# Web and API pentest

# Find out what an attacker can do behind the login.

A manual pentest of your web application and API. The focus is on permissions, roles and business logic, the flaws a scanner misses. Every finding comes with evidence and a fix for your developers.

**From €1,950 excl. VAT**. Fixed price once the scope is agreed

- **Duration**: 2 to 7 or more test days
- **Approach**: Black, grey or white box
- **Start**: By arrangement, usually within two weeks
- **Report**: Within 10 working days of the test
- **Retest**: Included from Standard
- **Up front**: NDA and written permission

[Request a pentest](https://hackindex.nl/en/contact/details?parts=web,api)

## Sound familiar?

- **A customer asks for a pentest report.** You get a report with evidence and severity for each finding, ready to share with your customer.
- **Something big is about to go live.** Test a new module, payment flow or API before real users can reach it.
- **The ISO 27001 or NEN 7510 audit is coming up.** A recent pentest is often part of the evidence for the auditor.
- **Customers must never see each other's data.** On a platform with several customers, that separation gets extra attention.

## What gets tested

Pick a part of your application to see which questions the test answers.

### Outside: The public side

What can someone see without an account?

- Information that is public by accident
- Error messages that reveal too much
- Forms that can be abused

### Access: Login

Can someone get in without knowing the password?

- Guessing passwords or using stolen ones
- Two-factor authentication and password reset
- Signing in with Google, Microsoft or single sign-on

### Access: Sessions

Can someone take over a logged-in session?

- Sessions that stay valid too long
- Access that remains after logging out or a new password

### Application: Roles and permissions

Can a user see or do what they should not?

- Viewing data of other users or customers
- Admin actions with a regular role
- The separation between customers on the same platform

### Application: Business logic

Can the app work against its own rules?

- Changing prices, discounts or quantities
- Skipping steps, such as paying
- Getting around limits

### Application: Uploads and admin

What can be done through uploads and the admin area?

- Files that do more than a document or image
- How well the admin area is shielded

### Back end: The API

What does the API do when you skip the app?

- Permissions the app checks but the API does not
- Returning more data than needed
- Protection against mass requests

### Back end: Integrations and data

What can be done through connected systems?

- Payments and integrations that can be faked
- Files, exports and backups that can be reached

## What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

### HI-OP-2026-M4TX-03: Employees of customer A can open invoices of customer B

- **Severity**: High, CVSS 4.0 7.1, CVSS 3.1 7.7

The app checks whether someone is logged in, but not whether the invoice belongs to their organisation.

1. Log in as an employee of customer A.
2. Open one of your own invoices.
3. Increase the invoice number in the address bar by one.
4. The invoice of customer B appears, with name, address and amount.

Any logged-in user can view the financial data of every customer on the platform. That is a data breach.

```diff
public function show(Invoice $invoice)
{
+    $this->authorize('view', $invoice);

    return view('invoices.show', compact('invoice'));
}
```

A made-up example. Real findings stay confidential.

## What is and is not included

### Part of the job

- Your web application, including everything behind the login
- The API the application uses, from Standard
- Every agreed user role
- A report and a debrief

### Not included

- **Production**, testing only happens on a test environment or copy
- **Infrastructure**, such as servers, network and hosting. Available on request, priced separately
- **Load tests**, and attacks that make the environment unavailable
- **Phishing**, and other tests on your staff
- **Systems of others**, without their permission

## Which package fits your app?

Answer three questions and the package that fits lights up. After the intake you get a fixed price.

- **Basic**, from €1,950: Test days 2 to 3, Suited for Website or web shop with 1 user role, Included Report and debrief
- **Standard**, from €3,750: Test days 5, Suited for Web application with multiple roles and an API, Included Report, debrief and 1 retest
- **Extended**, from €5,500: Test days 7 or more, Suited for SaaS platform, multi-tenant application or large API, Included Report, debrief and 1 retest

## What you provide

The better this is ready, the more time goes into the testing itself.

- **A test account per role** (Needed): For example customer, employee and administrator.
- **A fixed point of contact** (Needed): Available for questions and when something critical is found.
- **A test environment** (Optional): A copy of your app, separate from real users. No test environment? HackIndex sets up a copy, at no extra cost for common sites. Protection that blocks test traffic is switched off for HackIndex.

## More coverage in one job

- **Web and API pentest** (from €1,950): Tests from outside what an attacker can do.

- **Security code review** (from €1,520): With white box the code is read as well. That way flaws surface that are not visible from outside.

[More about Security code review](https://hackindex.nl/en/security-code-review)

## Frequently asked questions

### What is the difference with a scan?

A scanner looks for known flaws. Flaws in permissions and logic, such as an employee opening the invoices of another customer, only turn up by hand.

### Do we need a test environment?

No. If you have one, the test runs there. If not, HackIndex sets up a copy of your app, separate from real users. For common sites such as WordPress, WooCommerce and Laravel at no extra cost. For a more complex setup it is a fixed item in the proposal. Testing does not happen in production.

### Is Basic enough for my web shop or WordPress site?

Usually, when there is one kind of user, such as customers placing orders. If you also have staff with their own permissions or an API for an app, Standard fits better. After the intake you hear which package fits.

### Is the API included?

From the Standard package it is. Basic only tests the web application.

### What if something critical is found?

You hear about it right away, not only in the report.

## Get your web app tested.

Briefly describe what needs testing. You'll receive a proposal with a fixed price.

- [Request a pentest](https://hackindex.nl/en/contact/details?parts=web,api)

## Other services

- [Mobile pentest](https://hackindex.nl/en/mobile-pentest): iOS and Android apps, including the API behind them
- [Security code review](https://hackindex.nl/en/security-code-review): Your source code read for vulnerabilities
- [GDPR code check](https://hackindex.nl/en/gdpr-code-check): How your code handles personal data

## Glossary

- **Debrief**: A call about the report: what was found, how serious it is and in which order to fix it.
- **Infrastructure**: The servers, network and hosting underneath your application, such as open ports and server settings. These fall outside a test of the application itself.
- **Multi-tenant**: One application serving several customers or organisations, where the data of each one must stay separate.
- **Retest**: Once the issues are fixed, every finding is tested again to confirm the fix works.
- **Test environment**: A copy of your application, separate from real users and data, where testing can be done safely.
- **User role**: A type of user with its own permissions, such as customer, employee or administrator.
- **White box**: You also share the source code and documentation, so flaws surface faster and more completely.

Source: https://hackindex.nl/en/web-and-api-pentest