Select Page


Web applications are one of the most common types of software in use today. Due to their complexity and ubiquity, web applications represent a unique challenge to the security posture of any organisation. Modern web applications handle increasingly sensitive data, so it is important to ensure that they do not introduce significant risks to an organisation.

Nettitude has a large team of CREST certified penetration testers who specialise in web application penetration testing. The Nettitude penetration testing team is diverse and contains a wealth of experience in both security and software development.

Nettitude is highly capable of penetrating testing web applications, web services, APIs and more, across an extremely large range of technologies.

What Are The First Stages Of Web Application Testing?

Based on the individual organisation’s requirements, Nettitude will first formalise an appropriate testing strategy to suit system and compatibility needs. Various levels of simulated attack are possible, each with its own points of merit.  It is important, before technical delivery commences, to identify primary security concerns such that the overall security posture of the web application can be accurately evaluated.

Because of these factors, the very first step is to receive an in-depth consultation with a Nettitude web application penetration testing expert, so that a strategy appropriate to the goals of the engagement can be designed and proposed.

Technical Delivery

Both breadth and depth of findings must be achieved during most engagements. Consequently, Nettitude uses a combination of manual and automated tools and techniques throughout each engagement. The toolsets used vary from well configured off-the-shelf software to custom made tools, depending on the task at hand and system compatibility.

Nettitude utilises a methodology that moves from initial discovery exercises through to in-depth exploitation:

  • Reconnaissance and threat intelligence gathering
  • Enumeration
  • Vulnerability Discovery
  • Exploitation
  • Post Exploitation

Once the full attack surface of a web application has been mapped, Nettitude will proceed to probe for vulnerabilities.

Design, implementation and operational vulnerabilities are all analysed and exploited in a standard web application penetration test. Nettitude goes far beyond basic lists such as the OWASP Top 10 to ensure that all possible weaknesses are analysed.

Understanding each web application’s functionality from an end user’s perspective is important to Nettitude and allows flaws that are often missed by others to be uncovered. Each engagement is unique and Nettitude ensures that priority is given to flaws that directly affect a system’s primary security concerns described by the client organisation, ahead of the test.

It is not uncommon for Nettitude to uncover methods of remote code execution and advanced data exfiltration, even in commercial, off-the-shelf web applications. Nettitude specialises in identifying application attack chains; it is often the case that the overall impact of a series of flaws is greater than the sum of its parts.

Frequently Asked Questions About Web Application Testing


How Will My Web Application Testing Results Be Delivered?

It is important for each web application penetration test to result in clear and actionable output. Nettitude will deliver a management report and a technical report at the end of each engagement. The management report is designed to be consumed by a business audience and describes the engagement in terms of risk. The technical report is typically a longer document that describes each of the findings in detail, along with appropriate remedial advice. These reports are subjected to a rigorous quality assurance process before final delivery.

At the request of the client ahead of the engagement, Nettitude can tailor the web application penetration testing output in a multitude of ways to meet organisation-specific requirements.


Will Nettitude Provide a Debrief of My Results Beforehand?

Nettitude believes that it is important to ensure that full comprehension of the engagement has been achieved. All web application penetration testing engagements come with a debrief or ‘readout’ as standard. The reports will be delivered in advance of the debrief in order to give time for the organisation to digest the content and to formulate any questions or thoughts ahead of time.


Will Nettitude’s Testers Provide Advice On Discovered Vulnerabilities?

Nettitude’s web application penetration testers all have robust programming ability and typically have professional developer backgrounds. This ensures that the advice given and the tests performed are useful and relevant.

Importantly, Nettitude is able to provide robust and actionable remedial advice for all levels of vulnerability. Nettitude understands that one of the most valuable portions of any engagement is the formulation of remedial and preventive strategies. Nettitude consultants are on hand, both during and after the engagement, to provide in-depth guidance based on years of unique experience.

Get a free quote

speak to our experts