Web application VAPT, tested by hand
Web application VAPT tests how your app handles logins, sessions, roles, tenants and business logic, the way a real user or a hostile customer would try to break it. From ₹79,000 plus GST, with a retest included.
In short
- Most serious web app findings are broken access control: one user reaching another's data.
- Scanners rarely find those; testing every role against every tenant by hand does.
- One application takes 4–6 testing days; a multi-tenant product with its API takes 8–12.
- You get a report with evidence for every finding, a readout and a retest of the fixes.
What we test
| Area | What we check |
|---|---|
| Authentication | Login, MFA, password reset, sign-up and invitations, SSO where in scope |
| Sessions | Rotation, timeouts, logout, token handling, cookies, CSRF |
| Access control | Every role against every function and object (IDOR / BOLA) |
| Tenant isolation | Every object across two seeded tenants |
| Business logic | Workflow order, limits, prices, credits, race conditions |
| Input handling | Injection, file uploads, SSRF, cross-site scripting |
| Configuration | Security headers, CORS, error handling, exposed debug features |
Why manual testing matters
Scanners are good at known patterns: an outdated library, a missing header. They cannot tell that a member of Tenant A just read Tenant B’s invoice, because the response looks normal. That class of bug, broken access control, sits at the top of the OWASP Top 10 and is behind many SaaS data exposures. Finding it means logging in as each role, in each tenant, and asking for things that belong to someone else.
What you receive
- A summary your customer’s reviewer can read in minutes.
- A coverage record of what was and was not tested.
- Each finding with severity, the request and response, affected roles and a specific fix.
- A readout call with your engineers (product test and programme).
- A retest of the fixes and an updated report.
Before the test
- List the roles and create a test account for each.
- For multi-tenant apps, seed two tenants with realistic data.
- Freeze the test environment for the testing window.
- Name a contact for urgent findings.
The pentest readiness checklist covers the rest.
Our prices
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare packagesFocused test
One website, app or API. Right for a launch or a first customer review.
Product test
A full SaaS product, where each customer must only see their own data.
Release programme
Two tests a year, for teams that ship often and answer security reviews all year.
Questions buyers ask
What is web application VAPT?
A vulnerability assessment and penetration test of a web application: automated checks for known weaknesses, then manual testing of authentication, sessions, access control, tenant isolation, business logic and input handling, with evidence for every finding.
How long does a web application VAPT take?
4 to 6 testing days for one application with up to two roles; 8 to 12 days for a multi-tenant product and its API with up to five roles. Scoping comes before and reporting after.
What do you need from us?
A signed scope and authorisation from the system owner, test accounts for every role (in two tenants if the app is multi-tenant), a stable test environment and a contact for urgent findings.
Do you test in production?
Usually in a staging environment that matches production. Where production testing is needed, the rules of engagement limit timing, data and techniques.
Is the OWASP Top 10 enough?
The OWASP Top 10 is an awareness list, not a test plan. We test against the OWASP Web Security Testing Guide and ASVS, which cover far more, and record what was and was not tested.
What does it cost?
From ₹79,000 plus GST for one application or API, and from ₹1,49,000 for a multi-tenant product and its API. See VAPT cost in India for what moves the price.
Get a fixed quote for your web app.
Tell us the application, the roles and the deadline. You get scoping questions, then a fixed quote.