Guide

Web application penetration testing: what it is and how it works

A plain-English explanation of what a web app pentest covers, how it runs from start to report, how it differs from a network test or a scan, and what it should cost.

By the Bug Circuit security team · Last updated October 22, 2026

What is web application penetration testing? It is an authorized, hands-on attempt to break into a website or web app the way an attacker would, to find weaknesses in its login, access control, inputs, business logic and configuration. A person does the testing, usually following the OWASP Web Security Testing Guide, and delivers a report with every finding and its fix. It costs $5,000 to $20,000+ from an agency, or $49 for a focused manual audit of one small site.

What a web application pentest covers

The OWASP Top 10 is the usual checklist of the most common web risks. A good test goes well beyond running a tool against it.

Authentication and sessions: password rules, password reset, login limits, how sessions are created and ended.
Access control: can one user see another user’s data, or reach an admin function, by changing an ID or a URL?
Input handling: SQL injection, cross-site scripting (XSS) and file upload flaws in forms, URLs and APIs.
Business logic: checkout, coupons, roles and multi-step flows that a tool cannot understand.
Configuration: security headers, HTTPS, exposed files, debug pages and admin panels.
APIs and integrations the app depends on.

How a web application penetration test runs

1
Scope and permission
Agree the target, user roles and rules, prove ownership and sign a written authorization.
2
Map the app
Find pages, subdomains, APIs, technology and user roles. Passive first, then active.
3
Test by hand
Work through the OWASP checks, try to use each weakness, and chain issues together.
4
Report and retest
Every finding with severity, evidence and fix. After you fix, the tester retests.

Web application vs network penetration testing

Web application penetration testing compared with network penetration testing
	Web application test	Network test
Targets	Code, logins, forms, APIs and business logic	Servers, open ports, firewalls and services
Typical findings	Broken access control, injection, weak sessions, logic flaws	Exposed services, weak configurations, missing patches
Best for	Websites, web apps, online stores, SaaS	Offices, internal systems and hosted infrastructure
Where small sites are hit	Most often here	Less often, unless you run your own servers

Many engagements cover both. For a typical small-business website, start with the web application test. For how this compares with automated checks, read manual vs automated penetration testing.

Black box, grey box and white box

Black box, grey box and white box web application tests
Type	The tester gets	Good for
Black box	Nothing but the address	Seeing what an outside attacker finds
Grey box	One or two logins for different roles	Access-control and logic flaws. Best value for most sites
White box	Logins and the source code	Deep review of a custom app before a launch

What it costs

Price follows tester days, and tester days follow scope: pages, roles, APIs and depth. Agencies usually quote $5,000 to $20,000 or more. A focused manual audit of one small website is far cheaper because the scope is small and fixed. See how much a penetration test costs for the market ranges and the cost calculator to estimate your own.

Circuit, $49 one-time: a person tests one website by hand and writes the full report. See a sample report.
Signal, $147 every 3 months: everything in Circuit, plus fixes for the high and critical issues, re-tests every 6 months and weekly checks.
Enterprise, fixed quote: several apps or APIs in one scoped engagement. See Enterprise.

Choosing a company or a tool

There are two common ways to get this wrong: buying a scanner report and calling it a pentest, or paying for a long scoping process you do not need. Look for a person who tests by hand, a sample report before you pay, a fixed price for a written scope, and a signed authorization before any testing. The full checklist is in how to choose a penetration testing company, and if you are in Sri Lanka, how to choose a cyber security company in Sri Lanka. To scan your own site first, see how to scan a website for vulnerabilities.

Frequently asked questions

What is web application penetration testing?

It is an authorized, hands-on attempt to break into a web application the way an attacker would, to find weaknesses in its login, access control, input handling, business logic and configuration before a real attacker does. It ends in a written report with every finding, its severity and how to fix it.

What is the difference between web application and network penetration testing?

A web application test targets the application layer: your site’s code, logins, forms, APIs and business logic. A network test targets infrastructure: open ports, servers, firewalls and services. A website often needs the first one more, because most real breaches of small sites come through the application, such as a weak login or a broken access check.

What methodology does a web application penetration test follow?

Most testers follow the OWASP Web Security Testing Guide, with the OWASP Top 10 as the checklist of the most common risks. The stages are: scope and rules of engagement, information gathering, configuration testing, authentication and session testing, authorization testing, input validation testing, business logic testing, then reporting and retest.

How much does a web application penetration test cost?

Agency tests usually cost $5,000 to $20,000 or more, billed in senior tester days at roughly $900 to $2,200 per day, and the price grows with the number of pages, user roles and APIs. A focused manual audit of one small website costs $49 one-time with Bug Circuit, or $147 every 3 months with fixes, re-tests and weekly checks.

What is the difference between a vulnerability scan and a web application penetration test?

A scan is automated and lists possible weaknesses. A penetration test is done by a person who tries to use the weaknesses, chains them together and tests logic that tools cannot understand, such as one customer reading another customer’s order. Scans are cheap and frequent. Pen tests are deeper and less frequent.

What tools are used for web application penetration testing?

An intercepting proxy such as Burp Suite or ZAP sits between the tester’s browser and the site so every request can be read and changed. Testers add scanners such as Nuclei, content discovery tools and scripts. The tools only find leads. A person decides which ones are real and how serious they are.

What are black box, grey box and white box tests?

In a black box test the tester knows nothing about the app, as an outside attacker would. In a grey box test they get a login or two, which finds the most access-control problems for the money. In a white box test they also see the source code. Most small-business tests are grey box.

How often should a web application be tested?

At least once a year, and after major changes such as a new login system, a payment flow or a platform migration. Run automated scans more often, such as weekly, to catch new problems between manual tests.

Keep reading

VAPT servicesAssessment plus penetration testing, with one report.How to get a penetration testThe six steps from scope to report.Do I need a penetration test?A five-question check.See a sample reportExactly what you get at the end.How to choose a penetration testing companyWhat separates real testers from scanner resellers.Choosing a cyber security company in Sri LankaTen checks and the red flags to avoid.

Start with the free passive check

See what attackers can see about your website in seconds. No login, no card, nothing touches your site.

Ready for the full manual audit? See pricing