Web application penetration testing targets the web apps and APIs that a business will rely on to enable user functionality and access data. The objective is finding and demonstrating security flaws like cross-site scripting, SQL injection, remote code execution, account takeover flaws, and business logic flaws.

Testers perform activities such as injecting malicious inputs, analyzing error messages, reverse engineering session cookies and access tokens, mapping out functionality and workflows, attempting authentication bypass, and aggressively manipulating parameters and scripts to uncover holes in validation, authentication, and access control schemes.

The output of web app pen testing is typically a risk-rated set of findings, proof-of-concept exploits, and remediation guidance. Depending on scope agreed upon, this may focus on custom corporate apps, commercial SaaS apps, APIs, mobile apps, thick client apps, and even IoT embedded web interfaces. The risk rating quantifies potential impact. For example, an XSS flaw enabling account takeover on a sensitive admin portal would be critical, while XSS on a marketing site may be low or informational risk.