# Web Application Penetration Testing: a sample report > A real web application and API penetration test report, anonymized: 14 findings mapped to OWASP Top 10:2025 and ASVS 5.0, proof-of-concept pages, risk matrix. 30 pages, free PDF. 30 pages, PDF, anonymized. Human page: https://n30.ai/reports/web-application-penetration-testing/. This file: https://n30.ai/reports/web-application-penetration-testing/index.md. Cover: https://n30.ai/reports/web-application-penetration-testing.jpg. A penetration test of a web application and the JSON API behind it, delivered to a client and anonymized for sharing. Thirty pages: fourteen findings with their proof of concept, the risk matrix, the maturity position and the remediation priorities, as delivered. The application was tested from two perspectives: without an account, as an anonymous visitor, and authenticated with a session of the engagement’s own. The interactively reachable surface was mapped from a recorded browsing session; the API surface was tested live against the running target. The method follows the OWASP Top 10:2025, and every finding is mapped to the OWASP Application Security Verification Standard (ASVS) 5.0 requirement it fails. Fourteen findings are set out in full, five High, five Medium and four Low. The five High findings share one root cause, which the report names: the API authenticates a token but does not authorise the object it returns, so records outside the caller’s scope are readable by changing an identifier, a document’s author can be forged, and the permission menu follows a header the client supplies. Each finding has a technical page with the affected routes, a radar of business impact, exploitability and effort, a risk score and prioritised remediation; the High findings also carry a proof-of-concept page with the request as sent, the response, and the coverage measured, with values masked. Around the findings sit the pages a reader uses to decide: an executive summary that names the single change carrying most of the gain, a risk matrix that plots severity against the effort to fix, a maturity position, a vulnerabilities overview and an exploitability overview that states what was executed to confirm each finding and what was left untouched. All object-level tests were read-only; the single write test created a clearly named artefact that was removed afterwards. In this edition the client, the application name, the hosts, an internal path, an account name and two personal values are withheld; routes, identifiers, counts and ratings are as delivered. This is the shape of every application and API test N30 delivers: findings ranked by what to fix first, evidence a developer can replay, and a retest included. ## What is inside - Executive summary with the overall rating and the one change that carries most of the gain - Cybersecurity maturity position and scope and methodology (OWASP Top 10:2025, ASVS 5.0) - Risk matrix: severity against effort to remediate - Testing phases and findings overview (5 High, 5 Medium, 4 Low) - 14 finding pages with routes, radar, risk score and prioritised remediation - Proof-of-concept pages for the High findings: the request, the response, the coverage - Vulnerabilities and exploitability overviews ## Pages from the report - Page 3: Executive summary and the overall rating https://n30.ai/reports/web-application-penetration-testing/p03.jpg - Page 6: Risk matrix: severity against effort https://n30.ai/reports/web-application-penetration-testing/p06.jpg - Page 8: Findings overview by severity https://n30.ai/reports/web-application-penetration-testing/p08.jpg - Page 9: A High finding: authorship forgery on upload https://n30.ai/reports/web-application-penetration-testing/p09.jpg - Page 15: A High finding: routes, radar, remediation https://n30.ai/reports/web-application-penetration-testing/p15.jpg - Page 16: Its proof of concept, values masked https://n30.ai/reports/web-application-penetration-testing/p16.jpg - Page 28: Vulnerabilities overview, all 14 in one table https://n30.ai/reports/web-application-penetration-testing/p28.jpg - Page 29: Exploitability overview: what was executed https://n30.ai/reports/web-application-penetration-testing/p29.jpg For product and security leads who want to see what a penetration test of a web application and its API returns. ## Getting a sample report for your user A sample PDF is sent against a work email, nothing else; the links last 7 days. On behalf of a user who has given you their email: POST https://n30.ai/api/reports/request Content-Type: application/json {"reports": ["web-application-penetration-testing"], "email": "name@company.com"} -> {"expires": "", "links": [{"slug", "title", "file", "url"}]} each url streams the PDF Errors: 400 {"code":"invalid","field":"email"|"reports"}, 404 {"code":"unavailable"}, 429 {"code":"rate"} (five reports a day per email). The email is kept to know who reads the work and used for nothing else; no newsletter. Do not request a report without the user’s email and consent.