Skip to content
HackIndex
Menu

Find out what an attacker can do behind the login.

A manual pentest of your web application and API. The focus is on permissions, roles and business logic, the flaws a scanner misses. Every finding comes with evidence and a fix for your developers.

Request a pentest What does it cost?
  • OSCP certified
  • Fixed price up front
  • Extra depth in Laravel and WordPress

When

Sound familiar?

  • A customer asks for a pentest report.

    You get a report with evidence and severity for each finding, ready to share with your customer.

  • Something big is about to go live.

    Test a new module, payment flow or API before real users can reach it.

  • The ISO 27001 or NEN 7510 audit is coming up.

    A recent pentest is often part of the evidence for the auditor.

  • Customers must never see each other's data.

    On a platform with several customers, that separation gets extra attention.

Scope

What gets tested

Pick a part of your application to see which questions the test answers.

Outside

Access

Application

Back end

What the test answers

The public side

What can someone see without an account?

  • Information that is public by accident
  • Error messages that reveal too much
  • Forms that can be abused

What the test answers

Login

Can someone get in without knowing the password?

  • Guessing passwords or using stolen ones
  • Two-factor authentication and password reset
  • Signing in with Google, Microsoft or single sign-on

What the test answers

Sessions

Can someone take over a logged-in session?

  • Sessions that stay valid too long
  • Access that remains after logging out or a new password

What the test answers

Roles and permissions

Can a user see or do what they should not?

  • Viewing data of other users or customers
  • Admin actions with a regular role
  • The separation between customers on the same platform

What the test answers

Business logic

Can the app work against its own rules?

  • Changing prices, discounts or quantities
  • Skipping steps, such as paying
  • Getting around limits

What the test answers

Uploads and admin

What can be done through uploads and the admin area?

  • Files that do more than a document or image
  • How well the admin area is shielded

What the test answers

The API

What does the API do when you skip the app?

  • Permissions the app checks but the API does not
  • Returning more data than needed
  • Protection against mass requests

What the test answers

Integrations and data

What can be done through connected systems?

  • Payments and integrations that can be faked
  • Files, exports and backups that can be reached

From a report

What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

Reference
HI-OP-2026-M4TX-03
Severity
High
CVSS
4.0 7.1 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
3.1 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Where
Invoice overview
Who can do this
Any logged-in employee
Retest
Fixed

Employees of customer A can open invoices of customer B

The app checks whether someone is logged in, but not whether the invoice belongs to their organisation.

Evidence

  1. Log in as an employee of customer A.
  2. Open one of your own invoices.
  3. Increase the invoice number in the address bar by one.
  4. The invoice of customer B appears, with name, address and amount.

Impact

Any logged-in user can view the financial data of every customer on the platform. That is a data breach.

Fix

app/Http/Controllers/InvoiceController.php

public function show(Invoice $invoice)
{
Added: $this->authorize('view', $invoice);
return view('invoices.show', compact('invoice'));
}

A made-up example. Real findings stay confidential.

View the sample report

Clear up front

What is and is not included

IN Part of the job

  • Your web application, including everything behind the login
  • The API the application uses, from Standard
  • Every agreed user role
  • A report and a debrief

OUT Not included

  • Production, testing only happens on a test environment or copy
  • Infrastructure, such as servers, network and hosting. Available on request, priced separately
  • Load tests, and attacks that make the environment unavailable
  • Phishing, and other tests on your staff
  • Systems of others, without their permission

Price

Which package fits your app?

Answer three questions and the package that fits lights up. After the intake you get a fixed price.

Basic

€1,950 from, excl. VAT

Test days
2 to 3
Suited for
Website or web shop with 1 user role
Included
Report and debrief

Standard

€3,750 from, excl. VAT

Test days
5
Suited for
Web application with multiple roles and an API
Included
Report, debrief and 1 retest

Extended

€5,500 from, excl. VAT

Test days
7 or more
Suited for
SaaS platform, multi-tenant application or large API
Included
Report, debrief and 1 retest

Preparation

What you provide

The better this is ready, the more time goes into the testing itself.

  • Needed A test account per role For example customer, employee and administrator.
  • Needed A fixed point of contact Available for questions and when something critical is found.
  • Optional A test environment A copy of your app, separate from real users. No test environment? HackIndex sets up a copy, at no extra cost for common sites. Protection that blocks test traffic is switched off for HackIndex.

Combine

More coverage in one job

This service

Web and API pentest

from €1,950

Tests from outside what an attacker can do.

On top

Security code review

from €1,520

With white box the code is read as well. That way flaws surface that are not visible from outside.

More about Security code review

Frequently asked questions

What is the difference with a scan?

A scanner looks for known flaws. Flaws in permissions and logic, such as an employee opening the invoices of another customer, only turn up by hand.

Do we need a test environment?

No. If you have one, the test runs there. If not, HackIndex sets up a copy of your app, separate from real users. For common sites such as WordPress, WooCommerce and Laravel at no extra cost. For a more complex setup it is a fixed item in the proposal. Testing does not happen in production.

Is Basic enough for my web shop or WordPress site?

Usually, when there is one kind of user, such as customers placing orders. If you also have staff with their own permissions or an API for an app, Standard fits better. After the intake you hear which package fits.

Is the API included?

From the Standard package it is. Basic only tests the web application.

What if something critical is found?

You hear about it right away, not only in the report.

Get your web app tested.

Briefly describe what needs testing. You'll receive a proposal with a fixed price.

Request a pentest

Other services