Web Application Penetration Test

We are launching a web application that handles user accounts, payments and uploaded documents, and before we open it to the public we want an independent security check. Our own developers have followed good practice, but they are close to the code and may have blind spots. We need a specialist to look at the application the way an attacker would and tell us honestly where it can be broken.

The scope is a basic penetration test of the web layer: authentication and session handling, access control between user roles, input validation, and the usual suspects such as injection, cross-site scripting, insecure direct object references and file-upload weaknesses. We can provide test accounts at different privilege levels and a staging copy so that nothing touches live customer data. We would also like a quick look at security headers, cookie flags and password-reset flows.

The most important deliverable is the report. We do not want a raw scanner dump; we want each finding described in plain language with its severity, a concrete example of how it is exploited, the potential impact, and a clear recommendation on how to fix it. A short executive summary for management and a technical section for developers would be ideal. Please tell us your methodology, roughly how long the work takes, and how you handle sensitive findings responsibly.