Web application pen testing
Web application pen testing
The security of the data in your web application is extremely important to you. How secure are you right now?
If you want to know exactly, NFIR can test the security of your Web application using the OWASP WSTG standard pen test with our custom services.
Scope examples
The following environments can be included in a web application pen test: all types of web applications, as well as APIs.
What attack scenarios are possible for web application pen testing?
The most common attack scenario for web application pen testing is a pen test that mimics both Black and Grey Box attack perspectives. However, NFIR’s preference is for a White Box attack perspective. Because more complete information is available to the pentester from this attack perspective, the pentester can work more efficiently. During an intake, your needs are identified in order to choose an appropriate scenario.
Black Box of the web application
With minimal information a picture will be formed of vulnerabilities in the web application. By means of open source research (OSINT) as much information as possible will be collected to discover vulnerabilities.
Grey Box of the web application
This scenario simulates what a malicious hacker might do when gaining access to an account on the web application. Different accounts with different roles within the web application will be examined. Which vulnerabilities are present and is it possible to increase the privileges to administrator rights?
White box of the web application
In this attack perspective, the pen tester not only has limited information about the operation of the web application and logins, but also the source code of the web application. This allows for more efficient pen testing, as well as checking for vulnerabilities in the software dependencies used.
Standards
NFIR uses the Web Security Testing Guide (WSTG) for pen testing web applications. This standard gives you the guarantee that the pen test is carried out completely and according to the correct standards. In addition, the most recent versions of the OWASP Top 10 are used for both web applications and APIs. We find it important to be as transparent as possible about the execution of the pen test. For this reason, we offer a checklist for various pen testing standards which is added to the report. This allows you to see which checks have been carried out, which could not be carried out and which, if any, were not applicable.
Certified pentesters
The team consists of certified and experienced Technical Leads and pentesters. Specializing in various environments.
Professional approach
Committed Technical Leads and Project Coordinators ensure high-quality pen testing according to the CCV quality mark.
Extensive experience
Have a pen test performed by a team that performs hundreds of pen tests annually with an average customer satisfaction rating of 8.4
Clear and transparent
The pen test report is clear, complete and actionable. We always provide an explanation and are also available to you after the project.
Sample report web application pen testing
A sample report (NL/EN) of a grey box web application pen test is available.
In this report, a pen test was performed on a fictitious environment, whereby vulnerabilities were made transparent.
Pen tests
Which systems can you have tested by NFIR's experts?
Which systems can you have tested by NFIR’s experts? Our ethical hackers check the technical resilience of (web) applications, websites, IT and OT infrastructures, API links and mobile apps. If you have a different environment that you would like to have controlled, we will be happy to discuss it with you.
NFIR uses reliable pentesting services, certified with the CCV Pentesting Seal of Approval. We are your Cybersecurity partner if you are looking for a down-to-earth Dutch Cybersecurity company that has years of experience in pentesting. Our certified ethical hackers identify vulnerabilities and provide concrete and actionable insights about the effectiveness of your security measures. Contact us today to put your cybersecurity under the microscope as well.
High quality pen testing
Certified and quality-oriented pentesters
Pentests are essential to test the technical resilience and effective operation of security. Our pentesters focus on identifying vulnerabilities in systems by deploying various attack techniques. Our skilled and professional pen testers have extensive experience, creativity and up-to-date professional knowledge. The pentesters have completed various relevant training courses and hold the following certifications, among others, OSCP, OSWP, OSWE, OSEP, CPTS, CBBH, and eWPT.
Pentesting and the CCV seal of approval:
- This quality mark, based on NEN-EN-ISO/IEC standards 17021 and 17065, gives customers the guarantee that the execution of a pen testing assignment by NFIR is carried out in a professional and high-quality manner.
- NFIR possesses since 07-01-2022 the CCV quality mark for Pentesting.
I want to pentest my environment(s)!
Once you fill out this form, we will contact you immediately to inform you of the possibilities. We schedule a no-obligation intake with a Technical Lead to coordinate scope components and attack scenarios.
Do you have any questions in the interim? If so, please contact us by phone at the general NFIR phone number: 088 313 0205
