Scope

ClickMasters conducts penetration testing for B2B companies across the USA, Europe, Canada, and Australia. Web application pen tests covering authentication bypass, injection, broken authorisation, and session management. API pen testing against REST and GraphQL endpoints. Cloud infrastructure pen testing AWS IAM privilege escalation, exposed services, misconfigured resources. Authenticated and unauthenticated testing scenarios. Detailed findings report with CVSS severity scores, proof-of-concept reproduction steps, and remediation guidance.

Penetration Testing Authorised Simulated Attack

Penetration testing (pen testing) is an authorised, simulated cyberattack on a system performed by a security professional to identify vulnerabilities that could be exploited by a real attacker. Unlike a security audit (which reviews code, configuration, and documentation), a pen test actively probes the running system: the tester attempts to bypass authentication, inject malicious data, escalate privileges, and access data they should not be able to access. The penetration tester documents every successfully exploited vulnerability with a proof-of-concept a specific set of steps that reproduce the finding. The deliverable is a findings report that ranks each vulnerability by severity (using CVSS scoring) and provides specific remediation guidance. Penetration tests must be explicitly authorised written rules of engagement define the scope, prohibited actions, and testing window before testing begins.

Black-Box vs Grey-Box vs White-Box Pen Testing

Black-box testing simulates an external attacker with no prior knowledge the tester starts with only the application URL, no credentials, no source code access. This tests what is visible from outside the perimeter but may miss vulnerabilities deep in authenticated functionality. Grey-box testing (most common for web application pen tests) provides the tester with user-level credentials for each role (regular user, admin, API key) but no source code access. This enables testing of authenticated functionality the majority of web application vulnerabilities require an authenticated user. White-box testing provides full access source code, architecture documentation, test credentials for all roles. The most thorough approach, but requires more time (the tester must review code as well as test the running application). ClickMasters conducts grey-box pen tests as the default sufficient to cover the OWASP Top 10 comprehensively at the most practical cost.

What this engagement delivers

Web Application Pen Testing

Black-box and grey-box web app pen testing: authentication testing (brute force resistance, account enumeration, session fixation, token predictability, insecure "remember me", MFA bypass), authorisation testing (IDOR can user A access user B's resources by modifying IDs?), injection testing (SQL injection manual + automated with SQLMap, XSS reflected/stored/DOM-based, SSTI, command injection), business logic testing (discount code abuse, premium feature access bypass, checkout manipulation), session management (token randomness, invalidation on logout, HttpOnly cookie protection).

REST & GraphQL API Pen Testing

API-specific penetration testing: authentication bypass (JWT algorithm confusion alg:none attack, weak secret brute force, expired token acceptance), GraphQL-specific attacks (introspection enabled in production exposes full schema, unbounded query depth DoS via deeply nested queries, batch query abuse many mutations in single request), mass assignment (API accepts unexpected fields that modify sensitive properties is_admin, price, balance), rate limiting bypass (per-IP limits bypassed with IP rotation, auth rate limits bypassed with different attack patterns), API versioning (deprecated versions still accessible with relaxed security controls).

Cloud Infrastructure Pen Testing

AWS pen testing within AWS's Penetration Testing Policy (EC2, RDS, Lambda, ECS, API Gateway, CloudFront, Lightsail, Aurora pre-approved; S3 bucket access testing, IAM privilege escalation): IAM privilege escalation (can low-privilege IAM role assume higher-privilege role through chain of allowed IAM actions Pacu for AWS attack simulation), metadata service abuse (SSRF leading to EC2 instance metadata access can attacker retrieve IAM credentials from metadata endpoint?), exposed services (any services listening on 0.0.0.0 that should only be accessible within VPC?), S3 bucket access testing (any S3 buckets publicly accessible that should not be?).

Findings Report & CVSS Scoring

Professional pen test deliverables: executive summary (non-technical overview overall security posture, number of critical/high/medium/low findings, business risk narrative), technical findings (per-vulnerability: CVSS 3.1 score, description, proof-of-concept reproduction steps, affected endpoint/system, impact statement, remediation recommendation), CVSS scoring (Common Vulnerability Scoring System base score considering attack vector, complexity, privileges required, user interaction, CIA impact), remediation verification (re-test of remediated findings confirm fixes are effective included as single re-test round within 30 days).

Compliance-Oriented Pen Testing

Pen tests structured for specific compliance frameworks: PCI DSS (annual pen test requirement for card data processors internal and external pen test, segmentation test, application and network layer), SOC 2 (pen test as evidence for CC6.1, CC6.8 control criteria authenticated app pen test, cloud infrastructure pen test), ISO 27001 (A.12.6 management of technical vulnerabilities pen test as evidence of vulnerability assessment programme), enterprise security questionnaires (pen test report as evidence for security questionnaire responses dated within 12 months, signed letter of attestation).

