Penetration testing for e-commerce companies
An online store is attacked at the checkout, the login and the payment callback, and the busiest weeks cost the most. BERRY9 engineers test pricing and coupon logic, account takeover, gateway callbacks, seller and admin portals and the platform behind them, using test payments only.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote, on-site by arrangement
Last reviewed
01 / Where attackers look
What attackers go after in an online store
A store turns a click into an order and a payment, so the logic between the cart and the gateway is what gets attacked.
Checkout and pricing logic
Prices, quantities, shipping fees and totals are often calculated in the browser and accepted by the server without a check. We test whether any of them can be changed between the cart and the order.
Account takeover
Credential stuffing, weak password reset, guessable one-time passcodes and sessions that survive a password change. Customer accounts hold addresses, saved cards' last digits and order history.
Payment gateway callbacks
The order is marked paid when the gateway says so. We check that the message is verified, that it matches the order and amount, and that it cannot be replayed or sent by someone else.
Coupons, wallets and loyalty
Stacked coupons, refunds that return more than was paid and referral credit claimed with bulk accounts turn promotions into losses. Sale seasons magnify the damage.
Seller and admin portals
Marketplace sellers should see their own orders and nobody else's. We test seller roles, catalog and price editing, payout screens and the admin panel itself.
Third-party scripts and plugins
Analytics, chat, tag managers, themes and plugins run in your customers' browsers, often on the checkout page. We check which scripts load there and how they are controlled.
02 / Scope
What an e-commerce penetration test covers
Most store engagements join the storefront, the apps and the portals to the hosting underneath.
| Part of the store | What we try | Covered by |
|---|---|---|
| Storefront and checkout | Pricing and total logic, coupons, cart and order handling, sign-in, recovery and session handling | Web application testing |
| Shopping apps | Stored data, deep links, traffic protection, payment hand-off and the API calls the app makes | Mobile app testing |
| Order, catalog and seller APIs | Access to orders and customers, seller separation, throttling and the fields in each reply | API security testing |
| Admin panel and back office | Role boundaries, catalog and price editing, refund approvals and who can reach the panel | Web application testing |
| Hosting and network | Exposed services, server and database access, and the paths from a compromised plugin to the rest of the system | Network penetration testing and Cloud security assessment |
| Staff awareness | Phishing exercises for support, finance and catalog teams who hold admin access | Social engineering assessment |
03 / Common flaws
Flaws that recur in online stores
Stores combine custom code, a platform, plugins and partners, and these are the weaknesses we try first.
Show details for Flaws that recur in online stores
Online stores combine custom code, a platform, plugins and partners, and attackers pick the weakest of the four. These are the flaws we try first.
- Client-side totals. A price, discount or shipping fee sent from the browser and accepted by the order system.
- Unverified payment confirmation. A request that marks an order as paid without a signed message from the gateway.
- Coupon and refund abuse. The same code applied repeatedly, codes that combine, or a refund larger than the amount paid.
- Order and invoice identifiers. A sequential order number that opens another customer's order, address and phone number. See IDOR and business-logic flaws.
- Weak account recovery. Reset links that do not expire and passcodes without an attempt limit; the rate limiting article covers the controls.
- Outdated plugins and themes. Known vulnerabilities in extensions that a scanner will list and a tester will try to use.
- Exposed back-office addresses. An admin panel, a staging store or a backup file reachable from the internet.
On a hosted platform such as Shopify, the platform itself is outside the test. We test your custom apps, themes, integrations and the way your store uses them. On a self-hosted store such as WooCommerce or Magento, the server, the plugins and the code are in scope too.
04 / Rules and partners
PCI DSS, the DPDP Act and marketplace reviews
Card payments and customer data bring rules with them. The report is the evidence your assessor or partner weighs.
Show details for PCI DSS, the DPDP Act and marketplace reviews
PCI DSS applies once you store, process or transmit card data. A hosted payment page removes most of that burden, and your gateway's documentation explains how much. Where card data stays in scope, PCI DSS 4.x (item 11.4) wants a test of the perimeter and of the inside network every year, and again after big changes. See the PCI DSS testing page for how we scope it.
