We've rebranded! Find out more about our rebrand to LRQA Nettitude here
Select Page


Web applications are one of the most common types of software in use today. Due to their complexity and ubiquity, web applications represent a unique challenge to the security posture of any organisation. Modern web applications handle increasingly sensitive data, so it is important to ensure that they do not introduce significant risk to an organisation.

LRQA Nettitude has a large team of CREST certified penetration testers who specialise in web application penetration testing. The LRQA Nettitude penetration testing team is diverse and contains a wealth of experience in both security and software development.

LRQA Nettitude are highly capable of penetrating testing web applications, web services, APIs and more, across an extremely large range of technologies.

For rigorous assurance, LRQA Nettitude recommends testing applications using the methodology set forth in the Application Security Verification Standard (ASVS). This ensures appropriate depth and breadth of testing is achieved when assessing the security posture of your web application.

What Are The First Stages Of Web Application Testing?

Based on the individual organisation’s requirements, LRQA Nettitude will first formalise an appropriate testing strategy. Various levels of simulated attack are possible, each with their own points of merit.  It is important, before technical delivery commences, to identify primary security concerns such that the overall security posture of the web application can be accurately evaluated.

Because of these factors, the very first step is to receive an in-depth consultation with a LRQA Nettitude web application penetration testing expert, so that a strategy appropriate to the goals of the engagement can be designed and proposed.

Technical Delivery

Both breadth and depth of findings must be achieved during most engagements. Consequently, LRQA Nettitude use a combination of manual and automated tools and techniques throughout each engagement. The toolsets used vary from well configured off the shelf software to custom made tools, depending on the task at hand.

LRQA Nettitude utilises a methodology that moves from initial discovery exercises through to in-depth exploitation:

  • Reconnaissance and threat intelligence gathering
  • Enumeration
  • Vulnerability Discovery
  • Exploitation
  • Post Exploitation

Once the full attack surface of a web application has been mapped, LRQA Nettitude proceed to probe for vulnerabilities.

Design, implementation and operational vulnerabilities are all analysed and exploited in a standard web application penetration test. LRQA Nettitude go far beyond basic lists such as the OWASP Top 10 and ensure that all possible weaknesses are analysed.

Understanding each web applications functionality from an end users perspective is important to LRQA Nettitude and allows flaws to be uncovered that are often missed by others. Each engagement is unique and LRQA Nettitude ensures that priority is given to those flaws that directly affect the primary security concerns described by the client organisation, ahead of the test.

It is not uncommon for LRQA Nettitude to uncover methods of remote code execution and advanced data exfiltration, even in commercial off the shelf web applications. LRQA Nettitude specialise in identifying application attack chains; it is often the case that the overall impact of a series of flaws is greater than the sum of its parts.

Reporting And Output

It is important for each web application penetration test to result in clear and actionable output. LRQA Nettitude delivers a management report and a technical report at the end of each engagement. The management report is designed to be consumed by a business audience and describes the engagement in terms of risk. The technical report is typically a longer document that describes each of the findings in detail, along with appropriate remedial advice. These reports are subjected to a rigorous quality assurance process before final delivery.

At the request of the client ahead of the engagement, LRQA Nettitude can tailor the web application penetration testing output in a multitude of ways to meet organisation specific requirements.

Remedial Advice

LRQA Nettitude’s web application penetration testers all have robust programming ability and typically have professional developer backgrounds. This ensures that the advice given and the tests performed are useful and relevant.

Importantly, LRQA Nettitude are able to provide robust and actionable remedial advice for all levels of vulnerability. LRQA Nettitude understands that one of the most valuable portions of any engagement is the formulation of remedial and preventative strategy. LRQA Nettitude consultants are on hand, both during and after the engagement, to provide in depth guidance based on years of unique experience.

Debriefs And Beyond

LRQA Nettitude believe that it is important to ensure that full comprehension of the engagement has been achieved. All web application penetration testing engagements come with a debrief or ‘readout’ as standard. The reports will be delivered in advance of the debrief in order to give time for the organisation to digest the content and to formulate any questions or thoughts ahead of time.

Get a free quote

speak to our experts