Information Gathering
Collect passive and active information about the application and sensitive data that should not be exposed, including technology fingerprinting and endpoint enumeration.
Application Security
Web Application Penetration Testing
Web applications are among the most targeted assets by attackers. At BlockSecBrain, our researchers identify all input fields, detect technical, business logic, and network-level vulnerabilities, and exploit them where suitable to demonstrate proof-of-concepts. Testing is performed using manual, automated, and hybrid approaches.
Overview
Testing Applications the Way Attackers Actually Use Them
Scanners find known patterns. Attackers find the gap between how an application was designed and how it behaves under pressure. Our engineers work through the application as an authenticated adversary would, mapping every role, state transition, and trust assumption before attempting to break them.
Every reported issue is manually verified and reproduced. You receive exploitation evidence, affected endpoints, and a fix that addresses the root cause rather than the symptom.
Testing covers the full request path: browser-side controls, session and identity handling, server-side authorisation, the API layer behind the interface, and the third-party integrations that inherit your users' trust.
Key activities
- Authenticated and unauthenticated testing across every user role
- OWASP Top 10 and SANS/CWE Top 25 coverage
- Business logic and workflow abuse testing
- Broken access control and IDOR enumeration
- Injection testing: SQL, NoSQL, command, template, and XXE
- Session management, JWT, SSO, and MFA bypass testing
- REST, GraphQL, and legacy SOAP API security testing
- File upload, deserialisation, and SSRF exploitation
- Client-side testing: XSS, DOM sinks, CSP, and CSRF
- Subdomain and forgotten-endpoint discovery
Assessment Methodology
Testing Methodology & Stages
A structured, repeatable process from reconnaissance to validated remediation.
Vulnerability Identification
Use manual testing and focused scanners to confirm security issues and eliminate false positives, including OWASP and business logic checks.
Exploit Progress
Identify viable exploit paths, gather impact evidence, and test post-exploitation scenarios where agreed in the rules of engagement.
Report Writing
Document all findings with risk ratings and clear recommendations to resolve each issue effectively.
Verification Test
After fixes are applied, we perform a free verification test to ensure the vulnerabilities are properly addressed.
Full Coverage Scope
Our testing covers subdomain discovery, session testing, business logic validation, code review, injection paths, and more.
Deliverables
What You Receive
Every engagement closes with a documented, defensible evidence set that serves engineering, leadership, and audit at the same time.
Technical Findings Report
Every finding with reproduction steps, evidence, affected components, risk rating, and specific remediation guidance.
PDF reportExecutive Summary
Risk posture, business impact, and thematic root causes written for leadership and board reporting.
PDF / slidesRemediation Tracker
A structured issue list with severity, owner, and status columns that maps directly into your ticketing system.
XLSX / CSVRetest Certificate
Formal confirmation of which findings were verified as remediated, suitable for customers and auditors.
PDF attestationAttack Path Narrative
Chained walkthroughs showing how individual weaknesses combine into a realistic compromise scenario.
Report sectionDebrief Session
A live walkthrough with your engineering and security teams covering findings, priorities, and fix strategy.
Live sessionReporting Process
Risk Rating Model
Findings are rated on demonstrated exploitability and business impact, not scanner severity. Critical findings are escalated during testing rather than held for the report.
CriticalConfirmed exploitation with direct impact on data, safety, or availability. Reported within 24 hours of validation.
HighExploitable weakness with meaningful business impact or a reliable path to privilege escalation.
MediumRequires specific conditions or chaining, but materially weakens the security posture.
LowLimited impact in isolation. Tracked for hardening and defence-in-depth improvement.
InformationalObservations, hygiene items, and architectural recommendations with no direct exploitability.
Client Benefits
Outcomes You Can Measure
Application security work should reduce real risk and survive audit scrutiny. These are the results our clients report.
Manually Validated Findings
No unverified scanner output reaches your backlog. Every finding ships with reproduction steps and evidence.
Critical Escalation
Critical exploitable issues are reported the moment they are confirmed, not held until the report.
Vendor Bias
We do not resell WAFs, scanners, or platforms. Remediation advice is chosen on merit alone.
Technology Coverage
Technologies We Test
Coverage spans modern frameworks, API styles, identity protocols, and the infrastructure that serves them.
Frameworks & Runtimes
- React
- Angular
- Vue
- Next.js
- Node.js
- Django
- Flask
- Spring Boot
- .NET
- Laravel
- Rails
- PHP
APIs & Protocols
- REST
- GraphQL
- gRPC
- SOAP
- WebSocket
- Webhooks
- OpenAPI
- JSON-RPC
Identity & Access
- OAuth 2.0
- OIDC
- SAML 2.0
- JWT
- SCIM
- MFA/TOTP
- Session cookies
- RBAC/ABAC
Data Layers
- PostgreSQL
- MySQL
- MongoDB
- Redis
- Elasticsearch
- S3 buckets
- GraphQL resolvers
Delivery & Edge
- NGINX
- Apache
- Kubernetes Ingress
- CloudFront
- Cloudflare
- API gateways
- WAF rulesets
Pipelines & Supply Chain
- CI/CD workflows
- Dependency manifests
- Container images
- SBOM review
- Secrets scanning
Standards Alignment
Compliance Mapping
Findings are mapped to the frameworks your auditors, customers, and regulators already use, so one assessment feeds multiple obligations.
