Web App & API Penetration Testing
Manual penetration testing of the things your customers actually log into. AI does the wide search across every endpoint and role. I do the proof: every finding reproduced by hand, reported within two working days, retest included.
Password reset takes over any account, including admins
Critical 9.1// Token requested for an inbox we controlPOST /auth/reset/confirm HTTP/2Host: app.example.co.uk{ "token": "b7e1…9c04", "user_id": 1, "password": "••••••••••••" } // Response — token checked, account taken from the bodyHTTP/2 200 OK{ "status": "password_updated", "user_id": 1 }// user 1 is the platform owner
Any logged-in user can read and edit any customer's invoices
High 8.1// Authenticated as tenant A (user 4412)GET /api/v2/invoices/100873 HTTP/2Authorization: Bearer eyJhbGciOiJSUzI1NiIs… // Response — invoice belongs to tenant BHTTP/2 200 OK{ "id": 100873, "tenant_id": 2207, "total": 18450.00, "billing_email": "finance@…", "line_items": […] }// PATCH on the same ID also returns 200
Webhook URL check bypassed to reach cloud metadata
High 7.7// Validator blocks 169.254.169.254 but follows redirectsPOST /api/v2/webhooks HTTP/2{ "url": "https://redirect.tester.example/r?to=…" } // Delivery log for the webhook, 40s laterHTTP/2 200 OK{ "status": 200, "body_preview": "{\"AccessKeyId\":\"ASIA…\",\"SecretAccessKey\":\"…\", \"Token\":\"…\"}" }
AI finds candidates. I reproduce every one by hand before it becomes a finding.
Report in your inbox after testing ends, walked through on a call.
Fix within 30 days and every finding is re-verified within 2 working days.
Quoted in writing the same day as the scoping call. No day-rate creep.
Two surfaces, tested as one attack.
Most breaches of a modern product chain a web front-end flaw into an API flaw, or the other way round. I test both in the same engagement, so the chain gets found.
Web applications
OWASP WSTG v4.2 · ASVS L2- AUTHAuthentication & sessionMFA bypass, password reset logic, session fixation, OAuth and SSO misconfiguration, remember-me tokens.
- ACLAccess controlHorizontal and vertical privilege escalation, IDOR, role confusion across multi-tenant boundaries.
- LOGICBusiness logicPrice and quantity manipulation, workflow step skipping, race conditions on payments and coupons.
- INJInjection & server-sideSQL, NoSQL, command and template injection, SSRF into cloud metadata, XXE, insecure deserialisation.
- CLIENTClient-sideStored and DOM XSS, CSRF, postMessage abuse, prototype pollution, CSP and cookie hardening.
- FILESUploads & exportsMalicious file upload, path traversal, CSV and PDF injection, exposed object storage.
APIs
OWASP API Top 10 2023 · REST · GraphQL- API1Broken object level authorisationThe most common serious flaw in multi-tenant APIs. Every object reference tested across tenants and roles.
- API3Property-level exposureMass assignment (setting is_admin in a profile update), over-fetching that leaks personal data.
- API5Function-level authorisationAdmin endpoints reachable with a customer token, method switching, hidden versioned routes.
- API4Resource consumptionMissing rate limits on OTP and login, pagination abuse, expensive GraphQL queries and batching.
- TOKENTokens & keysJWT algorithm confusion, weak signing keys, non-expiring refresh tokens, API keys in client bundles.
- GQLGraphQL specificsIntrospection, alias-based brute force, nested query depth, field-level authorisation gaps.
Not me: internal networks, wireless, phishing, red teaming, mobile binaries. If you need those I'll say so on the call and point you to people who do them well. Doing one thing lets me go much deeper on it.
AI widens the search. A human confirms the hit.
A scanner matches signatures. A person understands your product. AI sits between the two: it can read every endpoint and every role and try things at a scale one tester never could, but it can't tell you what matters. So I use it for the search, and myself for the judgement.
Map and search
Tooling reads your API docs and front-end bundle, maps every endpoint including the undocumented ones, and generates per-role test cases for each.
