Sample Report: Web & API Penetration Test

About 30 pages · German or English · PDF

The fictional Heveon GmbH runs a self-service portal through which around 40 Swiss SMEs manage payslips, IBANs and social insurance numbers of their employees. Before go-live, we tested the web application and the REST API as a grey-box assessment over eight business days. The report documents six vulnerabilities, one of them critical, each with proof, risk rating and concrete remediation.

Email me the report

A look inside the report

What the report contains

Management summary with overall risk, risk heat map and attack chain
Scope and methodology based on the OWASP Web Security Testing Guide and the OWASP API Security Top 10
Six findings with CVSS score, MITRE ATT&CK mapping, proof of concept and screenshots
Prioritized remediation roadmap with deadlines
Mapping of the findings to the Swiss Data Protection Act (nFADP)

The findings at a glance

#	Finding	Severity
1	IDOR: Payslip Accessible via Sequential API ID	Critical
2	Broken Authentication: Password-Reset Token Reusable After Use	High
3	Business Logic: Expense Amount Client-Controlled	High
4	Sensitive Data in JWT Payload	Medium
5	Legacy API v0 Admin Endpoint Still Reachable	Medium
6	Missing HTTP Security Headers	Low

The client, people and data in the report are fictional. The vulnerabilities and evidence come from a test environment built for this purpose.

Get the report by email, free of charge

Which reports would you like?

Web & API penetration test

Internal and Active Directory pentest

Report language

Name

Business email

Company (optional)

We use your details to send you the report. You will only receive further emails if you tick the box above. More in our privacy policy.

Another sample report

Sample report: Internal pentest

From a standard account to Domain Admin: 33 pages with nine findings, proof and a remediation roadmap. Free by email.

View sample report