Nederlands
Get a web application pentest
Have your web application tested by ethical hackers with in-depth experience in both software development and security. Preparing for an ISO 27001 audit or NIS2 reporting? Does an enterprise client require demonstrable security? Rolling out a new application into production? In each of these situations a pentest gives you demonstrable insight into your security posture.
At DongIT we combine the best of two worlds: secure software development and ethical hacking. Our specialists understand both development practices and attack techniques. This leads to findings that are technically correct and directly actionable for your development team.
Our pentests are performed by OSCP, OSWE and OWASP-certified ethical hackers per OWASP ASVS and NCSC guidelines. Reporting via our self-developed Security Reporter platform. CCV Keurmerk-accredited. Data stays in Europe.
What scanners miss, we find
Automated scanners find known vulnerabilities. Our pentesters find what scanners cannot see: patterns behind vulnerabilities, business logic flaws and context-specific risks that only emerge when experienced people piece the puzzle together. Specifically we assess:
- Whether framework security features are consistently applied, or whether protection is missing in some places.
- The presence of unit tests, CI/CD controls and automated security checks in your development pipeline.
- Business logic flaws that scanners systematically miss, such as race conditions, state manipulation and bypassing of payment or workflow controls.
- Complex scenarios such as multi-tenant separation and cross-tenant leakage, critical for SaaS platforms.
- Authentication and authorization flows, including SSO implementations (SAML, OIDC, OAuth 2.0) and session management.
Our reporting includes clear priorities, reproducible test results and concrete remediation guidance. Every pentest is delivered under our four-eyes principle: minimum of two testers involved, with peer review on every finding.
Our approach: how we test your web application
A pentest that adds value starts with a thorough intake and ends with findings your development team can actually resolve. We follow a structured six-step approach.
Intake and scoping
We discuss your application, architecture and business context, identify critical functionality and map out threats. Based on your goals, technologies and risk profile we jointly determine the scope.
Pentest execution
We combine manual and automated testing methods and simulate realistic attack scenarios. We test authentication, authorization, input validation, session management and API security per OWASP ASVS and NCSC guidelines.
Analysis and risk assessment
Vulnerabilities are analyzed and prioritized based on impact and exploitability, with CVSS scoring for objective risk assessment. Mitigation recommendations align with your tech stack.
Reporting and advice
Delivery via Security Reporter with executive summary, technical details and concrete remediation guidance. Findings mapped to OWASP Top 10 and your compliance framework.
Retest and validation
After vulnerabilities are resolved, we validate that the remediation actually works and risks have been effectively mitigated. Time and materials, based on the number and complexity of findings.
Follow-up and guidance
In addition to test results, we advise on secure development and preventive measures. We help your team implement security best practices and structurally increase resilience.
Experience with all modern tech stacks
We test web applications built on virtually any framework. Our pentesters know framework-specific patterns, common misconfigurations and the quirks of each technology. This means we are effective immediately, without needing to learn your stack first.
For niche tech stacks (Elixir, Rust, specific ERP implementations) we assess per engagement whether we have the right expertise in-house. Transparent, even when another party is a better fit.
- Backend. Node.js, .NET, Java (Spring), Python, PHP, Ruby, Go
- Frontend. React, Vue, Angular, Svelte, all major SPA frameworks
- Authentication. SAML, OIDC, OAuth 2.0, JWT, Entra ID
- API. REST, GraphQL, gRPC, WebSocket
- Cloud. Azure, AWS, GCP, Kubernetes, Docker
Common web application vulnerabilities
Our pentests focus on vulnerabilities that attackers actually use. In addition to the well-known OWASP Top 10 2021, we watch for business logic flaws and context-specific risks that scanners struggle to detect.
- SQL injection (SQLi). Manipulation of database queries to access sensitive data or take over accounts.
- Cross-Site Scripting (XSS). Injection of malicious scripts to hijack sessions or steal user data.
- CSRF. Attacks in which a logged-in user unknowingly performs actions on behalf of the attacker.
- Broken Authentication. Insecure login processes, weak session management or missing MFA that enables account takeover.
- Insecure Direct Object References (IDOR). Endpoints without authorization checks, allowing users to view or modify others' data.
- Server-Side Request Forgery (SSRF). Applications that force servers to make requests to internal or external systems they should not be able to reach.
- API Security Risks. Unprotected APIs, missing rate limiting or exposure of sensitive endpoints.
