Web Application
Penetration Testing Australia
CREST-certified ethical hackers attacking your web apps, APIs, AI integrations and cloud workloads the way real adversaries do. Built for Australian software vendors, government agencies, universities, healthcare providers, retailers and regulated industries not just banks.
64%
of Australian organisations faced a web-based attack in the last 12 months
$4.26M
average cost of a data breach in Australia in 2025 (IBM)
241 days
average time to identify and contain an application-layer breach
45%
of new application breaches in 2025 involved an AI or LLM-enabled feature
We partner with leading organisations that offer best-in-breed application security products
What web application
penetration testing actually is
A controlled, authorised attack against your web apps, APIs and cloud-facing services performed by certified ethical hackers. We test exactly the way a real adversary would but under written rules of engagement, with safe payloads, and with one job: find every exploitable flaw before someone hostile does.
Modern web applications no longer stop at a login form. They ship with public APIs, GraphQL endpoints, AI copilots, agentic workflows, third-party integrations, multi-tenant data planes and supply-chain dependencies each of which expands the attack surface in ways automated scanners simply cannot see.
That’s the gap we exist to close.
- Black, grey and white box engagements
- OWASP Web, API and LLM Top 10 coverage
- AI, LLM and agentic feature testing
- Manually verified proof-of-concept evidence
"We break into your applications on purpose so a criminal, a competitor or a nation-state doesn't get to do it for free."
Every Intrix engagement includes:
- Threat-model led scoping,
- Executive and technical reports,
- Free retest of remediated findings
OWASP Top 10 Web Application Penetration Testing Services
Three testing depths. One goal: find every exploitable flaw before attackers do.
Black Box Testing
Our testers start with nothing but a URL, the same position an external attacker holds. The most realistic simulation of an opportunistic or targeted attack.
Best for
- Production-facing customer portal
- Annual compliance attestation
- Pre-launch validation of public surface
Grey Box Testing
You provide partial credentials, role definitions and architecture context. Our testers go deeper, faster — the most cost-effective option for the majority of Australian SaaS, government and healthcare clients.
Best for
- Authenticated user journeys and RBAC
- Multi-tenant SaaS isolation testing
- Deep API and AI integration surface
- Business logic abuse across roles
White Box Testing
Full source code, architecture diagrams and CI/CD access. Runtime attack combined with manual code review to surface what black and grey box engagements cannot reach.
Best for
- IRAP-aligned and high-assurance systems
- Source review of AI prompt sinks and tool calls
- CI/CD pipeline and IaC security
- Products where a breach would be existential
Perimeter security stopped
being enough years ago
Real attacks walk in through your login form, your file upload, your AI chatbot, your forgotten staging subdomain and your customer-facing GraphQL endpoint. Web app pentesting exists because that’s where the actual risk lives.
Traditional security approach
Firewalls, IDS/IPS and WAF rules, none of which see into your business logic or AI features.
Security engaged after the release, when remediation is most expensive.
Hundreds of unverified findings, mostly false positives, that engineering quite reasonably ignores.
Internal traffic assumed safe; tenant boundaries assumed enforced; AI agents assumed obedient.
The Intrix approach
CREST-accredited engineers attacking the way adversaries actually attack in 2026 not the way scanners think they do.
Burp Suite, custom exploits, source review and human intuition. No raw scanner output makes it into your report.
OWASP Web, API and LLM Top 10s; AI agents and MCP; business logic; supply chain; modern auth; multi-tenant isolation.
Findings tied directly to your engineering workflow and the frameworks your auditor cares about.
Our Proven 6-Step Web Application Penetration Testing Process
Security automation that fits your development workflow. We integrate security gates into your existing CI/CD pipeline without slowing down your release velocity.
Scoping & Reconnaissance
We map every in-scope public and private asset, review architecture and AI integration surface, surface forgotten subdomains and shadow assets, and agree exact rules of engagement.
Threat Modelling
We identify your highest-value data and map realistic attacker paths specific to your tech stack, industry threat model and the actors most likely to target you e-crime, state-aligned, opportunistic or insider.
Manual and Automated Testing
Our testers use Burp Suite, custom scripts and human expertise across your chosen testing depth. No automated scan is submitted without manual verification.
