Skip to content
Penetration testing
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
All services on one page
Industries How we work About Blog
1300 AURIAN Contact
Menu
Penetration testing
  • Penetration testing services
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Security assurance and compliance services
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Managed security services
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
  • All services
  • Industries
  • How we work
  • About
  • Blog
Call 1300 AURIAN Contact
  1. Services
  2. Penetration testing
  3. Web application penetration testing

Penetration testing

Web application penetration testing

We test your web application against the OWASP methodology, by hand, in the roles a real user and a real attacker would hold.

Scope a test Call 1300 AURIAN

Who this is for

  • You are about to launch or have just changed a customer portal

    A new application, a major release or a new integration warrants testing before it carries real users and real data.

  • A customer or insurer wants evidence the application is tested

    Enterprise procurement and cyber insurance increasingly ask for an independent application test within the last year.

  • The application handles money, personal data or documents

    Anything worth stealing makes the application a target, and business-logic flaws in these systems are exactly what automated tools miss.

What our web application penetration test covers

Internet Web application API Perimeter Cloud tenancy Email Office network Workstation Identity Wireless Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: CHECKS INCLUDE Authentication, session management and MFA Access control: IDOR and privilege escalation Injection, file handling and SSRF Business logic, workflows and client-side controls API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. CROWN JEWELS: CHECKS INCLUDE Customer data reachable through the application Bulk retrieval and export of other users' records SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service. Internet Web application Perimeter API Email Cloud tenancy Office network Workstation Wireless Identity Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: CHECKS INCLUDE Authentication, session management and MFA Access control: IDOR and privilege escalation Injection, file handling and SSRF Business logic, workflows and client-side controls PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. CROWN JEWELS: CHECKS INCLUDE Customer data reachable through the application Bulk retrieval and export of other users' records SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service.

We test the application against the OWASP Web Security Testing Guide, unauthenticated and then in each user role, with a focus on the flaws that automated scanners cannot reason about.

  • Authentication, including password policy, multi-factor authentication and account recovery
  • Session management, token handling and logout
  • Access control, covering insecure direct object references and horizontal and vertical privilege escalation
  • Injection, including SQL, command, template and cross-site scripting
  • Business logic, such as price manipulation, workflow bypass and abuse of trust between steps
  • File upload and handling, including type and content validation
  • Server-side request forgery and other server-side flaws
  • Client-side security, including content security policy and third-party scripts
  • Third-party integrations, single sign-on and the trust between them

How we test it

A web application penetration test at Aurian is manual work by a senior consultant, structured by the OWASP Web Security Testing Guide and measured against the Application Security Verification Standard. Scanners are run for coverage, to sweep for the mechanical issues across a large application, but they cannot reason about what your application is for, and the findings that hurt most, the access-control and business-logic flaws, are exactly the ones a scanner cannot see.

We map the whole application first, every function and every role, so we understand the intended behaviour before we try to subvert it. Then we test in each role you provide. Access-control testing in particular depends on comparison: we can only show that a standard user reaches an administrator’s function, or another customer’s records, by holding both roles and trying. This is why test accounts matter and why the authenticated phase finds far more than an anonymous scan.

Each finding is written to be reproduced. You get the request, the response, the steps and the exact condition that makes it work, so a developer can confirm the issue and know when it is fixed. We report critical findings as we confirm them rather than holding them for the end, and once your team has remediated we retest the findings rated high or above and update the report.

Standards OWASP WSTG, OWASP ASVS, OWASP Top 10

  1. 01 Mapping

    We walk the whole application, map every function and role, and understand what it is meant to do before we try to make it do otherwise.

  2. 02 Authenticated testing

    We test in each user role you provide, because access-control flaws only appear when you can compare what one role can do against what it should.

  3. 03 Manual exploitation

    A consultant tests each category from the OWASP guide by hand, confirms real issues and chains them, using scanners only to widen coverage.

  4. 04 Reporting and retest

    You receive findings ranked by severity with clear reproduction steps. Once you have remediated, a retest of the findings rated high or above confirms what is closed and the report is updated. Retesting is quoted with the test or booked afterwards.

What you receive

Every finding in an Aurian report looks like this: what we found, the evidence, what it means for you, and what to change.

High AUR-2026-014 Sample finding, fictional environment

Insecure direct object reference exposes other customers' invoices

Affected asset
GET /api/v2/invoices/{id} on app.example.com.au
Rating
High Likely 4 × High 4 = 16

Description

The invoice endpoint returns any invoice by its identifier without checking that it belongs to the authenticated user. Because identifiers are sequential, an attacker with one account can retrieve every invoice in the system by incrementing the number.