Names, addresses, phone numbers and order history are personal data under India's DPDP Act, and the rules start to bite in 2027: see our DPDP checklist. Marketplaces, payment partners and big brands may also ask a seller or vendor for a recent test report. For each of these, our report is evidence that your assessor or partner weighs, and the decision stays with them.
05 / How it runs
How an e-commerce engagement runs
Book 5 to 10 working days well ahead of any big sale; the proposal lists the exact schedule.
Show details for How an e-commerce engagement runs
Before day 1
Scope and dates
We settle which storefront, apps and portals are in scope, which payment methods to use in test mode, and dates that keep clear of your sale peaks.
Day 1
Test shop and payments
You supply customer, seller and admin accounts, a staging store if you have one, and a gateway in test mode with test cards.
Days 2 to 7
Walking the purchase journey
We attack the cart, accounts, coupons, callbacks and portals by hand, check the platform and plugins with tools, and report anything serious as soon as it is confirmed.
OutputFindings with proof, using test payments only
Days 8 to 9
Reports and walkthrough
Owners and partners are given an executive report; your developers or agency are given an engineering report with fixes, and a short call explains everything.
After your fixes
Retest
Each repaired issue is checked once more, and we record whether it is now closed.
06 / Preparation
What to prepare before the test
A staging store and a gateway in test mode let us test the whole purchase journey without real money.
Show details for What to prepare before the test
- A staging copy of the store, or agreed windows outside your busiest hours.
- The payment gateway in test mode, with test cards and the callback address.
- Customer, seller and admin test accounts, with sample orders.
- A list of the platform, theme, plugins, apps and third-party scripts the store uses, with the agency or vendor who maintains each.
- Notice to your hosting provider and your web application firewall team, and our testing addresses allowed.
- A fresh backup taken before testing, and a named contact for the days it runs.
Our preparation guide lists the remaining basics, and the checklist PDF is a quick way to brief your agency and hosting provider.
07 / Price and timing
What an e-commerce test costs, and when to book it
Show details for What an e-commerce test costs, and when to book it
A simple WordPress store with a hosted payment page can count as a small scope: The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. A store with custom code, several roles, mobile apps or a seller portal is different: Every other test starts from INR 27,000 + 18% GST, rising with each of those. What drives the figure is explained in the VAPT cost guide; your proposal states scope and price in writing before anything starts.
08 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you test checkout, coupons and payment callbacks?
Yes. We change prices, quantities and totals between cart and order, stack and repeat coupons, and send forged or repeated gateway callbacks, always with the gateway in test mode. See the section on Flaws that recur in online stores above.
Will you use real payments or real customer data?
No. We use a staging store or agreed windows, a gateway in test mode with test cards, and sample accounts and orders. A check that can only run in production is allowed only on the terms the written rules set. See the section on What to prepare before the test above.
Can you test a Shopify store?
We test what you control: custom apps, themes, integrations, scripts and how your store uses them. Shopify itself is outside the test, as is any system you do not own. See the section on Flaws that recur in online stores above.
Can you test a WooCommerce or Magento store?
Yes. On a self-hosted store the server, platform, plugins and custom code are all in scope; plugin versions are checked against known vulnerabilities and the risky ones are then tried by hand. See the section on Flaws that recur in online stores above.
When should we test before a sale season?
Several weeks ahead, so there is room to fix and retest. The test itself needs 5 to 10 working days in total, and fixes plus the retest come on top. See the section on How an e-commerce engagement runs above.
Do we need PCI DSS?
If you store, process or transmit card data it does, and hosted payment pages shrink the scope. Where it applies, expect a yearly test and a retest after significant changes; your acquirer or assessor decides what you must do. See the section on PCI DSS, the DPDP Act and marketplace reviews above.
How much does a store penetration test cost?
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. Anything bigger, such as a store with its own apps or a seller portal, is quoted per scope: Every other test starts from INR 27,000 + 18% GST. See the section on What an e-commerce test costs, and when to book it above.
Could a test slow the store down or lose orders?
We avoid that by testing staging or agreed quiet windows, keeping request volumes within limits we set with you, and stopping when you tell us to. Checkout is never hammered during trading hours. See the section on How an e-commerce engagement runs above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana