Are you leading an SME and your website sells products, takes appointments, or stores customer data? A hacker doesn't need to know you to test it: bots probe your site every day.
Website pentesting, or penetration testing, involves having your site attacked by a professional, with your written consent, before someone else does. Here's what it really covers, and how to buy it wisely.
What a Website Pentest Really Tests
An automated scanner lists outdated software versions. A pentester goes further: they chain vulnerabilities together like an attacker would. A poorly secured search field grants access to the database, the database provides accounts, and an account grants administrative control.
- Authentication: weak passwords, bypassable two-factor authentication, sessions that don't close.
- Permissions: a customer seeing another's data by changing a number in the URL.
- Injections: SQL, malicious scripts (XSS), uploading malicious files.
- Configuration: forgotten files online, accessible backups, missing security headers.
- Business logic: a price changed before payment, a promo code usable a hundred times.
At White Hat, automated pre-audits serve as the first step: 3,080 pre-audits are completed out of 5,079 scans launched. They identify the visible issues. Manual testing finds what truly benefits an attacker.
Black Box, Gray Box, or White Box: Which to Choose
The mode determines what the tester knows before starting.
- Black Box: No information, like a stranger on the internet. Useful for measuring public exposure.
- Gray Box: A user account is provided. This offers the best effectiveness/cost ratio for an SME, as most serious vulnerabilities hide behind the login.
- White Box: Access to the code and architecture. The most comprehensive, reserved for critical applications.
The process remains the same. A quote and a precise scope are signed, the test takes place during agreed-upon times, you are immediately alerted in case of a critical vulnerability, and then you receive the report.
A good report includes a summary readable by a manager, each vulnerability classified by severity with proof, and the necessary corrections in order. After remediation, a re-test confirms the vulnerability is closed. If you also need to comply with NIS2, read NIS 2: Is Your SME or Mid-Sized Company Concerned and the NIS2 Audit page.
Questions to Ask Before Signing
Is the scope written down in black and white?
Yes, or don't sign. Domains, applications, restrictions, testing hours, and emergency contacts should be in the contract. A serious tester never attacks a site without a signed mandate.
Who is doing the test?
Ask for the name of the person typing on the keyboard, not just the company name. With a freelance pentester, it's the same person from the quote to the report.
Is the report usable by your developer?
It must provide proof, impact, and remediation for each vulnerability. An 80-page scanner export is not a pentest report.
Is a re-test included?
Without it, you won't know if the fixes are effective.
What to do if the site is already under attack?
Don't test: handle the incident first. Follow the first 72 hours after a hack, then schedule the test.
Request a Security Audit
Read more