Offensive security
Test the application the way an attacker uses it.
Manual, authenticated security testing of web applications — business logic, access control, session handling and injection classes.
Test sequence
Scope: Roles, environments, test data and rules of engagement.
A web application security assessment is a manual penetration test of a running web application. Automated scanners find known patterns; our testers work through the application with real user roles to find broken access control, flawed business logic and authorisation gaps that scanners structurally cannot detect. Testing follows the OWASP Testing Guide and is mapped to the OWASP Top 10, so results are comparable and auditable.
This assessment is a focused form of penetration testing for running web applications.
Where the application exposes substantial backend interfaces, add dedicated API Penetration Testing for every endpoint, role and object boundary.
Between manual tests, Vulnerability & Threat Assessment helps maintain a prioritised view of exposure.
€1,500 excl. VAT
Configure with our team€3,600 excl. VAT
Configure with our teamCustom scope
Configure with our teamOur experts hold certifications including OSEE, OSCP, OSWE, OSEP, OSED, OSWP, eWPTx, eMAPT, eCPPT, CRTO and CEH.
Evolvice operates certified quality-management and information-security systems under ISO 9001:2015 and ISO 27001:2022.
More than thirteen years of technology delivery inform scoping, communication, reporting and remediation support.
“Their penetration testing report was not only detailed but actionable. Our developers could immediately start fixing the issues.”
“They helped us identify critical vulnerabilities we didn’t know existed. A truly professional and responsive team.”
“From the initial scoping call to the final report, everything was handled with precision and professionalism.”
Horizontal and vertical privilege testing across every user role and tenant boundary.
Workflow abuse, price and quantity manipulation, state and sequence bypasses.
SQL, NoSQL, command, template and XSS testing against real application behaviour.
Login, MFA, password reset, token lifetime and session invalidation.
SSRF, insecure deserialisation, file upload handling and misconfiguration.
Vulnerable dependencies assessed in the context of your application, not in isolation.
A typical business application takes five to ten working days of testing, depending on the number of roles and the size of the functional surface. Scope is agreed before the engagement starts.
Staging is preferred when it mirrors production. Production testing is possible under agreed rules of engagement, defined windows and escalation contacts.
A technical report with reproduction steps and fix guidance, an executive summary for decision-makers, and a retest of remediated findings.
A scan matches known signatures. This is manual testing that chains findings together and proves real exploitability — including logic flaws a scanner cannot see.