Request a Demo
WEB APPLICATION PENTEST

Secure every application,
not just the critical few

Every release widens your attack surface. Cobalt delivers expert testing across your full web application portfolio from autonomous to human-led pentesting. Ship fast. Test often. Fix what matters.
THE CHALLENGE

Web-based assets are proliferating across your organization

Web applications are the public face of your business, and attackers know it. 80% of incidents and 60% of breaches involved web apps. The risk compounds on three fronts:

  • The number of applications keeps growing, from customer-facing products to internal tools handling sensitive data.
  • Each new application widens the attack surface and gives attackers another way in.
  • Release cycles continue accelerating. Code changes daily. An old pentest does not reflect the application you are running today.

 

Testing a few critical applications once a year leaves the rest of your portfolio untested. Meanwhile attackers work at machine speed with AI, and findings from scanners without proof of exploit clutter the backlog.

 

Source: Verizon Data Breach Investigations Report

OUR APPROACH

A proven methodology,
executed by expert pentesters

Cobalt tests web applications following our industry-leading methodology, which is informed by the OWASP Application Security Verification Standard (ASVS) and the OWASP Top 10. Human-led testing goes where automation cannot, while AI accelerates reconnaissance, scanning, and triage so pentesters can focus on exploitation and complex business logic.

Read the web application pentest methodology
map-light-full

Map the application and its logic

Pentesters review workflows, roles, access controls, authentication, and session management, surfacing design-level weaknesses scanners never see.
radar-light-full

Scan authenticated and unauthenticated surfaces

Testing covers the application as an external attacker sees it and as a logged-in user does, surfacing misconfigurations, exposed endpoints, and broken access controls across both.
user-secret-light-full

Exploit manually, beyond the scanner

Expert pentesters confirm what is actually exploitable, from injection, cross-site scripting, and IDOR to session attacks, cryptographic failures, and business logic abuse.
network-wired-light-full

Test modern web architectures

Coverage extends to single-page applications, microservices, CORS and WebSockets, software supply chain exposure, and AI or LLM components.

Find and fix critical web application vulnerabilities

Every finding includes steps to reproduce and remediation guidance, all reported in real time and available for integration into your existing tooling and workflows.
Example Exploit Finding

CRITICAL (CVSS 10.0): SQL Injection in Patient Search Parameter Exposes Clinical MS SQL Server Database

Severity: Critical | CVSS: 10.0 | CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) | OWASP: Injection > SQL Injection | Status: Fixed

Description

The patient search endpoint concatenates the user-supplied searchtext query parameter directly into a SQL statement executed against a Microsoft SQL Server backend. The injection is error-based: submitting a bare single quote causes the server to return an "Unclosed quotation mark" error message, confirming unsanitized input reaches the query.

Further payloads extracted the database name, the login context (SA user), the server name, and the SQL Server version. The SA user holds the sysadmin fixed server role, granting full read and write access over the clinical database, including patient PHI and case records.

Affected Resources

  • GET /api/Patient/getPatientsBySearchPaginated?searchtext= — patient search endpoint, authenticated
  • Microsoft SQL Server 2019 (RTM-GDR) backend; login context: sa (sysadmin)

Proof of Concept

Step 1: Log in as any authenticated user and navigate to the patient directory search feature.

Step 2: Confirm error-based injection by submitting a bare single quote in the search field. Intercept the request:

  1. GET /api/Patient/getPatientsBySearchPaginated?searchtext=test'&offset=0&numrows=30 HTTP/1.1
  2. Host: [web-target-domain]
  3.  
  4. Response 500: "Unclosed quotation mark after the character string 'test'"

Step 3: Confirm injection is sanitized by submitting a doubled quote (returns empty result set, no error):

  1. GET /api/Patient/getPatientsBySearchPaginated?searchtext=test''&offset=0&numrows=30
  2.  
  3. Response 200: [] (no error, confirming error-based SQLi)

Step 4: Extract the database name using a CONVERT-based error payload:

  1. GET /api/Patient/getPatientsBySearchPaginated? searchtext=%27%2BDB_NAME()%2BCONVERT(int%2C%271%27)%2B%27&offset=0&numrows=30
  2.  
  3. Response 500: "Conversion failed when converting the nvarchar value '[DB_NAME]' to data type int."

Step 5: Confirm SA login context:

  1. searchtext=%27%2BSYSTEM_USER%2BCONVERT(int%2C%271%27)%2B%27
  2.  
  3. Response: "Conversion failed when converting the nvarchar value 'sa' to data type int."

Step 6: Confirm sysadmin role membership:

  1. searchtext=%27%2BCONVERT(varchar%2CIS_SRVROLEMEMBER(%27sysadmin%27))%2BCONVERT(int%2C%271%27)%2B%27
  2.  
  3. Response: "Conversion failed when converting the nvarchar value '1' to data type int." (1 = TRUE, SA is sysadmin)

Impact

Full read and write access to the clinical MS SQL Server database, including patient PHI, case records, and any other data in scope. The SA login context removes any database-level access control boundary. An attacker could exfiltrate all patient records, modify clinical data, or use xp_cmdshell (if enabled) to execute operating system commands on the database host.

