IPentest · scoped on a call
A penetration test of the application you already have.
manual · written scope within two working days · sample report public
You have a live or nearly-live web application — built by you, your team, an agency or a freelancer — and you need to know how it fails before someone else finds out.
Who this is for
Usually because someone asked for it in writing.
A customer, a partner or an investor wants to know the application has been tested, and “we ran a scanner” won't hold. You need findings a non-technical reader can act on, from a tester who can read your code and talk to your developers.
It's also for agencies and development teams who build well but don't test, and want a tester who works with their developers rather than around them.
What I test
Web applications and their APIs, by hand.
Tooling covers ground; it doesn't write the report. Every finding is reproduced by hand before it's written up. Mobile applications on request.
- 01Authentication and session managementSignup, login, reset, tokens, logout — and what happens when they're wrong.
- 02Access control across users, roles and tenantsWhether user A can read or change user B's data by changing an ID, a role or a request.
- 03Input handlingInjection, cross-site scripting, request forgery, unsafe file handling.
- 04Business-logic abuseThe flows a scanner can't see: prices, limits, states, sequences.
- 05CORS and cross-origin behaviourWhat another origin can read, send or trigger.
- 06Headers, transport, cookies and the deployment surfaceSecurity headers, TLS, cookie flags, information leakage, what the app exposes to the internet.
One finding, as you'd receive it
This is what a finding looks like.
From the sample report — a fictional target, the real format. Request, response, the line that gives it away, the severity, the fix.
- → GET /api/invoices/10422 Authorization: Bearer <customer A>
- ← 200 OK { id: 10422, customer: "A", total: "₹2,40,000", pdf: "/files/inv-10422.pdf" }
- → GET /api/invoices/10423 Authorization: Bearer <customer A> ← next id, same token
- ← 200 OK { id: 10423, customer: "B", total: "₹1,10,000", pdf: "/files/inv-10423.pdf" }
- The id is sequential and the server never checks who is asking. Every invoice on the platform is one number away.
- Severity: High (CVSS 7.5) · Broken object-level authorisation (OWASP API1)
- Fix: authorise on the server — invoice.ownerId === session.userId — and stop exposing sequential ids. Retested: fixed.
IIWhat you get
The format of the public 12-page sample at amansploit.com: an executive summary a non-technical reader can act on, then each finding with severity, impact, reproduction steps, evidence and a specific fix. A walkthrough call with your developers, and one retest of the fixes within 30 days, included.
A report you can act on. Then a call. Then a retest.
What I need from you
Authorisation, an environment, accounts.
- 01Written authorisationA rules-of-engagement document — there's a free template at amansploit.com.
- 02A test environment, or an agreed window on productionEither works; the scope says which.
- 03Test accounts at each roleAccess control can only be tested from every side of it.
- 04Source code, if you want a white-box testWhich finds more.
IIIScope, price and timeline
Every application is different. A 30-minute call to understand yours, then a written scope, price and timeline within two working days.
Scoped, not priced from a menu.
What this is not
Not a certificate, not a scan with a logo on it.
It isn't a compliance certificate, and I'll never call it one. It isn't a red-team exercise or a network test of your office. It isn't an automated scan — you can run those yourself for free, and I'll tell you when that's all you need.
Questions founders ask
Before you ask for a quote
How much does a penetration test cost?
Every application is different, so a test is scoped, not priced from a menu: a 30-minute call to understand the application, then a written scope, price and timeline within two working days.
What does the report look like?
The same format as the public 12-page sample at amansploit.com: an executive summary a non-technical reader can act on, then each finding with severity, impact, reproduction steps, evidence and a specific fix.
Is a retest included?
Yes. One retest of the fixes within 30 days of the report is included in every penetration test.
Is the testing manual or automated?
Manual. Tooling is used to cover ground, not to generate the report, and every finding is reproduced by hand before it is written up.
Do I need to give you source code?
Not necessarily. A white-box test with source access finds more; a grey-box test with test accounts at each role is also possible. The scope says which.
Is this a compliance certificate or a red-team exercise?
Neither. It is a manual test of a web application and its API — not a certificate, not a red-team exercise, not a network test of your office.
IVGet it scoped
Tell me what it is and who built it.
Written scope, price and timeline within two working days of the call.