Web Application Penetration Testing: What Testers Check, What PCI DSS Requires, and What It Costs

By The Uptime Report Team · Last reviewed: October 2026

Web application penetration testing is an authorized attack on a web app, commonly structured around the 97 test IDs in OWASP WSTG v4.2; PCI DSS Requirement 11.4 requires one at least every 12 months for card-data apps.

What is web application penetration testing, and how is it different from a scan?

Web application penetration testing is an authorized attack on a running web app in which a tester tries to exploit flaws, not only list them. NIST SP 800-115 draws the line: vulnerability scanners “check only for the possible existence of a vulnerability,” while the attack phase of a penetration test “exploits the vulnerability to confirm its existence.”

PCI DSS v4.0.1 says the same in its guidance for Requirement 11.4.1: “Penetration testing is a highly manual process. While some automated tools may be used, the tester uses their knowledge of systems to gain access into an environment” (page 275). The requirement’s stated objective is testing “by a competent manual attacker.” The OWASP Application Security Verification Standard (ASVS) 5.0.0 adds that DAST and SAST tools “will be unable entirely to verify many of the more complicated ASVS requirements or those that relate to business logic and access control.”

Requirement 11.4.1 lists “Application-layer penetration testing” and “Network-layer penetration tests” as separate items (page 274), so a web app test does not cover the host, firewall and segmentation work in our network penetration testing guide. Vulnerability scans sit in a different requirement again, 11.3, so a combined quote should price the scan and the test as separate lines, the split explained in our vulnerability assessment and penetration testing guide.

What does a web application penetration test check?

A web application penetration test checks the OWASP Top 10:2025 risk categories by running numbered test cases from the OWASP Web Security Testing Guide. OWASP calls the Top 10 “a standard awareness document,” not a test plan. WSTG v4.2 supplies the 97 test IDs a report can cite, such as WSTG-ATHZ-04 for insecure direct object references.

The 2025 edition reshuffled the list. Security Misconfiguration moved from fifth place in the OWASP Top 10:2021 to A02:2025, Server-Side Request Forgery was folded into A01:2025, Software Supply Chain Failures (A03) expands the 2021 Vulnerable and Outdated Components category, and A10:2025 Mishandling of Exceptional Conditions is new with 24 CWEs. A quote scoped “to the OWASP Top 10” should name the edition, because A05 means Security Misconfiguration in 2021 and Injection in 2025.

The WSTG column is our editorial mapping, made by matching each category description to the test objectives in the v4.2 checklist. CWE counts and incidence rates come from each OWASP category page; the ZAP column counts the alert pages in the ZAP alert index whose Tags field names that 2025 category.

Two categories show where a scanner stops. No ZAP alert carries the A09:2025 tag, so logging and alerting failures need a tester who watches whether abuse triggers a response. A03:2025 has the highest average incidence rate in OWASP’s score tables, 5.72%, yet OWASP says it ranks on its community survey and hopes “testing catches up in this area”; a black-box test can fingerprint versions with WSTG-INFO-08 but cannot inventory a build pipeline.

How does a web app pentest run, phase by phase?

A web app pentest runs in the four phases set out in NIST SP 800-115: planning, discovery, attack and reporting, with reporting running alongside the other three. PCI DSS adds a fifth step for card-data apps: Requirement 11.4.4 says penetration testing “is repeated to verify the corrections” (page 278). Each phase maps to specific WSTG v4.2 test categories.

