Web application penetration testing in Chennai
Chennai's web applications are rarely simple storefronts: they are dealer and supplier portals for auto-component makers, customer sites for banks and fintechs, and delivery portals that IT exporters build for overseas clients. BERRY9 tests them from Hyderabad, where our only office is, and visits Chennai by arrangement.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, visits by arrangement
Last reviewed
01 / Local need
Why Chennai companies ask for a web application test
The request tends to come from a client, a lender or a foreign customer, and lands with someone who is not a security specialist.
A manufacturer in the Sriperumbudur and Oragadam belt gives dealers and suppliers a portal for orders, schedules and invoices, and its biggest customer then asks for proof that the portal has been tested. A bank or fintech in the city launches a customer site and is asked by its own risk team, or by a partner, for an independent report. An IT services exporter builds a portal for a client abroad, and the contract names a penetration test as a delivery condition. In each case the person who receives the request is an IT manager or a project head, and what they need is a scope, a date and a report they can forward.
A head office in the city rarely needs a visit for this kind of test, though a kickoff meeting there is easy to arrange. Our web application testing page describes the method, and VAPT services in Chennai sets out what Chennai buyers usually ask first.
02 / Scope
Web systems we test most often for Chennai companies
Most of the web work we scope for the city falls into six kinds of application.
Dealer and supplier portals
Portals for orders, schedules, quality records and invoices. We test what each dealer or supplier role can see, whether one partner can reach another's documents, and how accounts are issued and closed.
Banking and fintech customer sites
Account views, statements, transfers and loan journeys. We test authorization on every record, session handling, one-time passcodes and the logic around limits and approvals.
Client delivery portals
Sites that IT exporters build and host for overseas clients. We test the client's environment boundary, the admin features and what a contractor's old account can still reach.
ERP and procurement front ends
Web interfaces to purchasing and inventory systems. We test role boundaries, approval workflows and upload features, where manufacturers often have the weakest checks.
Logistics and tracking sites
Shipment tracking and booking pages are public by design. We test what they reveal when identifiers change and whether bulk lookups are limited.
Admin and reporting consoles
The pages used by staff to export data, change prices or approve payments. We test who can reach them and whether the interface alone hides a function.
03 / From our guide
From our guide: the two ends of the scale
Chennai buyers often ask whether the tester should start with nothing or with everything. This is how our guide describes the two ends of the scale, and what each costs in time.
Black box: no inside knowledge
In a black box test the tester gets a URL and nothing else, the position of an outside attacker who has just found your site. It is the closest simulation of an unprepared stranger, and it is the right choice when the question is "what can someone find about us from the internet alone?".
The cost is time. A black box tester spends the first part of the engagement discovering pages, parameters and roles that your team could have listed in minutes. Anything behind a login stays out of reach unless the tester can register an account, so deep problems in signed-in features are often not reached.
White box: source code too
In a white box test the tester also reads the source code and sees the architecture and configuration. It finds the most, including flaws that are almost impossible to see from outside: weak cryptography, hardcoded secrets, unsafe deserialization, a missing check on a path nobody linked. It is usually run together with a source code review and takes longer, so it suits core applications such as payments, health records or identity.
Most Chennai portals sit between the two, and the middle option, gray box, is described in the full article. The middle option, gray box, and the way to choose are in the complete guide to the three approaches.
04 / What we find
Weak points that recur in Chennai portals and customer sites
Manufacturing and finance portals fail in ways that reflect how they were commissioned.
Show details for Weak points that recur in Chennai portals and customer sites
- Dealer accounts that see too much. A role built for one dealer that also lists every dealer's price list, because the filter lives in the screen and not on the server.
- Uploads accepted without checks. Drawings, certificates and invoices uploaded as any file type and stored where the web server can run them.
- Accounts that never expire. Contractor and ex-employee logins at a supplier portal that still work two years later.
- Approval steps in the browser. A two-person approval that can be completed by one person by sending the second request directly.
- Customer statements by number. A statement or invoice identifier that opens another customer's document when the digits change.
- Old components. Portals built years ago on frameworks and plug-ins with known weaknesses that nobody was assigned to update.
Because many of these portals were built by a vendor and later maintained by someone else, the report names the component and the fix separately, so the right team can act on each one.
05 / Rules and customers
ISO 27001, PCI DSS and regulated customers in Chennai
Three kinds of request are common, and each asks for a slightly different report.
Show details for ISO 27001, PCI DSS and regulated customers in Chennai
Manufacturers and exporters often hold, or work toward, an ISO 27001 certificate, and auditors expect a routine of testing and proof that findings were closed. Card payments bring PCI DSS into scope for stores and billing sites that handle card data. If you are a bank, or serve one, the regulator's own directions set what testing is expected of you, so read them or ask whoever handles compliance, and let us know so the scope can reflect them.
What to hand over when a customer wants evidence is covered in our article for that situation.
06 / How it runs
How a web test fits a Chennai change calendar
Plants and branches rarely need a visit; the schedule is shaped by your change windows instead.
Show details for How a web test fits a Chennai change calendar
Before day 1
Scoping call
We confirm the portals, the roles, the staging site and any change freeze, and set the testing window to avoid month-end and shift changes.
Day 1
Accounts and addresses
You send one test account per role and any documents. We confirm access and give you the fixed addresses our requests will come from.
Days 2 to 7
Hands-on testing
Our engineers test role boundaries, workflows, uploads and the data behind each page, and tell you straight away about anything serious.
OutputEvidence for each confirmed finding
07 / Questions to ask
What to ask a web tester before you sign
If a vendor maintains the portal, these questions are worth putting to them too.
Show details for What to ask a web tester before you sign
- Will you test every role a dealer, supplier or customer can hold, or only the main one?
- How do you treat file uploads, and what happens to a hostile file?
- Can the report separate what the vendor must fix from what our own team must fix?
- Do you check who can still log in, including old contractors?
- Will the summary stand on its own when forwarded to our customer or bank?
08 / Delivery
Delivery of web tests for Chennai companies
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
Budgeting a web application test in Chennai
A plain website may fit a small scope, which comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. A dealer or customer portal with roles and workflows sits in the larger band, beginning from INR 27,000 + 18% GST and following roles, endpoints and environments. See the web application testing cost guide.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Is there anyone from BERRY9 based in Chennai?
No. Chennai clients are served from our Hyderabad office, and a visit happens only if it helps. See the section on Delivery of web tests for Chennai companies above.
Can you test a dealer or supplier portal run by a vendor?
Yes, if the vendor and you both agree in writing. We scope with you, bring the vendor in for access and fixes and report to you. See the section on Web systems we test most often for Chennai companies above.
Which web systems should a manufacturer test first?
The portals that outsiders can log in to, such as dealer, supplier and customer sites, then the internal ERP front end. Those are the ones customers ask about. See the section on Web systems we test most often for Chennai companies above.
Does a bank or fintech need a web test before launch?
Your regulator's directions and your partners decide what is required. Whatever applies, a test before launch finds authorization and logic flaws while they are cheap to fix. See the section on ISO 27001, PCI DSS and regulated customers in Chennai above.
Black box or white box for a Chennai portal?
Most portals do best with something in between: accounts and documents given to the tester, so the days go into logic and authorization. Pure black box suits a public site with no login. See the section on From our guide: the two ends of the scale above.
What does it cost?
A small scope comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest; a portal with roles and workflows begins from INR 27,000 + 18% GST. See the section on Budgeting a web application test in Chennai above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana