Web application and API penetration testing
We identify weaknesses in authentication, access controls, and business workflows through technical testing within the authorized scope.
Useful before a launch or after significant application changes.
Ensoulve / Cybersecurity
Web application security and architecture reviews.
Find out where your application is exposed, which findings matter, and how to address them. We conduct penetration tests and architecture reviews, with technical evidence and practical recommendations for your team.
Defined scope. Authorized testing. Documented results.
Services
An assessment shaped around your system and decisions.
We work with you to choose the service and depth of review. The proposal sets out what we will assess, what you will receive, and when.
Security architecture review
We analyze trust boundaries, data flows, permissions, and integrations to identify risks in your system’s design.
Useful when making architecture decisions and understanding exposure.
Remediation and retesting support
We work with your team to address findings and verify fixes through agreed follow-up testing.
Turns assessment results into verifiable improvements.
Deliverables
Evidence for decisions. Technical detail for fixes.
An executive summary for decision-makers and reproducible findings for the people implementing the fixes.
- Assessment scope, methodology, and limitations.
- Findings with evidence and reproduction steps.
- Severity explained through impact and exploitability.
- Remediation recommendations and a technical review session.
Fictional scenario showing the report format. It does not refer to a client or an assessment that has been performed.
Executive summary
Access to another account’s invoices
An authenticated account can retrieve another account’s invoice because the server does not verify who owns the document.
- Example severity
- High
- Example scope
- Billing API · two test accounts
Method and evidence
While signed in as account A, a request is made for an invoice created by account B. In this scenario, the API returns the other account’s document.
GET /api/invoices/invoice-b
Session: account A
Expected: access denied
Observed: 200 OK + account B’s invoiceImpact and priority
Billing information is exposed across customers. This example is rated high because of the sensitivity of the documents and because exploitation only requires a valid account and another invoice’s identifier.
Evidence limits
The example covers two accounts and one endpoint. It does not establish exposure of other documents or systems.
Recommendation
Check on every request that the resource belongs to the authenticated account. Enforce the control on the server and add cross-account access tests.
Retesting criteria
Verify that account A can no longer access account B’s invoice and that B retains legitimate access. Verification takes place after the fix is implemented.
Each report is tailored to the agreed scope and the evidence collected during the assessment.
Technical approach
Security through a development lens.
We combine web development, security testing, and architecture experience to assess how your system behaves and what your team needs to strengthen it.
Testing with context
We review roles, permissions, business workflows, and integrations. Each finding is tied to how the application is actually used.
OWASP reference
We use the OWASP Web Security Testing Guide as a reference for structuring tests that fit the agreed scope.
View the OWASP WSTGActionable recommendations
We explain the technical cause, priority, and proposed changes so your team can plan remediation.
Process
From scope to verification.
Direct coordination with your team, defined objectives, and results you can review.
- 01
Context and scope
We agree on objectives, systems, access, testing windows, and authorization before work begins.
- 02
Technical assessment
We review the application and agreed controls, validate findings, and document the evidence.
- 03
Report and joint review
We deliver an executive summary and technical details, then discuss impact, priorities, and fixes with your team.
- 04
Remediation and verification
If you engage us for follow-up, we support remediation and verify fixes through agreed retesting.
Frequently asked questions
Before we begin.
What does penetration testing include?
Testing is defined around your application and its risks. It may cover authentication, authorization, sessions, APIs, and business logic. The proposal specifies the systems, user roles, and tests included.
How do you determine price and turnaround time?
We review the number of applications, user roles, integrations, and desired depth of assessment. We then prepare a proposal with scope, deliverables, schedule, and price.
How do you coordinate testing in production?
We agree on the environment, required access, testing windows, and an operational contact. Tests that could have an impact require specific authorization and agreed stop criteria.
How is technical information handled?
Before receiving access or sensitive information, we agree on confidentiality, exchange channels, and evidence handling. The initial form only asks for general context.
Are remediation and retesting included?
The proposal states whether follow-up is included or quoted separately. You can implement the recommendations with your team and engage us to verify the fixes later.
Can you work with our team remotely?
Yes. We coordinate the assessment and results review remotely, with points of contact and communication times agreed in advance.
Do you offer continuous monitoring or incident response?
This offer focuses on project-based penetration testing, architecture reviews, and remediation. Continuous monitoring and incident response are outside the scope of this assessment.
Talk about your project
Tell us about your assessment.
Let us know which application or architecture you would like reviewed. We will follow up to clarify the goals and prepare a proposed scope.
contact@ensoulve.comShare general context only. Access, credentials, and sensitive details are arranged later through an agreed channel.