Agency is suggesting a web pentest, how does it differ from a standard pen test and does a small site need it?

A network test looks for open SSH ports and outdated Linux kernels. A web pentest looks at code-level flaws like SQL injection vulnerabilities, cross-site scripting risks, and session fixation bugs. If your portal runs on custom code, the logic flaws left behind by developers will only ever surface through a web pentest.

We paid 190.000 RUB for a web test on our own B2B system last year. Our server came back completely clean, but the web test caught a critical authorization flaw where dealers could view each other's account statements. Compared to the potential brand damage, it was completely worth the money.

Do you store payment card data on the site, or are orders simply billed to an open trade account? Also, is this dealer portal built on off-the-shelf software, or was it coded from scratch for you? Those details dictate whether the test is really necessary.

Ask the agency for their methodology document before accepting the quote. Find out what standards they follow for their reports. If they're just going to run an automated vulnerability scanner and print out a report, 240.000 RUB goes straight into the trash; if they do manual testing for business logic flaws, then it's worth talking.

A lot of security firms on the market just run an automated vulnerability scanner for two hours and sell you a 50-page PDF report calling it a pentest. If the proposal doesn't explicitly state 'manual business logic testing' do not pay that money under any circumstances.

the agency is right unfortunately network testing is one thing web pentest is another. anyway if dealers see custom pricing and one manages to steal anothers rates youre gonna have a huge headache. narrow down the scope and ask for a discount but dont skip the test entirely.

B2B databases contain client agreements that constitute trade secrets. Signing a comprehensive non-disclosure agreement prior to procuring web pentest services and stipulating in the protocol that testing must be conducted outside operational hours are essential for your legal security.

I'm curious too.

Thanks, this was very helpful.

We experienced almost the exact same thing last year. If you scold false alarms, nobody will report again.

Of course, it varies if your situation is different.

let me write how it's done in practice. i mean just because everyone does it doesn't mean it's right.

absolutely. i mean if I were to add anything: The real issue isn't the number but what it's based on.

of course it varies if your situation is different.

The answer above hits the nail on the head. Taking measures without an inventory leaves doors you haven't seen open.

That's all, sorry if I went on too long.

Let me summarize whats been said so far... Taking measures without an inventory leaves doors you havent seen open.

Of course, it varies if your situation is different.

I didn't know that.

I partly agree, partly disagree. If 2FA is on, a stolen password alone is useless.

Just leaving this note, it might be useful.

I've been dealing with this for a long time. People defend habits, not processes. Resistance comes from there.

Having backups accessible on the same network and with the same identity makes them part of the target. Proven by experience.

I don't think this advice fits everyone. If you scold false alarms, nobody will report again.

If permission and scope aren't in writing, don't start that test. Correct me if I'm wrong.