Extra web application

Another web application in the same audit

Do you have a customer portal, an internal dashboard or a second app besides your website? We add it to your audit and test it the same way: by hand, with real accounts and every fix verified.

Authenticated manual pentest of one additional web application (OWASP WSTG and ASVS): access control, session, business logic and injections, with a proof of concept per finding and review by a second Lop.

Duration: Adds about 1 week
Start: Together with the audit

from US$2,500

Added to Dig, Rabbit Hole or Warren. Retests: the same as the audit it is added to.

Add an app

Already signed the audit? You can add the app before we start.

It is for you if

Besides your website you have another app with its own login: customer portal, partner dashboard or booking system.
That app was built by another team or has its own code.
You are already doing Dig, Rabbit Hole or Warren and want it covered in the same audit.

What we check

That each user sees only their own data and nobody else’s.Horizontal and vertical access control (IDOR, privilege escalation) with accounts for each user type.

That nobody can get in with someone else’s account or hijack an open session.Authentication, password recovery, session and token handling.

That your business rules cannot be skipped: prices, coupons, limits, steps.Business logic: parameter tampering, race conditions and out-of-order flows.

That nobody can sneak code in through a form or an uploaded file.Injections (SQL, XSS, templates), file upload and SSRF.

How we work

With the scope
Scope
You tell us which app it is and give us 2 test accounts per user type.
The app goes into the same signed authorization; 2 accounts per role, up to 2 roles.
During the audit
Testing
We test it by hand like the rest. If something is serious, we tell you the same day.
Authenticated manual pentest; same-day notice for a critical finding.
At the end
Report
Its findings go in the same report, kept apart so you know what belongs to each app.
Its own section in the audit’s technical and executive reports.

What you get

That app’s findings, with what each one could cost you.
Findings with CVSS severity, proof of concept and impact in money.
How to fix each one, step by step.
Remediation per finding for your team or your vendor.
Every fix tested again.
Retests on the same terms as the audit.

See a sample report

Scope limits

Includes

1 app with its own login or its own code.1 additional web application (its own login or codebase).
Up to 2 user types (for example, customer and admin).Up to 2 authenticated roles.

Does not include

It is not sold on its own: it goes with Dig, Rabbit Hole or Warren.Audit module; not sold separately.
A subdomain with the same login and the same code is not an extra app: it is already in the audit.Same login and same codebase = same asset.
We do not fix the code: Lop Fix can do that.No remediation; available with Lop Fix.

More than 2 user types or a very large app? We give you a fixed price before signing.

Questions before you buy

How do I know if my app counts as extra?

If it has its own login or another team built it with other code, it counts. If it is part of the same site with the same login, it does not. If in doubt, we check together before signing.

Why can I not buy it on its own?

Because the audit already checks the server and the cloud where the app lives. On its own, the parts that break most would be left out. If you want to audit a single app, that is Dig.

Do you have more than one app?

Add it to your audit and get everything in one report, with every fix verified.