Web Application Penetration Testing: a sample report

The application was tested from two perspectives: without an account, as an anonymous visitor, and authenticated with a session of the engagement’s own. The interactively reachable surface was mapped from a recorded browsing session; the API surface was tested live against the running target. The method follows the OWASP Top 10:2025, and every finding is mapped to the OWASP Application Security Verification Standard (ASVS) 5.0 requirement it fails.

Fourteen findings are set out in full, five High, five Medium and four Low. The five High findings share one root cause, which the report names: the API authenticates a token but does not authorise the object it returns, so records outside the caller’s scope are readable by changing an identifier, a document’s author can be forged, and the permission menu follows a header the client supplies. Each finding has a technical page with the affected routes, a radar of business impact, exploitability and effort, a risk score and prioritised remediation; the High findings also carry a proof-of-concept page with the request as sent, the response, and the coverage measured, with values masked.

Around the findings sit the pages a reader uses to decide: an executive summary that names the single change carrying most of the gain, a risk matrix that plots severity against the effort to fix, a maturity position, a vulnerabilities overview and an exploitability overview that states what was executed to confirm each finding and what was left untouched. All object-level tests were read-only; the single write test created a clearly named artefact that was removed afterwards.

In this edition the client, the application name, the hosts, an internal path, an account name and two personal values are withheld; routes, identifiers, counts and ratings are as delivered. This is the shape of every application and API test N30 delivers: findings ranked by what to fix first, evidence a developer can replay, and a retest included.

What is inside

• Executive summary with the overall rating and the one change that carries most of the gain
• Cybersecurity maturity position and scope and methodology (OWASP Top 10:2025, ASVS 5.0)
• Risk matrix: severity against effort to remediate
• Testing phases and findings overview (5 High, 5 Medium, 4 Low)
• 14 finding pages with routes, radar, risk score and prioritised remediation
• Proof-of-concept pages for the High findings: the request, the response, the coverage
• Vulnerabilities and exploitability overviews

For product and security leads who want to see what a penetration test of a web application and its API returns.