1. Planning. Agree rules of engagement, management approval and goals; NIST SP 800-115 states that “No actual testing occurs in this phase.” Fix the ASVS level, the environment, and two test accounts per user role, because WSTG-IDNT-01 tests role definitions and horizontal access checks need two users of the same role.
2. Discovery. Run WSTG-INFO-01 to 10 (search engine reconnaissance, server and framework fingerprinting, entry points, architecture map) and WSTG-CONF-01 to 11 (platform configuration, HTTP methods, HSTS, subdomain takeover, cloud storage): 21 test IDs.
3. Attack. Work through 76 test IDs: identity and access (WSTG-IDNT, ATHN, ATHZ, SESS: 28), input and client side (WSTG-INPV, CLNT: 32), and business logic, cryptography, error handling and API (WSTG-BUSL, CRYP, ERRH, APIT: 16). NIST SP 800-115 Figure 5-2 loops new findings back into discovery.
4. Reporting. Per NIST SP 800-115, the report describes each vulnerability, presents a risk rating and gives mitigation guidance. PCI DSS 11.4.1 requires keeping penetration testing results and remediation results “for at least 12 months” (page 274).
5. Retest. Under PCI DSS 11.4.4, correct exploitable findings according to the entity’s Requirement 6.3.1 risk ranking, then repeat the test to verify each fix.

Ask which WSTG version a report cites. The in-development checklist on GitHub, last changed 15 October 2026, lists 115 test IDs in 13 categories, renames WSTG-INPV to WSTG-INJT, and adds WSTG-ATHN-11 (Multi-Factor Authentication), WSTG-SESS-10 (JSON Web Tokens) and WSTG-BUSL-10 (Payment Functionality). v4.2, a GitHub release from 3 December 2020, is still the version the OWASP site labels stable.

How much of a web app pentest can an automated scanner do?

Less than half, by ZAP’s own labels. Across the 730 non-deprecated alert pages in ZAP’s public alert index, tags name 43 of the 97 WSTG v4.2 test IDs; counting only the 210 release-status alerts, 30 of 97. Business logic shows 1 of 9 tests tagged and identity management 1 of 5, which is where a human tester’s hours go.

Method: we read the index at zaproxy.org/docs/alerts on 26 October 2026, fetched all 733 alert pages it lists, and collected every “WSTG-V42-” tag from each page’s Tags field. Each tag was matched against the official WSTG v4.2 checklist; all 43 tagged IDs exist in it. A tag means ZAP’s maintainers link an alert to that test, not that the rule completes it, and a missing tag does not prove ZAP never touches the area. ZAP’s Access Control add-on alerts (10101 and 10102) carry A01:2025 tags but no WSTG tag and need configured users per role.

For a buyer, the count sets the line between a scan and a test: if a quote only promises scanner output, at least 54 of the 97 WSTG v4.2 tests have no tagged rule behind them. Scanners such as ZAP are compared in our penetration testing tools guide, which helps an MSP decide which of these checks to automate between annual tests.

Black box, grey box or white box: how much access should testers get?

Give testers credentials for every role and, for higher assurance, documentation or source code. OWASP ASVS 5.0.0 says testing without that access “is an inefficient and ineffective mechanism for security verification” and strongly encourages documentation or source code-led (hybrid) testing. ASVS also warns that even Level 1 “is not necessarily penetration testable” from the outside alone.

Source: our count of the official ASVS 5.0.0 CSV (released 30 May 2025) and the level definitions in the ASVS chapter “What is the ASVS”, which itself puts Level 1 at “around 20%” of requirements and Level 2 compliance at “around 70%”.

What does PCI DSS require for web application penetration testing?

For systems in the cardholder data environment, PCI DSS v4.0.1 Requirement 11.4.1 requires “Application-layer penetration testing to identify, at a minimum, the vulnerabilities listed in Requirement 6.2.4” (page 274). The guidance names “Open Web Application Security Project (OWASP) penetration testing programs” among the industry-accepted approaches (page 276), which is why WSTG IDs work as evidence.

The v4.0.1 text of Requirement 6.4.1 offers a choice for public-facing web applications: an application vulnerability review at least once every 12 months, or an automated technical solution in front of the app. That choice has expired. Its applicability note says it “will be superseded by Requirement 6.4.2 after 31 March 2025” (page 151), and PCI SSC FAQ 1593 (March 2025) says to mark it Not Applicable. A web application firewall meets 6.4.2; it does not replace the 11.4 penetration test.

