Web application pentesting

Scanning is not the same as attacking.

We attack your web applications, portals and APIs the way an attacker would, with authorization and method, so that you are the first to find the vulnerabilities. Following OWASP, with findings classified by CVSS and retesting of the fixes.

Request an initial assessment

More than 15 years of experience
Microsoft Partner since 2010
More than 200 large organizations as clients
ISO 27001 certified
In-house team in Barcelona and Madrid

THE STARTING POINT

Applications are the entry point

Scanners find known flaws; attackers look for the logic flaws that no scanner sees.

Injection

Unvalidated forms

Every input field is a candidate for SQL injection, XSS or CSRF if it is not properly validated.

Authorization

Access that should not exist

Users who see other users' data (IDOR) or who reach functions of a higher role.

Sessions

Weak authentication

Unprotected cookies, poorly validated JWT tokens and sessions that never expire.

Configuration

Headers and encryption

Missing security headers, misconfigured TLS and exposed administration panels.

Without a pentest, the first to test your applications may be an attacker.

When does a pentest make sense?

If you identify with any of these scenarios, a pentest gives you the evidence you need.

Before publishing

New application or major release

Validate security before opening a portal, a private area or an API to the internet.

Requested by third parties

Clients, insurers or auditors

Security questionnaires, cyber-risk policies or due diligence that ask for a recent pentest.

Compliance

ISO 27001, ENS or NIS2

Auditors expect periodic testing, classified findings and evidence of retesting.

Sensitive data

Personal or business data

Applications with customer data, payments or critical information and several user roles.

Also as a periodic review: annually or after every relevant change in the application.

A scanner is not enough

A scanner detects the known; a pentest checks what an attacker can actually do.

Scanner only

A list of warnings

Hundreds of unprioritized alerts
False positives that nobody dismisses
Invisible business logic flaws
Permissions between roles unchecked
No evidence that it has been fixed

Result: a feeling of security, not security

With Itequia

A controlled and documented attack

Automated and manual tests combined
Every role, tested against every function
Controlled exploitation that confirms the risk
Findings classified with CVSS
Retest included to close each finding

Result: vulnerabilities confirmed and closed

What an attacker would do, with authorization

We combine the coverage of tools with the judgment of a specialist: neither is enough on its own.

The tools

Automated testing

Active scanning, path enumeration and analysis of the server and encryption, across the entire surface.

The specialist

Manual testing

Injection, sessions and business logic, role by role: what no scanner detects.

The result

Confirmed risk

Each vulnerability, exploited in a controlled manner, classified and with its fix.

Where we attack

Forms

SQL injection, XSS and CSRF in every input field

Roles

Authorization matrix: privilege escalation and IDOR

Sessions

Authentication, cookies and JWT tokens for each role

Server

HTTP headers, TLS configuration and administration panels

What we test

We follow the OWASP testing guide (WSTG) and cover the OWASP Top 10 risks.

Reconnaissance

DNS and subdomains
Exposed technologies
HTTP headers
Hidden paths and files

Data inputs

SQL injection
Cross-site scripting
CSRF
Input validation

Configuration

Security headers
TLS and certificates
Web server

Authentication

Login and passwords
Session management
Cookies and JWT tokens
Expiration and logout

Authorization

Role–function matrix
Privilege escalation
Other users' data (IDOR)
Administration panel

Preferably in pre-production, or in production during agreed windows, with no impact on your users.

Our difference

A measured scope, not a rough estimate

The effort does not depend on the number of pages, but on the real attack surface.

We measure the surface

An OWASP ZAP crawl counts the pages (P) and forms (F) of the application.

We weigh the risk

Each form weighs three times and each user role (R) multiplies: (P + 3F) × R.

Fixed price

The score places the application at a level with effort and price fixed in advance.

A 10-page portal with 4 roles may require more testing than an 80-page one without login.

Four steps, from authorization to retest

The duration is adjusted to each case: pages, forms and user roles in scope.

Signed scope

Authorization

Scope, environments, testing windows and emergency contact, in writing.

Measurement and preparation

Reconnaissance

Application crawl, confirmation of complexity and passive reconnaissance.

Automated and manual

Execution

Scans, manual role-by-role testing and controlled exploitation of findings.

Technical team and management

Report and retest

Reports with CVSS, remediation plan and verification of the fixes.

What you receive: evidence to act on

Executive report

The relevant risks and their potential impact, without technical jargon, for management.

Technical report

Each finding with its description, evidence and CVSS classification, from critical to informational.

Remediation plan

Prioritized by risk, with a specific recommendation per finding for the development team.

Retest

Verification that the fixed vulnerabilities have effectively been closed.

Evidence for the ISMS

Documentation ready for the ISO 27001 or ENS auditor.

The pentest confirms the risk and defines how to close it. Code correction, infrastructure auditing and periodic pentests are separate services.

How it is contracted

Fixed price, no further commitments

Each step is decided with the information from the previous one: the pentest does not oblige you to contract anything else.

Initial assessment

One session to confirm the applications, environments and user roles in scope.

Pentest

At a fixed price, based on the complexity score of each application.

Remediation

As a project: code and configuration, according to the remediation plan.

Periodic review

Annual pentest or after each relevant release, using the same method.

The report and the remediation plan are yours, to carry out with whoever you choose. Tests are authorized in writing and data is handled under our ISO 27001 certification.

The difference from a scanner report

A team that also develops and operates applications.

Confirmed findings

Each vulnerability, exploited in a controlled way and verified by specialists.

Security we practice

Itequia is ISO 27001 certified and works in regulated environments: banking, pharma, industry and the public sector.

We know how to fix it

We have been developing applications since 2008: applicable fixes and, if you want, we implement them.

What you get

Confirmed risk

What an attacker can really do in your applications.

Clear priorities

Findings classified by CVSS, from critical to informational.

Verified fixes

Retest of every closed vulnerability.

Evidence for third parties

Reports for customers, insurers and auditors.

Compliance

Technical vulnerability management for ISO 27001, ENS and NIS2.

Limited cost and scope

Fixed price calculated with an objective method.

Where the pentest fits

The pentest works on its own or alongside Itequia's other cybersecurity services.

Audit the network

Cybersecurity audit

Infrastructure vulnerabilities and policy maturity.

Learn about the service

Test the applications

Web application pentesting

Controlled attacks, role by role, with retest of the fixes.

Assess the applications

Well-Architected assessment

Code, architecture and platform against the five pillars.

Learn about the service

Comply

NIS2, ENS and ISO 27001 diagnosis

Applicability, gap per framework and prioritized action plan.

Learn about the service

Each service is contracted separately. Infrastructure, applications and compliance with the same partner.

Why Itequia is the best choice for your software development needs?

With over 15 years of experience in the digital sector, we offer efficient and personalized software development services. Our agile methodology and management tools guarantee deliveries that adapt to your needs.

As a Microsoft Solutions Partner, we have the competence and experience to use the most advanced technologies.

We have a team of more than 50 highly qualified human professionals consisting of analysts, designers, developers, testers, consultants, and project managers.