Website and Web Application Penetration Testing

A penetration testing service, or pentest, is security testing in which a tester manually tries to break into a system, within a scope and written permission agreed first. The goal is to prove what can happen if a weakness is exploited. Legia runs it for websites and web applications, complete with a report and a retest after fixes.

The basis is the number and size of websites tested, the testing method chosen, and the number of user roles tested. A retest after fixes is included in the package. Legia gives the details after the scope and method are agreed in the consultation.

The whole process generally takes 3 to 6 weeks: setting scope and permission, information gathering, testing, report writing, then retest. The testing itself takes 5 to 10 business days, and the retest schedule follows when fixes are completed on your side.

Vulnerability assessment maps weaknesses as broadly as possible without exploiting them. Penetration testing tests manually by actually trying to break in, to prove the real impact of specific weaknesses. Some audit requirements ask for both.

For most needs, grey box is the most sensible starting point because the tester is given an ordinary user account, so weaknesses in access rights can be found. Black box is chosen when you want to resemble a real attacker's situation, and white box when the system handles sensitive data.

Legia's report contains the attack path, reproduction steps, severity based on CVSS, and retest results, so it can be attached as evidence that testing was done and the weaknesses were closed. Each auditor's requirements differ, so share the requirements you received in the consultation so the fit is confirmed before testing starts.

Your team can fix them using the reproduction steps and remediation advice in the report. If you prefer to hand it off, Legia does the fixes through the Website Maintenance or Server Installation & Management service, billed separately from the testing. The retest is still included, whoever does the fixing.

Testing only starts after a written permission letter from the system owner stating the scope, schedule, and limits, including a ban on testing meant to make the system unavailable. Testing is scheduled outside busy hours, and you receive an emergency contact who can stop it at any time. For very critical systems, testing can be done on a copy environment.

Some cloud and hosting providers require notice or permission before security testing is done. Legia checks your provider's terms and arranges the permission with you at the scoping stage.

Legia signs a confidentiality agreement before testing starts. The report is handed over through an encrypted channel only to recipients you name, and Legia does not keep copies beyond the period agreed in the contract.

Audit requirements generally ask for testing once a year. Beyond that, testing is best done before a major release and after fundamental changes to the system. Legia offers periodic testing contracts with a schedule agreed upfront, for example once a year plus testing before a major release.

At present, Legia's penetration testing focuses on websites and web applications, including the APIs they use. If your need is outside that, Legia says so from the start so you do not lose time.

Yes. Simulations such as phishing aimed at employees can be added to the testing. They are only run with separate written approval from company leadership, and are billed separately from website testing.

Not yet. Legia provides penetration testing with an agreed scope, not an ongoing full attack simulation. If you need a red team, Legia says so from the start so you do not lose time.