- Every object reference tried across every tenant and role
- Thousands of responses diffed for leaks and anomalies
- Runs in hours, so my time goes on the hard parts
Reproduce and judge
I take every AI candidate and try to make it happen by hand. Most don't survive. The ones that do get a real request, a real response, and an impact assessment.
- False positives discarded before you ever see them
- CVSS for comparability, priority set by your business
- Exact reproduction steps written down
Exploit and chain
The work AI can't do. Business logic abuse, chaining two mediums into something serious, and proving what an attacker actually gets, in an agreed test environment.
- Price, workflow and race-condition abuse
- Attack chains written up as their own finding
- Remediation your engineers can pick up as a ticket
If AI flagged it and I couldn't reproduce it, it isn't a finding. It doesn't go in the report.Every finding in your report has been made to happen by a person, with the exact request to make it happen again.
Most of what AI finds, I throw away.
That's the point. The search is cheap and wide. The judgement is expensive and narrow. You only pay for, and only read, what survived the second half.
Sample engagement · 1 web app + API · 214 endpoints · 4 roles · 5 tester daysScoped today. Tested this week. Report two days later.
Scope
30-min call · quote same dayWe count endpoints, roles and user journeys, agree what's in and out, and I send a fixed price and rules of engagement in writing before the day is out.
- Test accounts for each role
- Staging or production, your call
- Emergency contact and stop conditions
Test
Typically 2–6 daysAI mapping runs on day one. I spend the rest reproducing, exploiting and chaining. Criticals are reported the day I confirm them.
- Daily status note
- Direct chat with me, not a portal
- Criticals flagged same day
Report & debrief
Within 2 working daysExecutive summary, severity-ranked findings with step-by-step reproduction, walked through on a call with your engineers.
- PDF plus a machine-readable export
- Attestation letter for customers and auditors
Retest
Within 30 days · 2-day turnaroundFix, tell me, and I re-verify every finding within two working days and reissue the report with updated status. Included in the price.
- Per-finding closed or open status
- Clean attestation once everything is closed
"Typical" reflects what teams commonly report about larger suppliers. Plenty of firms do better; your experience will vary.
A report written for the people who have to fix it.
Your CTO reads the first page, your engineers read the rest, your auditor gets the letter. Nobody has to decode a scanner export.
Fixed price, sized by what you actually have.
Every engagement is quoted individually after a scoping call, based on endpoints, roles and complexity, and fixed in writing before I start. These are the usual shapes.
API test
- All documented and discovered endpoints
- Tested across every role and tenant you provide
- Full OWASP API Top 10 plus auth and token analysis
- Report, debrief, retest
Web app + API
- Everything in both single tests, by the same person
- Front-end to back-end attack chains explicitly hunted
- Business logic and payment flow abuse cases
- Attestation letter for customers and auditors
Web application test
- Authenticated grey-box testing across all roles
- OWASP WSTG coverage plus business logic testing
- Includes the API calls the app itself makes
- Report, debrief, retest
Larger estates, multiple apps and source-assisted reviews are scoped individually. Repeat tests after a release take less time, because I already know your app.
Size your engagement
Rough numbers are fine. This gives you an indicative effort and timeline, and pre-fills your email so the scoping call starts from the right place.
Estimate only. Your fixed price is quoted in writing after a 30-minute scoping call, and includes the report, debrief and retest.
Register interest with this scopeHow much I know going in.
Anonymous attacker
No accounts, no docs. Simulates an outsider. Realistic, but most of your application sits behind a login, so most of it goes untested.
Best for: public marketing sites, pre-auth surface only
Authenticated user
Test accounts for each role, API docs, and an architecture overview. Simulates a malicious customer or a compromised account, which is where real breaches start.
Best for: SaaS products, customer portals, any multi-tenant app
Source-assisted
Grey box plus read access to the repository. Lets me confirm root causes, find variants of each bug across the codebase, and give exact fix locations.
