Web apps

Web application vulnerability testing

Unauthenticated vulnerability scan of one web application with severity-ranked findings and fix guidance. From $350 per scan.

A web application scan looks at the running site the way an attacker would: input handling, session management, headers, exposed files and outdated components. Every finding in the report comes with the request that proves it.

Method

  1. Scope: hostname, environment, ownership and testing window confirmed.
  2. Automated crawl and scan.
  3. Manual verification of Critical and High results.
  4. Report and consultation, then a retest of fixed items.

Included at the starting price

  • Crawl and vulnerability scan of one web application (one hostname)
  • Checks aligned to the OWASP Top 10 and common misconfigurations
  • Manual verification of Critical and High findings
  • Findings with request and response evidence

Not included

  • Authenticated testing behind login (quoted separately)
  • Denial-of-service or load testing
  • Social engineering

Deliverable

Technical report (PDF) with evidence per finding, an executive summary and a results consultation call.

Questions

Will the scan affect my live site?

Scans are rate-limited and run in an agreed window. Destructive checks are off unless you request them against a staging copy.

Do you test staging or production?

Either. Staging is preferred when it mirrors production; the report states which environment was tested.

Request an assessment

Tell us what you need tested.

We reply within one business day with a scoped proposal. No scan runs until ownership of the target is confirmed.

  • Web, app and API testing
  • Code analysis and server scans
  • Ongoing patch management
  • Post-quantum readiness review

Enter your name.

Enter a valid email address.

Hostnames can wait for the scoping call.

Request sent. We'll reply within one business day with a scoped proposal.