WEB APPLICATION PENETRATION TESTING
Test Your Web Application From an Attacker's Perspective
G-2 provides controlled web application penetration testing for web systems, SaaS platforms, e-commerce, portals, APIs, and integrations. We investigate security weaknesses, validate realistic exploitation paths, document findings, and can support remediation through the G-2 development team.
The goal is to understand what is vulnerable, why it matters, and what should be fixed first.
Vulnerability scan can flag a potential weakness.
A penetration test adds human investigation and controlled attempts to determine whether and how a weakness could actually be exploited.
One Vulnerability Can Open the Door. What Happens Next Matters.
In October 2026, two critical PHP vulnerabilities with a CVSS score of 9.2 out of 10 highlighted the risks facing internet-facing applications. Under certain conditions, attackers could exploit vulnerable PHP installations to execute code remotely without authentication. Security agencies urged organisations to apply emergency patches and isolate exposed systems when necessary.
Patching known vulnerabilities is essential. But it is only one part of application security.
What happens if an attacker gains an initial foothold? Can exposed credentials provide access to other systems? Can a standard user account lead to sensitive data or administrative privileges?
Web application security is not just about finding individual vulnerabilities. It is about understanding what an attacker could do with them.
G-2 conducts penetration testing to identify exploitable weaknesses, validate attack paths and help organisations understand the potential impact of a compromise.
Preparing for a security review
a customer, auditor, internal security programme, or applicable compliance scope requires testing evidence.
Launching a new product or major release
significant functionality, APIs, or integrations are going live.
Handling sensitive data
the system processes customer, payment, financial, or business-sensitive information.
Responding to a security concern
you need to validate a suspected weakness and understand its impac
Meeting a customer or partner requirement
security testing is required before signing or onboarding
Application & Business Logic Testing
Assess application behaviour, workflows, input handling, and relevant security controls.
Authentication & Access Control Testing
Assess authentication, sessions, permissions, roles, and privilege boundaries.
API & Integration Testing
Test agreed APIs, endpoints, and integration points within scope.
Vulnerability & Exploitation Testing
Investigate weaknesses and validate realistic exploitation within scope.
Security Remediation
Support development fixes and review them where included in scope.
What We Test
Customer portals
Corporate web systems
SaaS platforms
E-commerce
Admin panels
CRM/ERP systems
APIs
Integrations
Internal web applications
Do you wanna test?
Let's get itFrom Scoping to Remediation
-
1 — Scope
define targets, objectives, access, and boundaries.
-
2 — Test
investigate the application and validate realistic attack paths.
-
3 — Find & Fix
document findings and remediate identified weaknesses.
-
4 — Review / Retest
verify relevant fixes where this is included in the agreed scope.
What You Get
Prioritised security findings
Technical evidence and proof of concept
CVSS-based severity scoring, where used
Business impact explained clearly
Recommended remediation steps
Development support and fix verification where included in scope
Why G-2
Security Testing Backed by Software Engineering
A penetration test tells you where a system is vulnerable. The next challenge is fixing it.
G-2 combines security testing with in-house software development, so identified weaknesses can move directly from finding to remediation within the same organisation.
Test. Find. Fix.
From Exposed Developer Infrastructure to Active Directory Compromise
An internet-facing service can become the starting point for a much larger security incident.
In a real external penetration test, G-2 began with only the client's company name and identified a chain of weaknesses that led from an exposed container registry and credentials in source-control history to compromise of the corporate Active Directory domain.
The assessment demonstrated how exposed developer infrastructure, historical secrets and vulnerable systems could combine to give an external attacker control over critical corporate resources.
What Can an Attacker Do With a Standard Employee Account?
Not every attack starts at the network perimeter. Sometimes, the starting point is an ordinary employee account.
During an assumed-breach assessment of a large enterprise environment, G-2 demonstrated how excessive access to shared files, weak internal authentication protections and insecure credential handling could enable a path from low-privilege access to domain-administrator privileges.
The assessment also identified a third-party desk-reservation application that exposed floor plans and seating information for all 17 floors of the client's building.
The takeaway: An ordinary employee account should not provide a path to large-scale data exposure or control of the corporate domain.
What Does Web Application Penetration Testing Cost?
Cost depends on system size and complexity, number of targets, testing approach, access provided, and required depth of testing.
FAQ
What is web application penetration testing?
A controlled security assessment in which specialists investigate a web-based system from an attacker's perspective and validate security weaknesses.
What is the difference between a vulnerability scan and penetration testing?
Scanning primarily identifies potential weaknesses automatically. Penetration testing adds human investigation and controlled exploitation to validate what can actually be abused.
What methodology do you follow?
The methodology depends on the scope and objective. OWASP guidance can be used where appropriate; exact frameworks and scoring methods are agreed during scoping.
What systems can you test?
Web applications, SaaS, e-commerce, customer portals, admin panels, CRM/ERP systems, APIs, integrations, and internal web systems.
Do I need penetration testing for SOC 2 or ISO 27001?
It may form part of security evidence required by a customer, auditor, or applicable compliance programme. Requirements depend on the framework and scope.
Can G-2 fix vulnerabilities found during testing?
Yes. G-2's development team can work on remediation.
Can penetration testing affect my system?
Testing is authorised and scoped in advance; operational risk depends on the system and techniques used.
How long does a test take?
The timeline depends on scope, targets, access, approach, and assessment depth.
How much does it cost?
The quote depends on the same scope factors. Tell us what needs to be tested and we will define the assessment scope.
Why do I need a penetration test if I’ve already installed all the latest security patches?
Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow remote code execution on unpatched systems. Patch first. Then let G-2 test your PHP application to see what an attacker could still reach, and fix it.
Request a Web Application Penetration Test
Tell us what you need assessed, what you are preparing for, and which systems are in scope.