Authentication and sessions
Login, password reset, MFA, session handling and the assumptions between them.
Services
Web application penetration testing
Manual testing of the logic, roles and data flows behind your application, where automated scanners stop being useful.
Scope
What gets tested.
01
02
Access control
Whether each role and tenant can reach only what it should.
03
Business logic
Workflows, limits and state changes used in ways the design never intended.
04
Injection
SQL, template and command injection across every input that reaches the server.
05
Client-side attacks
Cross-site scripting, request forgery and unsafe browser behavior.
06
File handling
Uploads, downloads, parsers and the storage behind them.
07
Server-side requests
Features that make the server fetch something on a user’s behalf.
08
Framework and platform
Configuration and known weaknesses in the frameworks and CMS you run.
Good fit
- Before a launch or major release
- After a significant architecture change
- When a customer asks for an independent test
- Before security due diligence
Included
What you receive.
- 01
Executive summary
Overall risk and priorities in plain language, for people who will not read the technical detail.
- 02
Technical findings
Severity, affected component, business impact, evidence, steps to reproduce and a specific fix for each issue.
- 03
Early notice
Critical issues are shared as soon as they are confirmed, without waiting for the final report.
- 04
One round of retesting
After your fixes, each finding is tested again and its status is updated in the report.
- 05
Attestation letter
A short letter stating what was tested and when, which you can share with customers or auditors.
Process
How the engagement runs.
- 1ScopeYou describe what to test. Targets, roles and timing are agreed, and you receive a written quote.
- 2AuthorizeThe system’s owner signs written authorization and rules of engagement. Testing does not begin without them.
- 3TestHands-on testing inside the agreed window. A critical issue is reported as soon as it is confirmed.
- 4ReportEvery finding comes with severity, business impact, evidence and a specific fix.
- 5RetestOnce you have fixed the issues, they are tested again and the report is updated with the results.
Questions
Common questions.
Do you need test accounts?
Yes, ideally one for each role being tested, and two per role for multi-tenant applications so that isolation between tenants can be checked.
Can a single-page application be tested the same way?
Yes. Testing covers the browser application and the backend it talks to, so its API calls are in scope unless you agree otherwise.
Find it before someone else does.
Tell ZeroDay Labs what you need tested. You will get a clear scope and a written quote before any work begins.
Request a pentest