Web App Security · Stat
60%
of breaches involve exploiting a known, patchable vulnerability.
Source: Verizon DBIR 2024.
Book a Free Pentest Consult →
~/homeservicesweb-app-pentest
03.1 · Web & API Penetration Testing

Your web app,
under siege.
Ethically.

Black-box and gray-box penetration testing for web applications and APIs. We hunt the OWASP Top 10, business-logic flaws, and the silent ones that scanners miss. We hand you a remediation playbook and free retests.

OWASP
Top 10 + Beyond
Models
Black · Gray · White
Retest
Included
~/engagements/web-app-pentest● LIVE
$semicolonsec scan --target https://app.client.com --mode gray-box
01 / Engagement Models

Two paths in.
One mission.

Choose the threat lens that matches your risk profile, or run both sequentially, many of our clients do. Full white-box (source-assisted) engagements are also available on request and pair well with our Secure Code Review.

BLACK BOX

Outside-In

// Zero knowledge. Pure attacker simulation.

We start with nothing but your domain: no credentials, no source code, no documentation. We mirror exactly what an external attacker sees and how they would chain weaknesses to break in.

  • Recon & attack-surface mapping
  • Unauthenticated exploitation paths
  • Public exposure & misconfig hunt
  • Most realistic threat model
GRAY BOX

Inside-Out

// Partial access. Maximum coverage.

We get user accounts (and optionally low-privilege internal access). We dig into authenticated flows, privilege escalation, business logic abuse, and IDOR chains that black-box testing cannot reach in time.

  • Authenticated role-based testing
  • Horizontal & vertical priv-esc
  • Business logic & workflow abuse
  • Business logic & workflow abuse
  • Best coverage per hour spent
02 / The Top 10 We Hunt

OWASP Top 10
categorized, weaponized, neutralized.

Click any category to see what we actually probe, not just what the spec says.

A01
Broken Access Control
A02
Cryptographic Failures
A03
Injection
A04
Insecure Design
A05
Security Misconfiguration
A06
Vulnerable Components
A07
Identification & Authentication Failures
A08
Software & Data Integrity
A09
Logging & Monitoring
A10
Server-Side Request Forgery
A01 / OWASP 2021

Broken Access Control

IDOR chains, horizontal/vertical privilege escalation, forced browsing, JWT claim tampering, missing object-level auth.

Observed in our engagementsCRITICAL · 95%
Potential Impact
  • Full data breach across every user account
  • Unauthorized admin takeover of the platform
  • Cross-tenant data exposure in multi-tenant apps
  • Regulatory fines under GDPR, HIPAA, or PCI-DSS
03 / Methodology

Three layers. No blind spots.

Scanners catch the low-hanging fruit. AI extends reach. Humans find what matters.

AUTOMATED

Scanners as a baseline

Automated tools sweep every endpoint for known vulnerabilities before we touch them manually. This maps the attack surface fast so our team can focus on what actually matters.

  • Known vulnerabilities caught before we start
  • Full endpoint coverage, nothing skipped
  • Lays the groundwork for deeper human testing
AI-ASSISTED

Faster triage, smarter payloads

We use LLMs to mutate fuzz payloads, deduplicate scanner output, and accelerate report drafting under engineer supervision. AI augments our pentesters; it never replaces them.

  • Scanner output deduplicated and ranked
  • Payload mutation tuned to your stack
  • Human effort focused on confirmed real risks
MANUAL

Senior pentesters in the loop

Experienced engineers verify every finding by hand and chain vulnerabilities into real attack scenarios. This layer turns raw issues into clear, proven business-risk evidence.

  • Every finding validated before you see it
  • Business impact explained in plain language
  • Exploits proven end-to-end, not theoretical
04 / Compliance Alignment

Reports that drop into your audit evidence pack.

OWASP
Top 10 · ASVS
ISO 27001
Annex A.12 · A.14
GDPR
Art. 32 · Security
PCI DSS v4.0
Req. 6.4.1 · 11.4
HIPAA
164.308(a)(8)
NIST
SP 800-115
SOC 2
CC7.1 · CC8.1
05 / Engagement Process

From scope to attestation.

Click a phase to see what happens and what you'll see in your terminal.

01

Scope & Kickoff

Day 0
A 30-minute scoping call locks the target list, testing window, rules of engagement, and emergency contacts.
02

Reconnaissance

Day 1–2
We map every endpoint, subdomain, framework, third-party dep, and admin interface, including the ones you forgot existed.
03

Exploitation

Day 3–N
Manual exploitation with AI-assisted payload mutation. We chain primitives into realistic attack paths and validate every finding by hand.
04

Reporting

Day N+1
A technical report with reproducible PoCs, screen captures, severity, business impact, and a step-by-step remediation playbook.
05

Retest

After fix
Once your team ships fixes, we verify each finding is actually closed and issue an attestation letter you can share externally.
~/phase/01-scope-and-kickoff● Day 0
>> defining target surface · approvals · ROE
>> NDA signed · MSA in place
>> testing window: 09:00–18:00 GMT+3
$
06 / Deliverables

What lands on your desk.

A pentest is only as valuable as the artifact you ship to your team.

technical-report.pdf
v1.0 · 47 pages · CVSS v3.1
CONFIDENTIAL
Severity Distribution
Critical
3
High
7
Medium
9
Low
4
  • Executive summary (non-technical, 1-page)
  • Per-finding: CVSS, CWE, evidence, PoC, business impact
  • Step-by-step remediation guidance
  • Strategic recommendations & maturity scoring

Free Retest, Included

One full retest within 60 days of report delivery, included. A second pass is available if first-pass remediation is partial.

Attestation Letter

A signed letter you can hand to auditors, customers, or your board. Proof you tested and remediated.

Direct Engineer Access

Your devs get Slack/Teams access to the pentest team during remediation. No black-box ticketing.

Free · 45 min · No pressure

Start with a free consultation.

A 45-minute call with a Semicolon cybersecurity expert. We’ll learn about your company, your services, and your cybersecurity needs, then explain exactly what an engagement with Semicolon would look like. No deck, no sales rep, no commitment.

  • Talk to the actual expert
  • Walk through your architecture & risks
  • Get a tailored scoping proposal
SC
Semicolon Security
Online now
Replies in < 24h
Type your question...
Let's talk →