Web application penetration testing

Web application penetration testing, black-box or grey-box.

ShieldProbe Assess tests your browser-based applications: customer portals, dashboards and web apps. It works through authentication, sessions, access control and business workflows, under an agreed OWASP Top 10 or full WSTG scope. A named consultant approves each finding before you see it.

Scope your web app test Open the sample report

Targets: Customer portals, dashboards and browser-based applications.
Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP Top 10 or full WSTG scope

Black-box and grey-box answer different questions.

Black-box testing starts without supplied login credentials and shows what an outside attacker can reach. Grey-box testing uses your test accounts to examine authenticated workflows and the permission boundaries between users and roles.

External applications are tested from ManticoreAI infrastructure. Internal applications are reached through an approved connector or access path, and an internal application can still be tested black-box.

Bring to scoping

Application URLs, their owners and written authorization.
Test accounts for each role you want covered, if you choose grey-box.
Which environment to test, and the actions that are off limits in production.
Testing windows, stop conditions and escalation contacts.

What a web application test covers.

Test authentication, sessions, access controls and business workflows. Follow weaknesses through to their demonstrated impact.

Customer portals, dashboards and browser-based applications.

Methodology: Agreed OWASP Top 10 or full WSTG scope. Testing records what it could reach within the agreed scope, and what it could not. Some buyers call this a VAPT engagement: weaknesses are found, then tested to prove which ones can be exploited.

The boundaries of this test

Business logic is tested against the workflows and roles in scope, not against every path a user could take.
Defend and Fix address supported application findings. Not every finding can be protected or patched automatically.
A clean result covers the agreed scope, access and time window. It does not prove the absence of vulnerabilities.

What we test

Web, API, network and server pentesting.

Choose the systems to test, where they run and the access we start with. Each assessment has an agreed scope and consultant-reviewed evidence.

Web applications

Customer portals, dashboards and browser-based applications.

Test authentication, sessions, access controls and business workflows. Follow weaknesses through to their demonstrated impact.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP Top 10 or full WSTG scope

APIs

REST, GraphQL and SOAP APIs, including backend services and integrations.

Test endpoint authorization, data exposure, input handling and API workflows, using the agreed accounts and API specification.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP API Security Top 10 or full WSTG scope

Networks & server infrastructure

Internet-facing services, private networks, and on-premises or cloud-hosted servers.

Test exposed services, misconfigurations and exploitable weaknesses. Validate privilege escalation and lateral movement where the agreed scope permits.

Location: Internal or external
Access: Black-box only
Methodology: Agreed PTES scope

Internal or external?

External: test internet-facing systems from our infrastructure.

Internal: reach private applications, APIs, networks and servers through an approved connector or access path.

Black-box or grey-box?

Black-box: start without supplied login credentials and test the reachable, authorized surface.

Grey-box: use supplied test accounts and context to test authenticated web and API workflows.

Network and server infrastructure assessments currently use black-box testing.

Not sure where to start? We'll help you define targets, access and permitted activities before testing begins.

Scope your assessment

Evidence you can hand to engineering and your assessor.

Each finding carries its reproduction evidence, demonstrated impact and limitations, approved by a named consultant before release. With scope agreed and access ready, the report can arrive in 48 hours, and retests of fixed findings run for 12 months under your engagement terms.

Need the test as audit evidence? See SOC 2 and PCI DSS penetration testing.

Common questions

Tell us the application and the access you can give. We will agree the rest with you.

Can you test internal systems as well as public targets?

Yes. External testing reaches internet-facing applications, APIs and services from ManticoreAI infrastructure. Internal testing reaches private applications, APIs, networks and servers through an approved connector or access path. Location and access mode are separate: an internal target may still be tested without login credentials.

What is the difference between black-box and grey-box testing?

Black-box testing starts without supplied login credentials and tests what an attacker can discover and reach within the authorized scope. Grey-box testing uses supplied test accounts and context to examine authenticated web or API workflows and permission boundaries. Web and API assessments support both modes. Network and server infrastructure assessments currently support black-box only.

Start with the application your customers log in to.

We will scope the rest of the web application test with you.

Scope your web app test