FR 514 918-3381 Free quote
ServicesCybersecurityCitiesIndustriesGuidesToolsaltea.io storeCall : 514 918-3381Free quote
Web application penetration testing

Web application and API penetration testing

Customer portal, online store, SaaS app or API: we look for the flaws an attacker would exploit, before they do.

Free quote 514 918-3381
  • 15+ years’ experience
  • Across Quebec
  • Free quote
  • Bilingual service
The service

Web application and API penetration testing

Web applications are a company’s most exposed entry point. Altea tests your applications and APIs the way an attacker would: authentication, session handling, access control between users, injection, business logic, file uploads, server configuration. Testing follows the OWASP Web Security Testing Guide (WSTG) and the OWASP Top 10, with manual verification of every finding — not just an automated scanner report.

What we install

  • Authenticated testing with several user roles
  • Access control: can one customer see another’s data?
  • Injection (SQL, command, template), XSS, SSRF
  • Business logic: prices, quantities, skipped steps
  • REST and GraphQL API security
  • File uploads and document processing
  • Headers, TLS, cookies and server configuration
  • Report with evidence, risk and fix, then retest
Process

How a project runs

  1. Scoping call: applications, roles, test environment
  2. Test accounts and rules of engagement
  3. Manual and tool-assisted testing
  4. Report: verified findings, risk, fix
  5. Retest of fixes
Free tool

Take the cybersecurity self-assessment

Open the calculator

Further reading

SAST, DAST or manual code review?Three ways to look for application flaws. Each sees things the others…The OWASP Top 10, explained simplyThe OWASP Top 10 is the reference list of web application risks. Here is what each category means, in plain…Preparing a penetration test: the checklistA well-prepared test costs less and finds more. Here is what to decide and gather before day…How to read a penetration test reportSummary, risk levels, CVSS scores, evidence, fixes: how to navigate it and what to fix…
Cybersecurity

All our cybersecurity services

Firewall and cybersecurityA well-configured firewall, a segmented network, secure remote access and filtering: the basics that stop most attacks.Network auditIs your network slow, dropping or too expensive? We measure before concluding, then fix it.Penetration testingWe attack your network the way an intruder would, within a scope agreed with you, and hand you a prioritized fix plan.External penetration testingFirewall, VPN, email, websites, remote access: we map everything your company exposes online and check that nothing gives way.Internal penetration testingIf a computer is compromised or a visitor plugs in a device, how far can they go? We measure it, from the network up to the domain controller.Wi-Fi penetration testingWi-Fi spills into the parking lot. We check that an intruder outside can’t connect or hop from the guest network to the internal one.Secure code reviewWe read your code to find what outside testing can’t see: secrets, logic flaws, vulnerable dependencies and forgotten access checks.Social engineering and phishing simulationMost attacks start with an email or a call. We measure how your teams react, without shaming anyone, then train them.Vulnerability scanningRegular scanning of your computers, servers and devices to know what isn’t patched, with a prioritized list — not 3,000 alerts.Security configuration reviewMisconfigurations cause as many incidents as vulnerabilities. We review your critical settings against recognized good practice.Physical security assessmentDoors, cards, keys, cameras, server room: we check whether someone can get in where they shouldn’t, and tell you how to stop them.

Other services

Access controlBuilding intercomVideo surveillanceBusiness network and Wi-FiMulti-site network
FAQ

Frequently asked questions

Do you test in production?

Preferably on an identical staging environment. If that isn’t possible, we test production with careful rules and agreed time windows.

How long does a web app test take?

It depends on the number of pages, roles and APIs. Scope is set in a free scoping call and written into the quote.

Do you test mobile apps?

We test the APIs mobile apps rely on; analysis of the app itself can be added to the engagement as needed.

Do we get an attestation?

Yes, besides the report, an attestation letter summarizes the scope and test date, useful for your customers or insurer.

Planning web application penetration testing?

Describe your situation in a few lines; an engineer will call you back quickly. The site visit and quote are free.

Free quote 514 918-3381
Quote

Request a quote

Free, no obligation. A quick answer from an engineer, in English or French.

Call514 918-3381Email[email protected]
  • Free site visit and quote
  • An engineer, not a salesperson
  • 15+ years’ experience, across Quebec
  • Hardware stocked on altea.io

Your details are only used to reply to you.

Updated 2026-11-05

CallQuote