What is the difference between a vulnerability scan and a penetration test?

A scan runs automated checks for known issues and reports what it finds, including false positives. A penetration test uses people to find, chain and exploit weaknesses, including logic flaws no scanner understands, and proves which ones are real.

Do you test against the OWASP Top 10?

Yes, and beyond it. The OWASP Top 10 is a list of the most common risk categories. Business logic flaws specific to your application are often more serious and are not on any list.

Is a retest included?

Yes. Every HYDN engagement includes one free remediation check once your team has fixed the findings.

Web Application Penetration Testing

Web application penetration testing

HYDN's web application penetration testing attacks your application the way a real attacker would, using manual techniques supported by tooling and following OWASP, PTES and NIST methodology. We test authentication, session handling, access control, injection, business logic and third-party components, prove what can be exploited, and retest once you have fixed it.

What we test

Authentication. Login, registration, password reset, MFA and SSO flows, including account takeover through weak reset or enumeration.
Session management. Token generation, expiry, fixation, and how sessions behave across devices and logout.
Access control. Whether one user can read or change another user’s data (insecure direct object references), and whether ordinary users can reach admin functions.
Injection. SQL, command, template and other injection, cross-site scripting, and server-side request forgery.
Business logic. Workflows that can be skipped, repeated or reordered to gain something: discounts applied twice, limits bypassed, approvals avoided.
Third-party components. Outdated libraries, plugins and integrations with known vulnerabilities.
Configuration. Security headers, error messages that leak detail, exposed admin panels and default credentials.

How an engagement runs

Scope and quote. You tell us about the application and share any documentation. We scope the engagement and give you an estimate.
Testing. Our team tests manually, supported by purpose-built tooling. Every finding is documented with a severity rating, proof of concept and remediation guidance.
Remediation check. Once you have fixed the issues, we retest to confirm they are resolved. One check is included in every engagement.
Final report. A report suitable for internal stakeholders, regulators or customers.

Web3 applications

If your web application is the front end of a dApp, we also test wallet connection, transaction construction and signing prompts. See dApp and front end penetration testing.