporting evidence for ISO 27001 and PCI-DSS assessments. It is worth noting that the report documents the technical assessment; it does not replace the audit itself.
How is production impact managed?
All testing is performed in a controlled, non-destructive manner. Pentrox recommends testing in a non-production environment where possible. Where production testing is required, testing windows, excluded operations, and escalation contacts are agreed in the statement of work before the assessment begins.
Is the report delivered in Dutch or English?
Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
What happens when a critical vulnerability is found during testing?
Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.
Does Pentrox test CMS websites such as WordPress or Drupal?
Yes. A CMS pentest is a web application test with extra attention for the plugins and themes, the admin panel, the user roles and the update status of the core. Most findings on CMS sites come from third-party plugins and weak admin accounts, so those are tested first. Custom modules and integrations are tested like any other application code.
Related assessment categories
Compliance and Standards
ISO 27001, NIS2, PCI-DSS, and DigiD assessments against a defined control framework.
Advanced Testing
Scenario-based assessments, red team exercises, mystery guest, and phishing simulations.
Pentest as a Service (PTaaS)
A continuous subscription covering recurring assessments across an agreed annual day allocation.