What we test for

Our assessment probes for the vulnerabilities that matter most on real websites:

• Injection flaws — SQL, command and related injection points.
• Cross-site scripting (XSS) and cross-site request forgery (CSRF).
• Authentication, session and access-control weaknesses.
• Security misconfigurations and exposed administrative interfaces.
• Outdated software, CMS and component vulnerabilities.
• SSL/TLS configuration and certificate issues.
• Information disclosure and other common web vulnerabilities.

This covers the full range of common, high-impact web security problems.