Suggested Fix

  • Replace all string-concatenated SQL queries with parameterized queries or prepared statements.
  • Apply strict input validation and allowlisting on all user-supplied search parameters before they reach data access logic.
  • Replace the SA database login with a least-privilege service account restricted to the minimum necessary tables and operations.
  • Configure the application to return generic error messages rather than raw SQL error strings.
  • Consider disabling xp_cmdshell and other extended stored procedures not required by the application.
TESTING LEVELS

Testing to match your goals

Cobalt offers three standard approaches to testing to match your objectives and level of access.

box-solid-full

Black-box pentest

Testers get no internal knowledge and operate like an external attacker, relying only on public information and exposed functionality. This shows how your application holds up under real-world attack conditions.
box-duotone-light-full

Grey-box pentest

Testers get partial knowledge, such as valid user credentials, limited API documentation, or an overview of the architecture. This balances realism with efficiency and goes deeper into authenticated functionality, access control, and business logic while keeping an external attacker's perspective.
box-light-full

White-box pentest

Testers get full access to internal documentation, architecture diagrams, source code, configuration details, and test accounts across roles. This delivers the most comprehensive coverage and surfaces deep-seated vulnerabilities, insecure configurations, and architectural weaknesses.
SCALE YOUR COVERAGE

Cover your full portfolio with Cobalt Autonomous Pentest

Human-led pentesting delivers depth on your most critical applications, while Cobalt Autonomous Pentest extends testing across your portfolio. Both run on Cobalt Sage AI, the intelligence powering every Cobalt pentest. Every service is backed by 500+ Cobalt Core pentesters, our elite testers who direct scope, methodology, and quality on each engagement.
BENEFITS

Coverage, speed, and proof across your whole portfolio

Whether you have a 50-person security organization, or you are the security team, agentic PTaaS scales to match your reality. Every role gets the outcome that matters most.

Explore Platform Benefits

Comprehensive pentesting tailored to your architecture

Test every component and interaction in your web apps, whatever the framework.

Testing for web-specific vulnerabilities

Find and fix the most exploited web flaws, from XSS and SQL injection to insecure session management.

OWASP-driven methodology

Proven OWASP standards surface and prioritize the vulnerabilities that matter most.

Manual testing of business logic and workflows

Uncover exploitable logic and workflow flaws that automated tools miss.

Continuous testing for agile development

Keep pace with fast release cycles, built into your DevOps workflows.

Real-time communication and remediation

Collaborate with pentesters in real time, and route findings into Jira, GitHub, ServiceNow, or Slack through 50+ integrations.
CUSTOMER TESTIMONIALS

Trusted by security leaders

customer_personio-logo-blk-cropped
With hundreds of deployments daily, our security controls need to be an enabler, not a blocker. Our offensive security program allows us to simulate real-world attacks early in the SSDLC, ensuring vulnerabilities are identified and fixed before they can be exploited.

Arnau Estebanell

Lead Security Engineer, Personio
insurity-logo-1
Cobalt’s pentesters give us specialized talent, delivering exceptional value compared to maintaining the same talent in-house. And we don’t just get one person, we get a team. We’re ecstatic that we can have these highly talented pentesters with diverse skills and perspectives working on our applications.

Adam Davis

Director of Application Security, Insurity
industry-vertical-zest-logo-cropped
The reports were incredibly clear, showing us exactly what was tested and the results. That level of detail made it easy to work with our data science team to quickly resolve vulnerabilities and help us understand our own application better.

Waylan Wong

Senior Manager, Cloud Engineering, Zest AI
FAQ

Frequently asked questions about web application pentesting

What are web application penetration testing services?
Web application penetration testing is a controlled, authorized assessment of a web application to find and confirm exploitable vulnerabilities before real attackers do. Cobalt combines human-led testing with AI-powered automation, following the OWASP ASVS and Testing Guide to evaluate business logic, authentication, authorization, and input handling across your application.
What methodology does Cobalt use for web app pentesting?
Cobalt follows an industry-standard methodology built on the OWASP Application Security Verification Standard (ASVS), the OWASP Testing Guide, and the OWASP Top 10. Testing spans reconnaissance, business and application logic mapping, authenticated and unauthenticated scanning, manual exploitation, and advanced testing for modern web architectures such as single-page applications and microservices.
What kinds of vulnerabilities does a web app pentest find?
Common findings include injection such as SQL injection, cross-site scripting, broken access controls and IDOR, session management flaws, cryptographic failures, security misconfigurations, and business logic abuse that automated tools miss. Every finding is validated as exploitable and delivered with reproduction steps and remediation guidance.
How are web app pentesting services different from a scan or DAST?
Automated scanning and DAST provide continuous coverage and catch recurring issues, but they capture a point-in-time view and cannot reason about business logic. Human-led pentesting uncovers the complex, chained, and logic-based vulnerabilities that scanners overlook. Many teams run both, using DAST between pentests for ongoing visibility.
Can Cobalt keep up with frequent releases?
Yes. Cobalt combines comprehensive full-application pentests with narrow-scope agile pentests for new features, so testing keeps pace with agile and DevOps release cycles. Findings integrate directly into developer workflows, and retesting is available within a 7-day SLA.
Can I test my web applications with AI instead of human pentesters?
Autonomous Pentest runs AI-driven web application pentests directed by elite Cobalt pentesters, so you can scale defensible testing across your full portfolio. Use human-led pentesting for the depth your most critical applications demand, and Autonomous for breadth and speed across every release and every application. Both follow proven Cobalt methodology, and Autonomous is aligned to the OWASP Autonomous Penetration Testing Standard (APTS).
What does web app pentesting work well with?
Web application pentesting pairs naturally with API Pentest for shared endpoints and data exchange, Mobile Application Pentest for shared APIs and authentication flows, Network or Cloud Pentest for the hosting environment, and Secure Code Review and DAST for coverage across the full application lifecycle.
RESOURCES

The latest from Cobalt

GET STARTED

Your portfolio changes every release. Make sure your testing keeps up.

Secure every web application with human-led, AI-powered pentesting from the Cobalt Core, delivered through the Cobalt Offensive Security Platform.

product-screenshot-FPO2