Page numbers refer to PCI DSS v4.0.1 (June 2024), which PCI SSC distributes through its document library after a license agreement. Requirements 6.4.2, 6.4.3 and 11.6.1 each carry the note that they were “a best practice until 31 March 2025”; the script inventory duty is summarized with the other 2025 changes in our PCI compliance guide. How often 11.4.2 and 11.4.3 require a test, and how that compares with SOC 2 and HIPAA, is set out in the compliance section of our penetration testing as a service guide.

What should a web app pentest statement of work specify?

A statement of work should name the standards and versions, every role and test account, the API definition, the environment, the retest terms and the report format. Each line below traces to ASVS 5.0.0, WSTG v4.2 or PCI DSS v4.0.1, so an MSP or IT buyer can paste it into an RFP and compare quotes on the same 97-test baseline.

Severity language belongs in the SOW too. FIRST’s CVSS v3.1 and CVSS v4.0 specifications share five bands, and FIRST calls the qualitative ratings optional. PCI DSS 6.3.1 lets each entity define its own risk ranking; its guidance lists “consideration of the CVSS score” as one possible criterion (page 145).

Severity bands do not say what attackers use. PCI DSS 6.3.1 guidance already lists alerts from FIRST or a CERT among ranking criteria (page 145), so for any finding tied to a CVE, ask the tester to flag whether the CVE sits in CISA’s Known Exploited Vulnerabilities catalog, the signal examined in our analysis of the CISA KEV catalog.

How much does web application penetration testing cost?

For web application penetration testing, price follows what a vendor counts as one app. Among the three offers compared below, public starting list prices in October 2026 ran from $3,500 for an Intruder white-box test of one repo-linked app to $10,283 for a Synack test that covers up to 25 unauthenticated apps or one low complexity authenticated app, with Synack’s required platform billed on top.

The full market spread of published pentest prices, and delivery-model costs with October 2026 list prices held flat over 3 years, are compared in the three-year cost model of our penetration testing as a service guide.

Which web application penetration test fits your situation?

Match the test to the obligation first and the app second. Card-data apps need an application-layer test under PCI DSS 11.4.1, apps with a login need credentials for every role, apps aiming at ASVS Level 2 (253 requirements) or Level 3 (345) need documentation or source access, and payment pages need 6.4.3 and 11.6.1 checks.

How we compiled this

We compiled this page from 32 primary documents accessed in October 2026: the OWASP Top 10:2025 introduction, its 10 category pages and project page, the Top 10:2021 list, the WSTG v4.2 site, checklist and release record, the in-development WSTG checklist, ASVS 5.0.0 chapters and CSV, PCI DSS v4.0.1, a PCI SSC blog post and FAQ, both FIRST CVSS specifications, NIST SP 800-115, the ZAP alert index, the OWASP API Security Top 10 2023, the AWS testing policy and three vendor price pages. We counted WSTG IDs, ASVS requirements and ZAP tags from the source files. We did not run tests or request quotes.

Frequently asked questions

Should we test the staging or the production web app?

NIST SP 800-115 section 6.3 says a technique likely to cause a denial of service should probably run against a non-production system, and that organizations should consider test data on a non-production system when testing could expose card or Social Security numbers. It also warns that differences between environments can cause missed vulnerabilities. One workable split: attack-phase tests on a matching staging copy, read-only WSTG-INFO and WSTG-CONF checks on production.

Does an API-only app need a web application penetration test?

Yes, scoped to the API. WSTG v4.2 has one API test, WSTG-APIT-01 for GraphQL, so add the OWASP API Security Top 10 2023, which starts with API1:2023 Broken Object Level Authorization. PCI DSS v4.0.1 Requirement 6.2.4 lists business logic attacks made through the manipulation of APIs (page 141), so card-data APIs fall under the 11.4.1 application-layer test.

Do we need permission from our cloud provider before a web app pentest?