Exploitation and Pivoting
We safely demonstrate real business impact including data theft scenarios, account takeover and lateral movement where applicable.
Reporting and Debrief
You receive an executive summary and full technical report with CVSS risk ratings, screenshots, proof of concept evidence and step-by-step remediation guidance.
Retest and
Ongoing Support
We retest all remediated findings at no extra cost and offer optional quarterly or continuous testing programmes.
Built for the way your
industry is actually attacked
Every sector has its own threat actors, regulatory pressures and architectural patterns. We scope and report accordingly.
Software & SaaS
For Australian software vendors and SaaS platforms shipping to enterprise. Multi-tenant isolation, API security, scoped-token abuse, AI feature security, and the SOC 2 evidence your enterprise prospects demand before signing.
Mapped to: SOC 2, ISO 27001, OWASP ASVS
Government & Public Sector
Federal, state and local government portals, citizen services and internal applications. IRAP-aligned scoping, ISM control evidence, PSPF considerations and Essential Eight maturity context delivered by Australian-based, security-cleared testers.
Mapped to: IRAP, ISM, PSPF, Essential Eight, Hosting Certification Framework
Healthcare & Life Sciences
Patient portals, telehealth platforms, allied health SaaS, clinical research systems and medical device companion apps. Designed around My Health Records Act obligations and ADHA security guidance.
Mapped to: My Health Records Act, ADHA, ISO 27001, Privacy Act
Financial Services
Banks, insurers, super funds, AFSL holders and fintechs. APRA CPS 234 information security testing, CPS 230 operational resilience evidence, AUSTRAC-relevant controls alongside the deep API and business logic testing payments and trading platforms demand.
Mapped to: APRA CPS 234, CPS 230, AUSTRAC, PCI DSS, SOC 2
Education & Research
Universities, TAFEs, RTOs and EdTech vendors. LMS platforms, student information systems, research portals, online assessment platforms with attention to student PII, research data, and the AI-enabled academic integrity tools now embedded everywhere.
Mapped to: TEQSA, Privacy Act 1988, Notifiable Data Breaches, ISO 27001
Retail & E-commerce
Storefronts, payment integrations, loyalty platforms and customer data platforms. PCI DSS scoping, payment flow security, voucher and pricing abuse, account takeover defence and the supply-chain risks embedded in modern e-commerce stacks.
Mapped to: PCI DSS, Privacy Act, ISO 27001, NDB scheme
What we test beyond OWASP Top 10
OWASP Top 10 is the floor of a modern engagement, not the ceiling. Real applications now ship with AI features, agentic integrations, multi-tenant data planes and supply-chain dependencies the original Top 10 was never designed to cover. Every Intrix engagement spans the categories below, scoped to what’s actually in your stack
OWASP Top 10 (2025)
Web App Fundamentals
Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable & Outdated Components, Authentication Failures, Software & Data Integrity Failures, Logging & Monitoring Failures, and Server-Side Request Forgery.
OWASP API Security Top 10 (2023)
BOLA, Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, BFLA, Unrestricted Access to Sensitive Business Flows, SSRF, Security Misconfiguration, Improper Inventory Management and Unsafe Consumption of APIs across REST, GraphQL, gRPC and WebSocket.
OWASP LLM Top 10 AI Features & Copilots
Prompt injection (direct and indirect), insecure output handling, training data poisoning, model DoS, supply-chain risk in foundation models and embeddings, sensitive information disclosure through LLM responses, insecure plugin and tool design, excessive agency, overreliance, and model theft.
AI Integration, MCP & Agentic Systems
Goes beyond the LLM Top 10. We test the full agent surface: tool poisoning, MCP server abuse, indirect prompt injection via documents and search results, RAG corpus tampering, agent jailbreaks pivoting into real systems, confused-deputy attacks, and exfiltration through markdown-rendered LLM output.
Business Logic Abuse
Workflow bypasses, race conditions, pricing and discount manipulation, voucher and credit abuse, multi-step exploitation that no scanner will ever catch. Found through engineering literacy and creativity, not pattern matching.
Modern Authentication & Identity
OAuth 2.0 / OIDC misconfiguration, SAML signature wrapping, JWT algorithm confusion and key abuse, passkey and WebAuthn implementation flaws, session fixation, account recovery abuse, and SSO trust boundary failures.
