Penetration Testing
Web Application, API & Network Penetration Testing
Find the weaknesses an attacker could use to access data, abuse business logic or move through your systems. We perform manual penetration testing of applications, APIs and networks, with clear findings your engineers can act on.
Testing is scoped to the systems you need assessed. Application testing, API testing and internal or external network testing can be commissioned individually or combined where appropriate.
Test the boundaries your software depends on
Can a user access another customer’s records? Can a restricted account perform an administrative action? Can a valid sequence of requests be rearranged to bypass a business rule?
These questions require an understanding of how your product is supposed to work. Our assessments investigate the relationship between user roles, application behavior and the controls protecting sensitive data and functionality.
What we test
Web Application Penetration Testing
We assess websites, SaaS platforms, dashboards and backend functionality for weaknesses that could compromise users, data or business operations.
Depending on the agreed scope, testing covers:
- Authentication flows and weaknesses that could allow unauthorized access.
- Authorization between users, roles, tenants and administrative functions.
- Business logic that can be manipulated through unexpected inputs or workflows.
- Sensitive data exposed through application responses or functionality.
- Other exploitable issues in the application’s security-relevant features.
For example, a user interface may hide an administrative control while the backend still accepts the action from an ordinary account. We investigate whether the underlying controls enforce the intended restrictions.
API Penetration Testing
An API must enforce access rules even when a request never passes through your application’s interface. We assess backend endpoints and the authorization boundaries around their data and actions.
Testing may examine whether a caller can access another user’s objects, read restricted fields, invoke privileged functions or misuse a sensitive business workflow. We also investigate authentication weaknesses and inappropriate data exposure within the agreed endpoints.
API documentation, example requests and test accounts can help define coverage. They are discussed during scoping; no particular access model is assumed.
External Network Penetration Testing
Assess the infrastructure an attacker can reach from outside your organization. We examine authorized public-facing hosts and services for exposed functionality, vulnerabilities and potential routes into connected systems.
The objective is to understand what an external attacker could exploit within the defined targets and testing boundaries.
Internal Network Penetration Testing
Assess what could happen from an agreed position inside your environment. We investigate reachable services, network weaknesses, privilege escalation and potential lateral movement between systems.
The starting access matters. Testing from a limited user account answers different questions from testing with broader access. We agree the starting point and permitted activities before the engagement.
Built for product, engineering and security teams
This service fits SaaS businesses, software teams and organizations with specific systems they need independently tested.
Consider an assessment when you are:
- Preparing to launch an application or deploy it to a major customer.
- Releasing an API or changing authentication, permissions or tenant isolation.
- Introducing a sensitive workflow such as account administration or data sharing.
- Responding to a customer request for independent security testing.
- Reviewing infrastructure after significant network changes.
The trigger helps define the scope. An API release does not automatically require an internal network test.
How the engagement works
1. Agree the targets and rules
We define the assets, objectives, access level, environment, testing window and permitted activities. We also agree how to communicate significant findings during the work.
2. Understand the application or environment
We examine the available documentation and system behavior to identify important roles, entry points, data flows and trust boundaries.
3. Investigate and validate weaknesses
Manual testing follows the ways the system could be misused. Supporting tools can help with discovery, but findings are assessed in the context of the target and the evidence available. Validation stays within the agreed testing boundaries.
4. Report the impact and remediation
We explain what was found, the conditions needed to exploit it and the changes recommended to address it. The report records the scope and limitations so your team can interpret the results accurately.
Source review where it adds depth
Black-box testing examines the behavior exposed by a running system. When included in scope, source code review can help trace authorization decisions, investigate backend logic and understand why a weakness exists.
We can combine these approaches where appropriate. Source access, authenticated testing and internal network access are not automatically included in every engagement; each is agreed during scoping.
Findings your engineers can work with
Your report includes:
- An executive summary of the most significant findings.
- The systems and testing areas covered, with relevant access assumptions and limitations.
- Technical findings, supporting evidence and reproduction details where appropriate.
- Severity and potential business impact, including exploitation conditions.
- Recommended remediation and priorities for addressing the findings.
If you need fix verification, a report format for a customer review or additional testing after changes, raise that during scoping so it can be included in the proposal where agreed.
Why CD Security
We bring the firm’s emphasis on experienced researchers and close analysis of complex logic to a service scoped for your application or network. The technical work focuses on how access and behavior can be abused, and the report connects each issue to practical remediation.
Our established public portfolio covers Web3 audits. It demonstrates the firm’s published security work without replacing the application or network expertise required for your engagement.
Frequently asked questions
Does a penetration test include applications, APIs and networks?
Only the areas agreed in scope. You can request a web application or API assessment without buying network testing. We can also scope internal or external network testing as a standalone engagement.
How does this differ from a vulnerability scan?
A scan can identify known patterns and exposed services. A penetration test also investigates how the system behaves, whether access controls hold and whether individual weaknesses can be exploited in context. Manual review is particularly useful for authorization and business logic that depend on your product’s intended behavior.
Do you need source code or user accounts?
Not for every engagement. Black-box testing can start without source access. Authenticated testing requires suitable accounts, and source-assisted testing requires the agreed code. We explain the coverage and limitations of the chosen access model before testing.
Can you test a production system?
The environment and testing constraints must be agreed first. Production testing can affect availability or data, so we define permitted activities and coordination arrangements during scoping. We do not promise risk-free production testing.
Do you cover OWASP risks?
Our application and API capabilities include authentication, access control, data exposure and business logic weaknesses addressed by OWASP guidance. If you need coverage mapped to the OWASP Web Security Testing Guide or API Security Top 10, tell us during scoping so the relevant checks and reporting requirements can be agreed.
How long does a penetration test take, and what does it cost?
That depends on the number and complexity of targets, user roles, access available and testing depth. We provide an engagement-specific scope, timeline and quote after reviewing your requirements.
Is retesting included?
Retesting terms are defined in the proposal. If you need confirmation that fixes address the findings, include that requirement when requesting the assessment.
Define your next penetration test
Tell us which application, API or network you want tested, what has changed and when you need the assessment. We will use that information to define the scope and quote.