OWASP Top 10 & ASVS
Every finding carries an OWASP Top 10 category and, where requested, an ASVS verification level so gaps map directly to a recognised maturity target.
OWASP API Security Top 10
API-specific issues are classified against the API Top 10, including broken object level authorisation and unrestricted resource consumption.
ISO/IEC 27001:2022
Evidence supports Annex A controls covering secure development, access control, logging, and technical vulnerability management.
NIST Cybersecurity Framework 2.0
Results feed the Identify and Protect functions and provide measurable input to Detect and Respond improvement plans.
NIST SP 800-53 Rev. 5
Testing evidences the CA-8 penetration testing, RA-5 vulnerability monitoring, and SI-10 input validation control families.
MITRE ATT&CK
Attack paths are annotated with ATT&CK techniques so your detection team can validate coverage against the same scenarios.
| Standard | Where it applies | How this engagement supports it |
|---|---|---|
| OWASP Top 10 | Application security baseline | Direct category mapping on every finding, with ASVS levels on request. |
| OWASP API Top 10 | REST, GraphQL, and gRPC services | Dedicated API test pass covering authorisation, rate limiting, and schema abuse. |
| ISO/IEC 27001 | ISMS certification and surveillance audits | Annex A.8 technical evidence, retest attestation, and remediation tracking. |
| NIST CSF 2.0 | Enterprise risk reporting | Findings grouped by function so posture can be reported at board level. |
| NIST SP 800-53 | Federal and regulated environments | Assessment evidence for CA-8, RA-5, SI-10, and AC control families. |
| MITRE ATT&CK | Detection engineering | Technique-tagged attack narratives for purple team and rule validation. |
Industry Expertise
Industries Served
We work with regulated and safety-critical manufacturers where a security failure carries operational, contractual, and certification consequences.
Automotive OEMs & Tier-1ECUs, telematics, and connected vehicle platforms
Industrial AutomationPLCs, SCADA, and plant-floor networks
IoT ManufacturersConnected products, gateways, and companion apps
Medical DevicesConnected diagnostics, monitoring, and hospital systems
Cloud & SaaSMulti-tenant platforms and customer-facing services
Enterprise Security TeamsInternal validation, assurance, and audit support
Engagement Workflow
How We Work With You
A predictable delivery model with defined checkpoints, so your teams know exactly what happens and when.
Scoping & Rules of Engagement
We agree targets, depth, timing windows, safety constraints, and escalation contacts before any testing begins.
Threat Modelling
Trust boundaries, attacker goals, and abuse cases are mapped so testing effort follows real business risk.
Execution & Validation
Manual, tool-assisted, and AI-accelerated testing with every finding reproduced and evidenced.
Reporting & Risk Rating
Technical detail for engineers, prioritised risk narrative for leadership, delivered in one report set.
Remediation Support
Direct access to the testing engineers while your teams design and implement fixes.
Verification Retest
A free retest of remediated findings confirms the fix holds and closes the engagement.
Questions
Frequently Asked Questions
Practical answers to what procurement, engineering, and security teams ask before an engagement starts.
What do you need from us to start?
A scope definition, target URLs or environments, test credentials for each user role, and a signed authorisation. Where an application uses MFA, we ask for either bypass credentials or seeded tokens so testing is not blocked.
Do you test APIs separately from the web interface?
The API layer is always tested directly, not only through the interface. Front-end controls are frequently absent at the API boundary, and that gap is where most authorisation failures live.
Do you test production systems?
Yes, where the environment and rules of engagement allow it. We agree timing windows, rate limits, and safety constraints up front, and we maintain a live escalation channel for the duration of the engagement. Where production testing is unacceptable, we test staging and validate configuration parity separately.
How long does a typical engagement take?
Most assessments run between one and three weeks of active testing, depending on scope size and depth. Scoping takes two to three working days, and the report is delivered within five working days of testing completion.
Is the retest really included?
Yes. One verification retest of remediated findings is included in the engagement fee, provided it is requested within 90 days of report delivery.
Who performs the testing?
Senior security engineers only. We do not staff engagements with junior analysts running scanner output, and the engineer who tested your environment is the engineer you speak to during remediation.
Ready to test your web application?
Send us the scope and we will come back with a testing plan, timeline, and fixed price. No sales cycle, no product pitch.