- Misconfigurations. Incorrect server or application settings, from open debug endpoints to leaky CORS configurations.
- Business logic flaws. Faulty workflows that scanners systematically miss, such as race conditions and state manipulation.
- Multi-tenant leakage. Situations where tenant or customer A can access data of tenant B without authorization. Critical for SaaS platforms.
Compliance mapping for your web application
Our reports are always aligned with the compliance framework relevant to you. Findings are explicitly linked to the relevant controls for your auditor or supervisory authority.
ISO 27001
Testing of technical controls from Annex A.8.8, A.8.29 and A.5.35. Findings directly usable for your ISMS and external audit.
NIS2 and Dutch Cybersecurity Act
Demonstrable assessment of security measures per article 21 Dutch Cybersecurity Act, for essential and important entities.
DigiD
Pentest for DigiD connections per DigiD normenkader v4.0 from Logius and NOREA. Annual obligation for DigiD-connected organizations.
GDPR
Security assessment focused on the processing of personal data in your application and GDPR reporting to the Dutch Data Protection Authority.
NEN 7510
For healthcare organizations and healthcare IT vendors. Pentest for applications that process personal health information.
DORA
For financial entities. Pentest per DORA articles 24-27 and preparation for Threat-Led Penetration Testing.
We also deliver reporting suitable for cyber insurance and supply chain requirements from enterprise clients. Our reporting meets the requirements of common cyber insurers and enterprise procurement processes.
What does a web application pentest cost?
The price depends on the scope and complexity of your application. For clearly defined web applications we offer standard packages. For more complex engagements such as multi-tenant SaaS platforms, microservices architectures or multiple applications in parallel we work with a scoping conversation and a tailored quotation.
- Quick Pentest, €2,960 excl. VAT
- Expert Pentest, from €5,040 excl. VAT (most chosen)
- Extensive Pentest, from €7,200 excl. VAT
- Enterprise engagements, tailored quotation
Tailored pricing
For every complex engagement we first propose a complimentary scoping conversation. This ensures you know exactly what the investment will be.
Frequently asked questions about web application pentesting
Below are the most frequently asked questions about web application pentesting. For a complete overview please visit our FAQ page.
What is a web application pentest?
A web application pentest is an assessment in which ethical hackers test your web application for vulnerabilities. They simulate realistic attack scenarios such as SQL injection, cross-site scripting, authentication bypasses and business logic flaws. The goal is to identify weaknesses before attackers do.
How long does a web app pentest take?
Active testing time ranges from 16 hours for a small, clearly scoped web application to 80 hours or more for large multi-tenant platforms with complex IAM. Total duration from scoping conversation to final report is typically 4 to 8 weeks.
Can you test our APIs as well?
Yes, API testing is typically part of a web application pentest. We test REST, GraphQL and gRPC APIs for authentication, rate limiting, IDOR, business logic and OWASP API Security Top 10 risks. For purely API-focused engagements we also offer standalone API pentests.
What do you test in multi-tenant and SaaS environments?
Multi-tenant separation is one of the biggest risks in SaaS. We test whether tenant or customer A can access data of B without authorization, whether the role model works across tenants, and whether admin functions are actually separated. We also verify whether new tenants are securely provisioned by default or whether configuration gaps arise.
What is the difference from a vulnerability scan?
A vulnerability scan is an automated check for known vulnerabilities. A web application pentest adds manual creativity. Our pentesters chain vulnerabilities together, test business logic and discover issues scanners struggle to find, such as IDOR patterns, race conditions and cross-tenant leakage.
Do you work black box, gray box or white box?
All three, depending on your objective. For complex web applications we typically recommend gray box or white box. With insight into architecture and source code we find substantially more high-impact vulnerabilities per hour. For external perimeter simulations we usually work black box.
Do you test on our production environment?
Preferably on acceptance or test environments. Where production testing is necessary, we make strict safety agreements about timing, impact limits and escalation paths. Our pentesters know how to work without disruption.
What do I provide as input for a web app pentest?
Depending on scope: architecture documentation, test accounts for different user roles, API documentation, source code (for white box) and access to an acceptance or test environment. During the scoping conversation we provide a concrete input checklist for your situation.
Is a retest included?
Retest of resolved vulnerabilities is performed on time and materials, depending on the number and complexity of findings. This is discussed during intake and explained in the quotation.
Ready to have your web application tested?
Preparing for an audit? Does a client require demonstrable security? Or is a new application going live? Response within one business day. Quotation within three business days.