An online furniture retailer in Montreal. An insurance brokerage on the South Shore whose clients upload bank statements through a portal. A property management company in Ottawa with a tenant portal for rent payments and maintenance requests. Three businesses with one thing in common: their web application has become their main front door.
That door is open around the clock to the entire internet. Firewalls and antivirus protect your laptops and servers, but they can't see that a customer is able to view someone else's file by changing a number in the address bar.
That's what a web application penetration test is for. And when people talk about it, they all use the same reference point: the OWASP Top 10, whose 2025 edition is the latest.
TL;DR
- A web application pentest checks what an attacker can do inside your application: take over accounts, reach other customers' data, tamper with payments.
- The OWASP Top 10 2025 lists ten major risk categories; broken access control is still number one.
- The Top 10 is a floor, not a ceiling: a good test also covers the business logic unique to your application.
- On price, Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope.
What a web application pentest checks
The tester takes on the role of several kinds of users: an anonymous visitor, a logged-in customer, an employee and an administrator. For each one, the question is the same: what can I do that I shouldn't be able to?
In practice, that means examining authentication (login, password reset, sessions), authorization between accounts, forms and file uploads, the APIs used by your mobile app or partners, and server configuration.
Most web tests are done grey box: you provide test accounts for each role. That's more efficient than testing blind, because the most serious flaws usually sit behind the login screen. Like any penetration test, it requires written authorization (Criminal Code, s. 342.1) and, if a third party hosts your application, compliance with its terms.
The OWASP Top 10 2025 in plain language
OWASP is a non-profit foundation that publishes open resources on application security. Its Top 10 is an awareness document, updated periodically from real-world data and a community survey. The 2025 edition is the eighth. It adds two new categories (software supply chain and exceptional conditions) and folds server-side request forgery (SSRF) into broken access control.
Here's what each category means for a small or mid-sized business:
| # | OWASP 2025 category | Real-world example |
|---|---|---|
| A01 | Broken Access Control | A customer views another customer's invoice by editing the number in the URL |
| A02 | Security Misconfiguration | Admin page reachable from the internet, public cloud storage bucket |
| A03 | Software Supply Chain Failures | Abandoned WordPress plugin, compromised JavaScript library |
| A04 | Cryptographic Failures | Poorly protected passwords in the database, outdated encryption |
| A05 | Injection | A search field that lets someone query the database directly |
| A06 | Insecure Design | A promo code that works an unlimited number of times, no limit on attempts |
| A07 | Authentication Failures | No MFA for administrators, sessions that never expire |
| A08 | Software or Data Integrity Failures | Updates or data accepted without verifying where they came from |
| A09 | Security Logging and Alerting Failures | Thousands of failed logins, and nobody gets an alert |
| A10 | Mishandling of Exceptional Conditions | An error page reveals server internals, or a payment check "fails open" |
It's no accident that broken access control has held the top spot since the 2021 edition. It's widespread, hard to detect with automated tools and among the most damaging flaws when personal information is involved.
Beyond the Top 10: business logic
A vendor promising to "test the OWASP Top 10" isn't telling you much. The costliest flaws are often specific to your application: ordering a negative quantity to generate a credit, skipping the payment step by calling the confirmation page directly, approving your own refund request.
No scanner finds problems like these. It takes someone who understands your business process. That's why serious testers follow a complete methodology, such as OWASP's Web Security Testing Guide (WSTG), and treat the Top 10 as a minimum. If you're weighing a scan against a real test, our article on security audits vs pentests vs vulnerability scans will help you decide.
How the test runs
- Scoping: list of URLs, roles, APIs and exclusions, choice of environment and signed authorization.
- Reconnaissance: mapping the application, its technologies and the third-party components it relies on.
- Manual and automated testing: every Top 10 category, then business logic, role by role.
- Immediate escalation of critical findings: the tester alerts you right away instead of waiting for the report, so you can start fixing before testing even ends.
- Report and debrief, followed by a retest once fixes are deployed.
Depending on the size of the application, the testing phase lasts from a few days to a few weeks. Make sure your developers are available to answer questions, especially early on.
Getting your application ready
Good preparation lets testers spend their time on vulnerabilities, not on access problems. Before kickoff:
- A staging environment as close to production as possible
- At least two test accounts per role, to confirm one customer can't see another's data
- Dummy data only, never real customer personal information
- Written authorization signed by someone with authority, plus the host's approval if required
- A list of critical functions: payments, uploads, password reset, data exports
- API documentation, if you have APIs
- A technical contact reachable for the entire test window
- A recent backup of the environment being tested
- A freeze on major deployments during the test
Budget, report and retest
Canadian vendors publish very wide ranges for penetration tests, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026). For a web application, the number of roles, features and API endpoints moves the price, as does whether a retest is included. These are indicative benchmarks; we cover the other factors in our article on penetration testing cost.
The report rates each finding by severity, with steps to reproduce it and a fix recommendation for your developers. Our guide on how to read a penetration test report explains how to turn it into a work plan.
One more point for Quebec organizations: Law 25 requires a privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3). A new customer portal fits that description, and a penetration test is useful evidence of the security measures documented in your PIA. Confirm the scope of your obligations with your legal counsel.
Our team performs grey-box web application penetration testing covering the full OWASP Top 10 and the business logic of your application.
Frequently asked questions
Should we test in production or in a staging environment?+
Ideally in a staging environment that mirrors production, so that your customers and real data are never affected. Some items, such as web server or web application firewall configuration, still need to be checked in production, with precautions agreed in advance.
Does our Shopify or WordPress site need a penetration test?+
On a hosted platform like Shopify, the provider secures the platform itself; your risk lies in installed apps, admin accounts and integrations. A WordPress brochure site with no custom features usually needs hardening and regular scans rather than a full test. A penetration test becomes worthwhile once you have customer accounts, payments or custom development.
Is there an "OWASP compliant" certification?+
No. OWASP doesn't certify applications or vendors. The Top 10 is an awareness document; for verifiable requirements, OWASP publishes the Application Security Verification Standard (ASVS), which defines three levels of rigour based on how sensitive the application is.
Sources
- 1.OWASP Top 10:2025
- 2.OWASP Web Security Testing Guide (WSTG)
- 3.OWASP Application Security Verification Standard (ASVS)
- 4.Packetlabs: Guide to the average cost of a pentest in Canada (August 2026)
- 5.Criminal Code, s. 342.1: Unauthorized use of computer
- 6.Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)