Identity and access
Sign-in, password recovery, session handling and privilege boundaries.
Can one account reach another customer’s data?
Web application penetration testing in Australia
Authenticated testing of SaaS products and web applications across your agreed roles.
From A$7,500 ex GST for one web app, its API and two user roles.
Manually verified findings.
- OSCP-certified testers
- Written testing boundaries
- Actionable remediation
Sorami runs authenticated web application penetration testing for Australian SaaS and web teams. Testers work through each agreed role to find access, tenant separation and business logic flaws. One web app with its API and two user roles starts from A$7,500 ex GST. That covers five testing days, the report and a retest of critical and high findings.
What we test
A scope with a purpose.
Tenant and data separation
Object access, exports and file handling between customer accounts.
Business logic
Approval steps, pricing and account changes that should not be bypassed.
Method, timeline and Australian context
Testing follows the OWASP Web Security Testing Guide. It runs unauthenticated first, then in each agreed role. The published scope is five testing days. Dates are agreed after we review scope and access readiness.
A test gives evidence for a customer review or ISO 27001 and SOC 2 readiness. It is not certification. If the application holds personal information, read the Privacy Act Tranche 2 breach notice guide. Draft your boundaries with the penetration test scope builder.
What we need from you
- Application URLs and the workflows that matter.
- A role matrix plus test accounts within and across tenants.
- Connected APIs named explicitly, not assumed.
What you can act on
- Prioritised application risk by role and workflow.
- Request or browser evidence for each finding.
- A practical remediation direction your engineers can follow.
Reporting and retest terms are agreed in writing. The record separates verified fixes from outstanding work.
Limits matter
What this test does not cover
- Third-party services and source-code review.
- Denial of service.
- Every connected API. Include them deliberately.
- Production access without written authorisation.
The deliverable
See what you will receive
A 19-page illustrative report built from synthetic findings, not a client report. It shows scope, evidence, severity rationale and the retest record.
Questions before you book
Practical answers.
What does a web application penetration test cover?
Sign-in, sessions and password recovery. Access between roles and between customer accounts. The business logic in the workflows you name. Connected APIs are included only when named in the scope.
Is staging enough?
A representative staging environment reduces operational risk. We record any difference from production because that difference limits what the result establishes.
What does a penetration test cost?
From A$7,500 ex GST for one web application with its API and two user roles. That covers five testing days, the report and a retest of critical and high findings. More applications, endpoints or cloud accounts give an indicative range. The price is fixed once scope is agreed, in writing, before work starts.
How long will it take?
Testing effort and elapsed delivery time are different. We agree both after reviewing the scope, access readiness and your deadline. Leave time for remediation and a focused retest.
Are you a CREST member company?
No. Sorami Consulting Pty Ltd is not a CREST member company. Our testers hold individual CREST Registered Tester certification, and we will confirm that position in writing for your procurement file.
Ready to price your test?
The sample report is illustrative, built from synthetic findings. It is not a client report.
Last reviewed: