Overview
What is web application penetration testing?
Web application penetration testing is an authorised, simulated attack on a web application. It finds security weaknesses and safely tries to exploit them, to show what an attacker could actually reach. Ants Creation (Pvt) Ltd’s own security team carries it out under a written authorisation you sign and an NDA.
It goes further than an automated scan: our testers check how users sign in, what each user is allowed to see and do, how the application handles what people type in, and whether its workflows can be misused.
You receive a report that rates each finding by severity, with the evidence and the steps to fix it. After the fixes, one re-test is included.
What is included
What does a web application penetration test cover?
How it works
How does a web application penetration test work?
01
Scope and authorise
The systems in scope and the testing window are set out in a written authorisation you sign, alongside an NDA.
02
Map
We map the target and how it is used, so testing covers what matters.
03
Test
We look for weaknesses and confirm, safely, which ones are real.
04
Report
Each finding is rated by severity, with the evidence and the steps to fix it.
05
Re-test
After you fix the issues, one re-test of the fixed issues is included.
Why Ants Creation
Why test your web applications with Ants Creation?
Since 2011, Ants Creation has completed 700+ projects for 400+ clients in Sri Lanka and abroad.
Common questions
Web application penetration testing: frequently asked questions
How is a penetration test different from a vulnerability scan?
A vulnerability scan is automated and lists possible weaknesses, including false alarms. A penetration test is carried out by people: Ants Creation’s security team confirms which weaknesses can actually be exploited and what an attacker could reach through them, and tests what scanners cannot judge, such as access control and business logic. See vulnerability assessment for the scan-led check.
Do you test the live site?
Only within the scope and testing window set out in the authorisation you sign before testing starts. Live applications can be tested, and riskier checks can run against a staging copy instead of the live site. Ants Creation’s own security team agrees the approach with you when we scope the test, and an NDA protects your information throughout.
How long does it take?
It depends on the size and complexity of the web application: the number of pages and functions, the user roles, and workflows such as orders, payments or approvals in scope. The timing and the testing window are agreed when Ants Creation scopes the test and set out in the authorisation you sign, so your team knows when testing will take place.
What happens after the report?
You, or Ants Creation’s developers, fix the issues using the evidence and the steps in the report, starting with the most severe. Our security team then re-tests the fixed issues once, included in the engagement, to confirm each one is closed. Because we also build web applications, our developers can make the fixes for you if you want them to.
How much does a web application penetration test cost?
It depends on the size and complexity of the application, the number of user roles and workflows in scope, and whether the APIs behind it are tested too. Ants Creation quotes each penetration test after scoping it with you, and quotes are free. Call or WhatsApp 077 282 0498, or email hello@ants.lk, with the application’s address and what it does.
Related services
Tell us what you need.
Tell us what you need, and we will recommend the right next step. No obligation, no sales script.