Authorisation Depth & Multi-Tenant Isolation
Horizontal and vertical privilege escalation, IDOR at scale, tenant boundary breaks in SaaS, scoped-token abuse, organisation-switching exploits critical for software vendors and multi-tenant platforms.
Supply Chain & Dependencies
SBOM review, dependency confusion, typosquatting, malicious package detection, transitive vulnerability exposure, npm and PyPI lockfile drift, CI/CD pipeline poisoning, and build artefact integrity.
Cloud, Container & IAM at the App Boundary
Over-permissioned IAM roles reachable from the app, IMDS abuse, SSRF-to-cloud-credential chains, container escape primitives, exposed Kubernetes APIs, IaC misconfiguration the app inherits.
Client-Side & Modern Front-End Attacks
DOM-based XSS, postMessage abuse, prototype pollution, CSP bypass, Subresource Integrity failures, WebSocket hijacking, clickjacking, and client-side template injection across React, Vue, Angular and Next.js front ends.
Related Application Security Services
This service is designed to help APRA-regulated entities prepare for and execute their CORIE obligations
AppSec as a Service Interactive, scenario-based training that boosts engagement and retention
Secure your APIs from design to deployment. Comprehensive testing, monitoring, and protection for REST, GraphQL, gRPC, and WebSocket APIs
Internal and external network infrastructure across firewalls, routers, servers and Active Directory
Evaluate the security of your cloud environments (AWS, Azure, GCP), focusing on misconfigurations and access control issues
What is web application penetration testing?
Web application penetration testing is a controlled security assessment where certified ethical hackers simulate real attacks against your web apps, APIs, AI features and cloud-facing services. The goal is to find every exploitable vulnerability before adversaries do and deliver a prioritised remediation report with reproducible proof-of-concept evidence. Intrix is a CREST-accredited penetration testing company based in Australia.
How much does web application penetration testing cost in Australia?
Cost depends on scope, testing depth and application complexity. Black box engagements typically run 3 to 5 business days, grey box 5 to 7 days, and white box with source code review 7 to 14 days. Intrix provides fixed-scope quotes after a free scoping call. Contact us at 1300 931 727 to get a quote specific to your application.
Do you test AI features, LLM integrations and agentic systems?
Yes. Intrix covers the OWASP LLM Top 10 plus broader agent surface including prompt injection, tool poisoning, MCP server abuse, RAG corpus tampering, confused-deputy attacks, agent jailbreaks pivoting into real systems and exfiltration through markdown-rendered output. If your application has a chatbot, copilot, embedded LLM feature or any agentic workflow, it is in scope.
Do you test APIs and modern JavaScript applications?
Yes. Intrix tests React, Next.js, Angular and Vue front ends, REST, GraphQL, gRPC and WebSocket APIs, single-page applications, mobile API backends and microservices architectures. API testing follows the OWASP API Security Top 10 with deep authorisation testing including BOLA and BFLA.
Will penetration testing affect my live application?
No. Intrix follows strict rules of engagement and uses safe testing methods designed to avoid service disruption. Testing can also be conducted against a staging or UAT environment if preferred, with destructive testing reserved for explicitly agreed scopes only.
Which compliance frameworks do your reports support?
Intrix maps findings to the frameworks Australian organisations actually report against including IRAP, ISM, PSPF and Essential Eight for government; ISO 27001 and SOC 2 for software and SaaS; APRA CPS 234 and CPS 230 for financial services; PCI DSS for payment environments; My Health Records Act and ADHA guidance for healthcare; and the Privacy Act and Notifiable Data Breaches scheme across all sectors.
Do you offer continuous or ongoing penetration testing?
Yes. Intrix offers quarterly testing programmes and release-triggered testing for teams running continuous deployment pipelines. This is suited to SaaS vendors, government platforms and regulated industries that need ongoing assurance rather than a point-in-time assessment. Ask about our ongoing AppSec as a Service option during your scoping call.
Is Intrix CREST accredited for web application testing?
Yes. Intrix is a CREST-accredited penetration testing company. All web application testers hold recognised industry certifications including OSCP and OSEP and are based in Australia. Security clearance is available for government and defence-adjacent engagements.
Ready to Secure Your Applications?
Whether you’re starting your AppSec journey or optimising an existing program, our experts can help you build security into every release.