OWASP Web Security Testing Guide
The testing checklist the industry recognises, used as the backbone for application coverage rather than a box-ticking exercise.
method
How a test actually runs.
No black box, no mystery. You know what is happening at each stage, and anything critical reaches you the day it is confirmed.
day 0 scoping call → fixed-price proposal day 1 rules of engagement + authorisation signed day 2 access confirmed, mapping begins day 3+ manual testing, daily status line critical finding → reported immediately end report delivered, debrief call later retest of fixed findings → retest letter
six steps
From first call to retest letter.
01
Scope
A short call about the application, its roles and what would hurt most if it broke. You get a fixed-price proposal and dates.
02
Authorise
Rules of engagement, authorisation and an NDA if you want one. Testing starts only once these are signed.
03
Map
Reconnaissance and mapping: every route, role, parameter and API call that makes up the attack surface.
04
Test
Manual testing against the OWASP guides, supported by tooling. Critical findings are reported the moment they are confirmed, not held for the report.
05
Report
Findings with evidence, reproduction steps, CVSS ratings and fix guidance written for developers, plus a summary for everyone else.
06
Retest
Once you have fixed things, a retest confirms it, and you get a letter you can show customers or auditors.
standards
Recognised methodology, applied by hand.
Tooling is used where it helps: mapping, discovery and repetitive checks. The findings that matter usually come from understanding the application, not from a scan.
OWASP API Security Top 10
APIs get tested directly, not only through the interface that happens to call them.
OWASP ASVS
Where you want a verification standard to measure against, findings can be mapped to ASVS requirements.
CVSS
Every finding carries a CVSS rating so your team can prioritise consistently with everything else in your backlog.
reporting
Written for two audiences at once.
A penetration test report has to work for the developer who will fix the issue and for the executive or customer who needs to know whether the risk is handled. You get both, in one document set.
- Each finding: what it is, where, how to reproduce it, evidence, CVSS rating, and how to fix it
- Management summary in plain language, with the overall picture and what it means commercially
- Findings in CSV so they go straight into your issue tracker
- Report delivered within 5 working days of testing ending
title Broken access control on /api/v1/records/:id severity CRITICAL · CVSS 8.8 affects Authenticated users of role "viewer" summary A viewer can read records belonging to another tenant by changing the identifier in the request. reproduce 1. Sign in as viewer@tenant-a 2. GET /api/v1/records/1042 (tenant B record) 3. Response: 200 with tenant B data fix Enforce tenant scoping server-side on every record lookup, not only in the listing query.
rules
Authorisation first, always.
Testing without written permission is not a service, it is an offence. Before anything starts, we agree rules of engagement: what is in scope, what is explicitly out, when testing happens, who to call, and how to stop it.
- Written authorisation and rules of engagement before any testing begins
- No denial-of-service testing, and no destructive actions without explicit agreement
- No social engineering, phishing or physical testing
- Third-party platforms are tested only with that provider’s permission where required
- Findings are handled confidentially and are never disclosed to anyone but you
Confidentiality
Findings, evidence and reports are yours. They are stored only as long as needed, shared with nobody else, and an NDA is signed on request before scoping begins.
Insurance and contracts
The engagement is contracted and invoiced by MD QMS Ltd. Contract terms, including liability and insurance details, are confirmed in writing with your proposal.
request a scope
Find out what a test would cost
A 20-minute scoping call, then a fixed-price proposal. No obligation, and no pressure to buy a bigger scope than you need.
Fixed-price quote within 2 working days of the scoping call · Report delivered within 5 working days of testing ending · One retest of fixed findings included, within 60 days