Best for: pre-launch, post-incident, high-assurance products
You're handing a stranger the keys. Here's what I do with them.
Credentials
Test accounts only, never real users. Stored in a per-engagement vault that only I can open, and deleted when the engagement closes.
What the AI sees
Tooling runs in an isolated environment per engagement. Your data is never used to train models. Any model provider involved is named in the rules of engagement before testing starts, and you can require local-only tooling.
Evidence and reports
Encrypted at rest, shared through an expiring link rather than an email attachment. Screenshots and response bodies are redacted to the minimum needed to reproduce the issue.
Retention
Evidence is deleted 90 days after your retest window closes. The report is kept for 12 months so I can reissue it, then deleted unless you ask me to keep it.
One tester. No handoffs.
Willbro Security is one person, not a team. The person you scope with is the person who tests, writes the report, and answers during the retest. No juniors learning on your app, no account manager in between.
It also means being honest about capacity. I'm committed to a full-time role until 2028, so I'm not taking new clients until then. I'd rather say that plainly than do a rushed job on the side.
Usually one of four reasons.
An enterprise deal needs it
Procurement wants an independent test from the last 12 months. You get a report and an attestation letter you can share without showing them your findings.
An audit or standard asks for it
Reports map findings to the control being evidenced and stand up to the auditor's questions.
You're about to launch or migrate
A new product, a re-platform, or an API opened up to partners. Cheaper to find the tenant-isolation bug now than in an incident report.
You want to know, honestly
No box to tick, just a team that would rather hear it from me than from a bug bounty submission or a customer. My favourite kind of engagement.
Are you taking on new clients?
Not until 2028. I'm committed to a full-time role until then and won't run new engagements alongside it. Existing clients still get their retests and report reissues. Register your interest and I'll get in touch in good time before I reopen.
How is AI used in the test? Is my report written by AI?
AI is used to map your application and generate and run test cases at a scale one person can't. It produces candidates, not findings. I reproduce every candidate by hand, discard the ones that don't hold up, and do all exploitation, chaining and severity judgement myself. The report is written by me, and each finding says how it was found.
How is an engagement priced?
A fixed price, in writing, after a 30-minute scoping call. It's based on endpoints, roles, user journeys and anything that moves money, not on an open-ended day rate. The quote includes the report, the debrief and a retest within 30 days. There are no extras added later for the scope we agreed.
How long does it take?
Most engagements are 2 to 6 tester days, with the report within 2 working days of testing finishing. From scoping call to report in hand is usually under two weeks.
Do you review source code?
Yes, as part of a source-assisted engagement. Testing the running application stays the core of the work, and read access to the repository lets me confirm root causes, find every variant of a bug, and point to the exact lines to change.
Should we test in staging or production?
Staging with production-like data is ideal. Production testing is possible for most applications with agreed stop conditions and no destructive testing, and I'll tell you on the call which I'd recommend for yours.
What do you need from us?
Written authorisation from whoever owns the system, test accounts for each user role, API documentation if you have it (an OpenAPI file or a Postman collection is perfect), any IP allow-listing, and a technical contact who can answer questions during the test.
Will the test break anything?
I don't run denial-of-service tests and I don't use destructive payloads without agreeing them first. AI-driven testing is rate-limited and scoped to the endpoints agreed. Anything with a real chance of side effects (payment flows, email sending, deletions) is discussed and agreed in the rules of engagement.
Can we share the report with customers?
Yes. Once retesting is complete I issue an attestation letter summarising scope, method and outcome that you can share with customers, prospects and auditors without revealing the detail of individual findings.
What happens if you're ill or unavailable mid-test?
Being one person, this is a fair question. Testing windows are agreed with slack built in, and if something serious happened the engagement would pause, not be handed to someone you haven't met. You'd be told the same day and never charged for time not delivered.
Booked until 2028. Leave your details and I'll come to you when that changes.
Tell me what you've built and roughly when you'd want it tested. I won't sell your details, I won't chase you, and I'll only get in touch when I have capacity.