Process

Phase 1 · Week 1
Pen Test Scoping
Rules of Engagement (RoE): scope definition (systems, IP ranges, authentication levels), prohibited actions (no DoS attacks affecting production, no exfiltration of real customer data), testing window. Deliverable: Signed RoE + Test Plan.
Phase 2 · Week 1-2
Reconnaissance
Passive reconnaissance (DNS enumeration, WHOIS, subdomain discovery, technology fingerprinting), open-source intelligence (OSINT), automated scanning (Burp/ZAP spider, directory fuzzing). Deliverable: Asset Invententory + Attack Surface Map.
Phase 3 · Week 2-3
Active Testing & Exploitation
Authentication bypass, authorisation (IDOR), injection (SQL/XSS/SSTI/command), business logic abuse, API-specific attacks (GraphQL introspection, mass assignment), privilege escalation, attack chaining, data exfiltration simulation. Deliverable: Exploitation Proof-of-Concepts.
Phase 4 · Week 3-4
Reporting & Review
Executive summary, technical findings (CVSS scores, PoC, impact, remediation), risk matrix, attack narrative. One-hour review session. Deliverable: Full Pen Test Report.
Phase 5 · Week 4-5
Remediation Support & Re-Test
Remediation guidance clarification, re-test of critical/high findings after fixes, verification report. Deliverable: Re-Test Verification Report.

Tech stack

Web App Testing: Burp Suite Professional, OWASP ZAP, Nikto, SQLmap, Hydra, ffuf, Metasploit
API Testing: GraphQL introspection (query validation), Postman (automated tests), custom JWT tools, Burp Suite for REST/GraphQL
Cloud Testing: Pacu (AWS exploitation IAM priv-esc), AWS CLI, SSRF detection, S3 bucket enumeration, Metadata API exploitation
Reporting: CVSS 3.1 scoring, custom finding templates, screenshot/evidence management, re-test tracking

How we work

Rules of Engagement Amber Callout

Written RoE required before testing scope, prohibited actions (no DoS), testing window | Basic: No RoE (legal risk)

GraphQL Introspection Attack

Check if introspection enabled in production exposes full schema to attackers | Basic: Generic API testing only

alg:none JWT Attack

Test JWT algorithm confusion alg:none attack, weak secret brute force | Basic: JWT presence check only

Metadata Service SSRF

Test SSRF leading to EC2 instance metadata access IAM credential theft | Basic: No cloud-specific testing

Pacu for AWS Attack Simulation

IAM privilege escalation chain testing low priv to high priv through allowed actions | Basic: Manual IAM review only

Where this is used

Enterprise Deal Pen Test

Fortune 500 customer requires pen test report. Full web app + API pen test. Report delivered in 3 weeks. Deal closed.

PCI DSS Annual Requirement

E-commerce platform processing card data. PCI DSS annual pen test: internal + external, segmentation, application layer. SAQ-A completion.

API-First SaaS Product

GraphQL API-only product. API pen test: introspection disabled, depth limiting, rate limiting, mass assignment protection. Clean report.

Cloud-Native Vulnerabilities

ECS + RDS on AWS. Cloud pen test: IAM privilege escalation, metadata API SSRF, exposed services. Critical findings fixed.

Pricing guidance

These ranges are planning anchors. The quote names scope, timeline, and what is excluded. Talk through a quote.

Web App Pen Test (Small scope)

$5,000 - $12,000

1 - 2 weeks

Up to 10 authenticated flows, OWASP coverage, CVSS report, re-test

Web App Pen Test (Full scope)

$8,000 - $20,000

2 - 3 weeks

Full application, all roles, all flows, CVSS, exec + tech report, re-test

API Pen Test (REST or GraphQL)

$5,000 - $14,000

1 - 2 weeks

Auth bypass, injection, mass assignment, rate limits, CVSS, re-test

Cloud Pen Test (AWS)

$6,000 - $16,000

1 - 2 weeks

IAM priv-esc, metadata, exposed services, S3, CVSS, remediation

Combined Web + API + Cloud

$12,000 - $30,000

3 - 4 weeks

Full coverage, exec + tech report, re-test, compliance letter

PCI DSS Annual Pen Test

$8,000 - $20,000

2 - 3 weeks

Internal + external, segmentation test, PCI DSS finding format

Pen Test + Remediation Support

$15,000 - $35,000

4 - 6 weeks

Pen test + engineering remediation of critical and high findings

FAQs

What is penetration testing?

How often should a penetration test be conducted?

Annual penetration testing is the standard cadence for most B2B companies required by PCI DSS (at least annually), recommended by SOC 2 auditors, and requested by enterprise procurement security questionnaires. Additional pen tests should be triggered by: significant changes to the application (new authentication system, new payment flow, major API version), major infrastructure changes (migration to a new cloud provider or architecture), post-incident (after a security incident, to assess whether similar vulnerabilities exist elsewhere), and pre-launch (for new products before public release). A pen test report dated more than 12 months ago is typically rejected by enterprise security teams annual testing maintains the currency required for sales.

What is the difference between black-box, grey-box, and white-box pen testing?

What does a penetration test report include?

A ClickMasters penetration test report includes: executive summary (one-page non-technical overview overall security risk rating, count of findings by severity, top three most critical findings in plain language suitable for board and investor review), scope and methodology (tested systems, testing dates, testing approach, tools used SQLMap, Burp Suite Pro, Metasploit for cloud, Pacu for AWS), findings (each finding: CVSS 3.1 base score, vulnerability name, affected system/endpoint, description of the vulnerability, proof-of-concept reproduction steps, evidence screenshots, impact assessment, remediation recommendation), risk summary matrix (all findings visualised by severity and ease of exploitation), and attestation letter (signed letter confirming the pen test was conducted and the overall risk rating suitable for enterprise security questionnaire attachment). Re-testing of remediated critical and high findings is included within 30 days.

Penetration Testing

Built to move from idea to production.