Evidence

GET /api/v2/invoices/1042 HTTP/1.1
Host: app.example.com.au
Authorization: Bearer eyJhbGciOi...   # a standard customer's token

HTTP/1.1 200 OK
{ "id":1042, "customer":"Northwind Pty Ltd",
  "abn":"51 xxx xxx xxx", "total":"12,480.00" }
# 1042 belongs to a different customer than the token holder

A standard customer's token retrieved an invoice belonging to another customer, including their ABN and billing detail.

Impact

Every customer's billing records, including business names, ABNs and amounts, can be read by any authenticated user. A single script would retrieve the entire invoice history of the platform. Exposure on this scale is what the Notifiable Data Breaches scheme exists for, and it is invisible to a scanner because the request itself is well-formed.

Remediation

Enforce an ownership check on every object lookup: the invoice must belong to the authenticated user, or to an account they are authorised to view. Apply the check server-side on every endpoint, not only in the user interface, and consider identifiers that are not guessable as defence in depth.

References

  • OWASP WSTG, testing for insecure direct object references
  • OWASP API Security Top 10, broken object level authorisation
  • Executive summary written for the board and the insurer, in plain language
  • Technical findings ranked by severity, each with evidence and reproduction steps
  • Remediation guidance your developers can act on without calling us
  • A debrief call with your development team to walk through the findings

Common findings

What this kind of engagement typically surfaces, so you can recognise your own environment.

  • Broken access control

    Insecure direct object references and missing role checks that let one user reach another's data or an administrator's functions.

  • Authentication and session weaknesses

    Multi-factor authentication that can be skipped, tokens that do not expire, and account-recovery flows that can be abused.

  • Injection

    SQL, command and template injection, and cross-site scripting where user input reaches a page or a query without proper handling.

  • Business-logic flaws

    Workflows that can be completed out of order, prices or quantities that can be altered, and limits that can be bypassed.

  • Server-side request forgery

    Features that fetch a URL on the server's behalf and can be pointed at internal systems or cloud metadata endpoints.

  • Exposed secrets and verbose errors

    API keys in client-side code and stack traces that hand an attacker the detail they need for the next step.

Frequently asked questions

Do you need credentials and test accounts?

Yes. Most real risk sits behind the login, so we ask for at least one account in each role: a standard user, any elevated roles, and an administrator where relevant. We tell you exactly what each account is used for, and we can test a staging copy to keep production untouched.

Can you test against staging instead of production?

Yes, and we often recommend it, provided staging matches production in configuration and data shape. If we test production, we agree what data we may create and clean up after ourselves.

How is this different from an API penetration test?

A web application test covers the application a person uses in a browser. An API test covers the interface other software calls directly, which has its own authorisation, rate-limiting and schema concerns. Applications with a significant API usually warrant both.

How long does it take?

It depends on the size of the application, the number of roles and the depth agreed: typically five to ten days of testing, with the report following. We confirm the timeframe after scoping.

Will the test break anything?

We test carefully and avoid destructive actions by default. Where a test could create or alter data, we agree the limits first, and against production we clean up what we create.

Related services

API penetration testing

API penetration testing for REST, GraphQL and SOAP against the OWASP API Security Top 10: authorisation, rate limiting and undocumented endpoints.

Continuous application scanning

Continuous web application scanning between manual tests: authenticated scans with human review, drift detection between releases and monthly summaries.

External network penetration testing

External penetration testing of your internet-facing perimeter: exposed services, VPN, mail and DNS, tested by hand by a senior consultant.

Penetration testing services

Scope a test with a senior consultant

Tell us what you need to know about your environment. We reply within one business day.

Scope a test Call 1300 AURIAN

Aurian Security is an Australian penetration testing and security assurance firm. Senior consultants perform every engagement, for clients across the country.

Penetration testing

  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation

Assurance and managed

  • Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
  • Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring

Company

  • About Aurian
  • How we work
  • Industries
  • Blog
  • Contact
  • Privacy policy
526/368 Sussex St, Sydney NSW 2000 1300 AURIAN (1300 287 426) sales@aurian.com.au

© 2026 Aurian Security Pty Ltd. ACN 639 930 528.

This site is static, loads no third-party trackers, and publishes a security.txt.