What this is
A manual penetration test of your web application: internet-banking portals, customer onboarding flows, admin consoles, e-government services, and the browser-facing side of any platform that handles money or personal data. We map every role and function, then work through authentication, access control, session handling, input validation, and the business logic that connects them, the way an attacker would. Web testing is also available as one track inside a wider engagement: see our penetration testing service for the full web, network, mobile, API, and cloud scope.
Methodology
Testing follows the OWASP Web Security Testing Guide (WSTG), with findings mapped to the OWASP Top 10 and the engagement run along PTES phases from pre-engagement scoping through exploitation to reporting. Every test is executed by hand:
- Mapping and recon: full application crawl, hidden and legacy routes, parameter discovery, and the technology stack behind the application
- Authentication and session management: password and MFA flows, reset logic, token and cookie handling, and session fixation and replay
- Access control: every function crossed with every role and foreign object references, to surface horizontal and vertical privilege escalation
- Input handling: injection classes from SQL injection and cross-site scripting to server-side request forgery and file upload abuse
- Business logic: workflow bypasses, race conditions, and the transaction-level flaws no signature database describes
A scanner finds missing patches; it does not find a transfer flow that skips its approval step. Every finding is demonstrated with reproducible proof-of-concept evidence, not flagged from a scanner signature.
Who this is for
- Banks and microfinance institutions: internet-banking portals, staff and back-office consoles, and customer self-service channels
- Fintech and payment providers: merchant dashboards, onboarding flows, and wallet front ends; our primer on fintech security basics in Rwanda covers where these platforms typically fail first
- Government agencies and ministries: e-government portals and the citizen-facing services that hold national-scale personal data
- Regulated organisations Africa-wide: healthcare, telecom, and any institution whose web applications sit inside a supervisory or audit scope
For institutions supervised by the National Bank of Rwanda, the engagement supplies the technical evidence the annual testing requirement in BNR Regulation N°50/2022 expects: see our BNR-compliant penetration testing service. Testing is led by an OSCP-credentialled practitioner whose engagement history spans a Tier-1 Nordic bank red team, a pan-African banking group, and a top-5 South African bank.
Deliverables
- Evidence-led report: executive summary, technical findings mapped to OWASP Top 10 categories, proof-of-concept evidence, and CVSS v3.1 ratings
- Prioritised remediation guidance: concrete fixes at the code and configuration level, ordered by exploitability and business impact
- Live debrief: a walkthrough with your engineering team so findings are understood, not just received
- Free retest: verification of remediated findings with a clean retest report for your auditor, partner bank, or regulator
Frequently asked questions
What does a web application penetration test cover?
How is manual testing different from a vulnerability scan?
What access do you need to test our web application?
Do you test applications in production?
Does this satisfy regulatory testing requirements in Rwanda?
How much does a web application penetration test cost in Rwanda?
For the full scope of our manual testing across web, network, mobile, API, and cloud, see our penetration testing service, or read the cornerstone guide to penetration testing in Rwanda.
Shipping a web application that handles money or personal data?
Tell us the application, roles, and timeline. We reply within 24 hours, and a scoped proposal follows within 48 hours of the scoping call.