Web Application Penetration Testing in Australia
Siege Cyber is a CREST accredited Australian penetration testing company. We test web applications, APIs and mobile apps for Australian software companies, SaaS platforms and any business with a customer portal sitting behind a login.
A web application penetration testing service is not a vulnerability scan with a logo on it. It is a tester working through your application by hand, with credentials, trying to do things your application was never meant to let them do. The fixed price is agreed before anything starts, and a retest after you have fixed the findings is included.
Siege Cyber is accredited by CREST. The accreditation is assessed and held at company level rather than borrowed from an individual tester’s certificate, and every web application and mobile application test on this page is delivered by CREST accredited testers.
What web application penetration testing covers
Scanners find known issues in known software. The findings that matter in a web app are usually logic problems that only appear when someone holds two accounts open at once and starts swapping identifiers between them. That is what the testing is for.
| Area tested | What we are looking for |
|---|---|
| Authentication | Password and session handling, multi-factor bypasses, token expiry, account lockout, password reset flows that can be abused |
| Authorisation | Whether one user can reach another user’s data by changing an identifier, and whether a standard user can perform an admin action |
| Business logic | Steps skipped in a workflow, prices or quantities altered in transit, limits that are enforced in the browser but not on the server |
| Injection and input handling | SQL injection, cross-site scripting, template injection, file upload handling and server-side request forgery |
| APIs behind the application | Endpoints that are not exposed in the interface, object level authorisation, rate limiting and mass assignment |
| Configuration | Security headers, cookie flags, exposed debug endpoints, verbose errors, default credentials on supporting services |
Testing follows the OWASP Web Security Testing Guide and the OWASP Top 10, with mobile work mapped to the OWASP Mobile Application Security Verification Standard.
Web application testing and mobile app testing are different jobs
They get bundled together in conversation, but the work is not the same. If you have both a web platform and an app, they are scoped and quoted separately.
| Web application | Mobile application | |
|---|---|---|
| Where the code runs | On your server, which you control | On a device you do not control, which the user can root or jailbreak |
| Main risks | Authorisation flaws, injection, session handling | Data stored unencrypted on the device, hardcoded secrets, weak certificate pinning |
| What gets tested | The application and the APIs behind it | The compiled app on iOS and Android, plus the same backend APIs |
| Typical driver | A customer security review or a compliance requirement | An app store release, or an enterprise customer asking before they roll it out |
Mobile app penetration testing usually turns up the same backend problems as the web test, plus a set of device-side issues that only exist because the code is sitting on someone else’s phone.
What a web application penetration test costs
We publish our prices. Most Australian providers will not, which makes comparing quotes harder than it needs to be. The ranges below are the ones we actually quote to, and the full penetration testing price list covers every other test type.
| Test type | Price range (ex GST) | What drives the number |
|---|---|---|
| Basic website | $3,400 to $6,500 | A brochure or marketing site with no login and little custom code |
| Web application and API | $5,900 to $16,500 | Number of user roles, number of distinct user journeys, how much of the platform is custom |
| Mobile application | $5,900 to $16,500 | One platform or both, whether the backend is in scope, and how much sensitive data the app stores locally |
All prices exclude GST. Every engagement is quoted at a fixed price before it starts, so the number on the proposal is the number you pay, and the retest after remediation is included rather than billed separately.
Where the full numbers live. Every test type and price range is set out on the penetration testing pricing page, and the wider service, including internal network, external network and red team work, is covered on our penetration testing services page.
Authenticated testing is where the findings are
Testing an application as an anonymous visitor tells you very little. Almost nothing interesting is reachable before you log in. The findings that end up at the top of the report come from testing as an admin, as a standard user and as a customer, and then checking whether one of those can reach another one’s data.
That means we need credentials for every role in the application before testing starts. Providing three sets of logins instead of one changes what the test is worth far more than it changes what it costs.
What you get
| What you get | What that means in practice |
|---|---|
| CREST accredited testers | The accreditation is assessed and held at company level, not borrowed from an individual |
| Manual testing | Testers working through the application by hand, with automated tooling used for coverage rather than for findings |
| Findings ranked by business impact | Ranked by what an attacker could actually do with them, not by a raw scanner severity score |
| A report two audiences can use | An executive summary your board or your customer can read, and a technical section your developers can act on |
| A free retest | Run once you have fixed the findings, so you finish with a clean report rather than a list of problems |
| A debrief call | We walk your engineering team through the findings and the fixes |
How a test is scoped
| Step | What happens |
|---|---|
| 1. A short conversation | Thirty minutes to understand what the application does, how many roles it has and why you are testing it now |
| 2. A scoping document | Exactly what is in scope, what is out, and what the price assumes |
| 3. A fixed-price proposal | One number, inclusive of reporting and the retest |
| 4. Credentials and dates | You provide a login per role and we agree dates that suit your release calendar |
When Australian software companies test
Three triggers account for most of the penetration testing we do on web applications. An enterprise customer has asked for a recent penetration test as part of their vendor review. A compliance framework expects one, which is the case for ISO 27001 and for SOC 2. Or the platform has changed enough since the last test that the last report no longer describes the thing that is running.
If you are heading into ISO 27001 or SOC 2, the test is included in our compliance packages rather than bought separately.
Common questions about web application penetration testing in Australia
How much does web application penetration testing cost in Australia?
Between $5,900 and $16,500 excluding GST for most web applications and APIs. A small brochure site with no login sits lower, between $3,400 and $6,500. The range is driven by the number of user roles and distinct user journeys rather than by the number of pages.
How long does a web application penetration test take?
Most run between three and ten working days of testing, with the report following shortly after. Scheduling is usually the longer lead time, so it is worth booking ahead of a customer deadline rather than after it.
Do you need credentials to test our application?
Yes, and ideally one set per user role. Unauthenticated testing only reaches the small part of the application that sits in front of the login, and the most serious findings in a web application are almost always authorisation problems that can only be found with an account.
Is a web application penetration test the same as a vulnerability scan?
No. A scan finds known issues in known software and takes minutes. A penetration test finds the chain of small problems a scanner cannot connect, including business logic flaws that are unique to your application. A scan is a reasonable thing to buy, but it should be bought knowingly.
Do you test mobile apps as well?
Yes. Mobile app penetration testing covers the compiled iOS and Android app and the APIs behind it, looking at local data storage, hardcoded secrets, certificate pinning and the same authorisation issues that affect the web platform.
Will a penetration test satisfy our ISO 27001 or SOC 2 requirement?
Yes. Both frameworks expect regular technical testing of systems in scope, and our reports are written so an auditor can see what was tested, what was found and what was fixed.
Get a fixed-price quote
Tell us what the application does and how many user roles it has, and we will come back with a fixed price and a scope you can hold us to.
Next step: Send us the details and we will quote it, or see the full penetration testing price list.