Web penetration testing for websites, online shops and web applications
We find out what an attacker could reach on your site before someone else does. With written authorization, manual testing and a fixed fee; you get evidence-backed findings and clear remediation steps.
If your site handles data or earns money
Online shop
Customer accounts, orders, coupons, checkout and the admin interface.
Portal and SaaS
Multiple users and roles: can one customer see another customer's data?
Company website
WordPress or another CMS, plugins, forms and admin login.
Development agency
Independent testing before handover, with a report you can show your client.
What we test
Login and sessions
Password reset, brute-force protection, multi-factor authentication and session handling.
Permissions
Can an attacker reach another user's data or admin functions by changing a request?
Injection flaws
SQL injection, XSS, command injection and file upload abuse.
Business logic
Price, quantity, coupons and order steps: what an automated scanner does not understand.
Exposed files and settings
Backups, configuration files, admin interfaces, TLS and security headers.
APIs and integrations
Permissions of the APIs behind the site, data exposure and third-party services.
From first call to retest
A 30-minute call, then a written fixed-fee proposal.
NDA, agreement, exact addresses and time window, signed authorization. We do not start without it.
Manual testing supported by tools. Serious issues are reported immediately.
Executive summary, severity, evidence, reproduction steps and remediation advice.
After remediation we check the findings once; this is included in the fee.
Before we talk
Is an automated scanner enough?
It is useful for finding known issues quickly, but it rarely understands permission and business logic flaws. More: scanner or penetration test.
Can testing take the site down?
We do not deliberately load-test or damage data, but the risk is not zero. We prefer a test environment; on production we work in an agreed window with a named contact.
How long does it take?
For a small site, testing usually takes a few working days, followed by the report. The schedule is fixed once the scope is known.
What affects the price?
The number of functions and user roles, APIs, and whether we work on production or a test environment. The proposal is fixed-fee.
Do you work across Hungary?
Yes. Web testing can be done entirely online from anywhere in Hungary.
Can you test a hosted shop platform?
Your own settings and custom parts, yes. The provider's system can only be tested with its permission, which we clarify in advance.
A penetration test is a snapshot and does not guarantee there are no other flaws. It is a voluntary test, not a mandatory vulnerability assessment under Hungarian Act LXIX of 2024.
Request a proposal
Briefly describe the system you would like tested and the reason for the engagement: a partner or regulatory requirement, an audit, or a new system going live. We will get back to you within one business day.