Check the provider’s policy before the start date. AWS lets customers test their own AWS infrastructure without prior approval for the services on its Permitted Services list, requires prior approval for testing that includes command and control (C2), and forbids testing AWS services themselves. Put the provider, the policy URL and the services in scope into the statement of work.

Can the MSP that manages our web app also penetration test it?

Only with organizational independence. PCI DSS v4.0.1 Requirement 11.4.3 accepts a qualified internal resource or a qualified external third party, provided the tester is independent, and the tester need not be a QSA or ASV (page 277). PCI’s guidance for internal scans gives the example that a network administrator should not be responsible for scanning the network (page 267), so the engineers who run the app should not test it.

What qualifications should a web application penetration tester have?

PCI DSS v4.0.1 guidance for Requirement 11.4.3 lists specific penetration testing certifications as one indication of skill and competence, plus prior experience: years of testing and the type and scope of past engagements (page 277). The same guidance warns that a penetration test that found nothing is typically indicative of shortcomings of the tester. Ask for sample reports that cite WSTG v4.2 test IDs.

Sources

1. OWASP, Top 10:2025 Introduction. Accessed October 2026.
2. OWASP, Top Ten project page. Accessed October 2026.
3. OWASP, A01:2025 Broken Access Control. Accessed October 2026.
4. OWASP, A02:2025 Security Misconfiguration. Accessed October 2026.
5. OWASP, A03:2025 Software Supply Chain Failures. Accessed October 2026.
6. OWASP, A04:2025 Cryptographic Failures. Accessed October 2026.
7. OWASP, A05:2025 Injection. Accessed October 2026.
8. OWASP, A06:2025 Insecure Design. Accessed October 2026.
9. OWASP, A07:2025 Authentication Failures. Accessed October 2026.
10. OWASP, A08:2025 Software or Data Integrity Failures. Accessed October 2026.
11. OWASP, A09:2025 Security Logging and Alerting Failures. Accessed October 2026.
12. OWASP, A10:2025 Mishandling of Exceptional Conditions. Accessed October 2026.
13. OWASP, Top 10:2021. Accessed October 2026.
14. OWASP, Web Security Testing Guide v4.2. Accessed October 2026.
15. OWASP, WSTG v4.2 testing checklist (WSTG-Checklist_v4.2.xlsx). Accessed October 2026.
16. OWASP, WSTG release v4.2 on GitHub. Accessed October 2026.
17. OWASP, WSTG in-development checklist (checklist.json). Accessed October 2026.
18. OWASP, ASVS 5.0.0 release and requirement CSV. Accessed October 2026.
19. OWASP, ASVS 5.0.0 chapter: What is the ASVS. Accessed October 2026.
20. OWASP, ASVS 5.0.0 chapter: Assessment and Certification. Accessed October 2026.
21. OWASP, API Security Top 10 2023. Accessed October 2026.
22. PCI Security Standards Council, PCI DSS v4.0.1 Requirements and Testing Procedures (June 2024), Document Library. Accessed October 2026.
23. PCI Security Standards Council, Just Published: PCI DSS v4.0.1 (11 June 2024). Accessed October 2026.
24. PCI Security Standards Council, FAQ 1593 on superseded requirements (March 2025). Accessed October 2026.
25. ZAP, Alert index and alert pages (Tags field). Accessed October 2026.
26. ZAP, Access Control Testing add-on help. Accessed October 2026.
27. FIRST, CVSS v3.1 Specification Document. Accessed October 2026.
28. FIRST, CVSS v4.0 Specification Document. Accessed October 2026.
29. NIST, SP 800-115 Technical Guide to Information Security Testing and Assessment (September 2008). Accessed October 2026.
30. Amazon Web Services, Penetration Testing policy. Accessed October 2026.
31. Synack, Pricing. Accessed October 2026.
32. Intruder, Pentest pricing. Accessed October 2026.
33. Astra Security, Pricing. Accessed October 2026.