Penetration testing for web and mobile applications
We test your application by hand, the way a capable hacker would. Our work concentrates on access control, business logic and API flaws that automated scanners miss, and every finding comes with exact reproduction steps, a practical fix and a free retest.
- Fixed quotation within one business day
- Mutual NDA before scoping
- Retest within 30 days included
Cross-tenant access to invoices through predictable IDs
Request sent as a user of Organisation B
GET /api/v2/invoices/inv_7Q2M9 HTTP/1.1 Host: app.example.com Authorization: Bearer <org B user token> HTTP/1.1 200 OK {"id":"inv_7Q2M9","org":"org_A","total":184500, …}
Recommendation
Scope every invoice query to the caller's organisation in the data-access layer, and return 404 for records outside it.
Our research record in numbers
- 1,200+
- vulnerabilities reported to product security teams since 2020
- 80+
- organisations have validated and resolved our reports
- 7.00
- HackerOne Signal over the last 90 days, in the 99th percentile of researchers Live from HackerOne
- Verify on HackerOne (opens in a new tab)
- Our public profile, with current statistics anyone can check
Our researchers have reported vulnerabilities to Google, Meta, Cloudflare, GitHub, Shopify, Okta and others through their disclosure programmes. These organisations are not our clients; we never name clients.
See the full recordSix services, each scoped and quoted on its own
Start with a single assessment or combine services into an ongoing programme. You get a fixed price once we understand what we are testing.
-
Web application penetration testing
Hands-on testing of your application and its APIs, signed in and signed out, focused on who can reach what and how workflows can be misused.
-
Pre-launch security review
A focused review before go-live: deployment, cloud configuration, secrets and CI/CD, while fixes are still cheap.
-
Attack-surface monitoring
Continuous discovery of the hosts, subdomains and exposed code you have on the internet, with alerts when it changes.
-
Mobile application assessment
Android testing that combines static analysis of the package, runtime instrumentation and testing of the API behind it.
-
Remediation support and retest
Help for your developers while fixes are written, then formal verification and a closure summary for your stakeholders.
-
Vulnerability disclosure support
Triage and reproduction of reports you receive from external researchers, with accurate severity and a coordinated response.
From first email to closure letter
-
Scoping
We agree targets, user roles, the test window and rules of engagement in writing. A mutual NDA is signed first, and you receive a fixed quotation.
-
Testing
Manual testing against the agreed scope, with tooling used to extend coverage. Critical issues are reported within 24 hours, without waiting for the report.
-
Reporting
Every finding is reproduced, rated P1 to P5, explained in terms of your business and paired with a fix for your stack. We walk your team through it.
-
Retest
Within 30 days of the report we verify each fix at no extra charge, and issue a closure summary you can share with customers or auditors.
A single web application with two or three user roles usually takes 5–7 business days of testing. A multi-service platform, or an Android app with a complex API, typically takes 10–14.
A report your engineers can act on
Automated scanners are useful, but they cannot reason about who should be allowed to do what in your application. That is usually where the serious issues are.
| Typical automated scan | HEBTECH assessment | |
|---|---|---|
| Access control and business logic | Largely out of reach | The main focus of our testing |
| False positives | Common; your team has to filter them out | Every finding is reproduced before it is reported |
| Reproduction steps | A generic description of the issue class | Exact HTTP requests, accounts and preconditions |
| Business impact | Boilerplate severity text | What an attacker gains, in your business's terms |
| Remediation | Links to general guidance | A fix for your framework and code |
| Urgent issues | Found whenever someone reads the output | P1 issues reported within 24 hours |
| Checking the fixes | Run the scan again yourself | Retest within 30 days, included in the price |
Where we test most often
The methodology stays the same. What changes is where the risk tends to concentrate.
- SaaS and B2B platformsTenant isolation and object-level authorisation
- Fintech and paymentsTransaction logic, limits and race conditions
- HealthtechRecord-level access control and data exports
- E-commerce and marketplacesPricing, coupons and payment callbacks
- Public sectorCitizen identity data and legacy exposure
- Mobile-first productsAndroid apps and the APIs behind them
Before you get in touch
How long does an engagement take?
It depends on scope. A single web application with two or three user roles usually takes 5–7 business days. A multi-service platform, or an Android app with a complex API, typically takes 10–14. You receive a confirmed timeline and a fixed quotation before testing starts.
Do you test production systems?
Only when you ask us to, and only with written authorisation, agreed testing windows and destructive tests excluded. Many clients prefer a staging or UAT environment seeded with representative data.
What do you need from us to start?
The scope (domains, IP ranges, app packages, or API documentation such as an OpenAPI file or Postman collection), test accounts for each role you want tested, a technical contact on your side, and signed authorisation. A mutual NDA is signed before scoping.
Will you name us as a client?
No. We do not publish client names, logos or results. We only give a client as a reference with their written consent.
What happens to our data afterwards?
Reports are delivered encrypted. Testing artefacts and logs are deleted from our systems once the 30-day retest window closes.
Tell us what needs testing
Send us your scope and what you need assurance on. You will get a written reply with our approach, a timeline and a fixed quotation, usually within one business day.
Or email enquiries@hebtech.in