Web application penetration testing in Coimbatore
Coimbatore's makers of textiles, pumps, motors and castings put web portals in front of dealers, overseas buyers and their own staff, and those portals are what an export customer's reviewer asks about first. We test them from Hyderabad, and come to your premises when a test needs us on site.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, visits by arrangement
Last reviewed
01 / Local need
Why Coimbatore manufacturers ask for a web application test
The request usually starts as a line in an export customer's questionnaire, not in the IT department.
A pump or motor manufacturer gives dealers a portal for stock, prices and warranty claims. A textile exporter lets overseas buyers log in to follow orders and download shipping documents. A foundry or component supplier opens a supplier portal for drawings and purchase schedules. A growing software firm builds portals for clients elsewhere. Each portal holds commercial secrets, such as price lists and drawings, that a competitor or a disgruntled former dealer would value.
The buyer's reviewer does not ask whether you use a firewall. They ask when the portal was last tested and who tested it, and for a small manufacturer the honest answer is often never. A first test, scoped to the portals that outsiders can sign in to, is usually the best start. Our approach is described on the web application testing page, and the city picture, including how we work from a distance, is on VAPT services in Coimbatore.
Many Coimbatore businesses are run by families who know their customers personally, so a portal is sometimes built by a nephew's company or a local freelancer and never reviewed. That is not a criticism; it is a reason to test, because trust between people is not a control that works on a website.
02 / Scope
Portals and sites that fill our Coimbatore web testing
Six kinds of web system turn up again and again.
Dealer portals for pumps, motors and machinery
Dealers see stock, prices and warranty claims. We test whether one dealer can see another's price list, how new dealers are approved and what a dealer account can export.
Export buyer portals
Overseas customers track orders and fetch shipping documents. We test whether document links can be guessed, whether one buyer can open another's order and how sign-in and recovery behave.
Supplier and drawing portals
Foundries and component makers exchange drawings and schedules. We test upload handling, who can download which drawing and whether old supplier logins still work.
ERP web front ends
Web access to purchasing, stores and accounts. We test role boundaries, approval steps and the reports that export whole ledgers.
HR and attendance portals
Large workforces mean large payroll and attendance systems. We test who can see salary data, how leave approvals are enforced and what the export features reveal.
Corporate and inquiry sites
The company website and its inquiry forms feed sales. We test form handling, the admin area behind the site and any plug-ins the content system relies on.
03 / From our guide
From our guide: testing the newer risk categories and the limits of a Top 10
More export buyers now cite the OWASP Top 10 in supplier reviews. The extract below explains how the newer categories are probed and where a Top 10 stops being enough.
How to test for the new categories
- Supply chain. Review the dependency list and lockfiles, check that builds are reproducible and pinned, check who can publish to your package registry and who can change the pipeline, and look for secrets in build logs.
- Exceptional conditions. Send malformed input, drop connections midway, make dependencies fail and watch what the application decides to do. Check that errors do not reveal stack traces, queries or internal addresses, and that the default answer to a failed check is "deny".
- Access control with SSRF. Test every feature that fetches a URL, imports a file from a link, renders a preview or calls a webhook, and test the server's access to internal ranges and metadata addresses.
What a Top 10 does not cover
The list is deliberately short. Business logic flaws such as skipping a payment step, abusing a coupon or racing two requests are mostly invisible to it. APIs have their own list, the OWASP API Security Top 10 from 2023, which remains the current edition. A good web application test uses the Top 10 as a minimum and then spends most of its time on how your particular application works.
For a portal built years ago, the supply-chain and error-handling categories are where we usually learn the most. The full list of categories and the explanation of each change are in the OWASP Top 10:2025 article.
04 / What we find
Patterns we expect in Coimbatore dealer, supplier and export portals
Portals built to serve trusted partners tend to share a few weaknesses.
Show details for Patterns we expect in Coimbatore dealer, supplier and export portals
- Price lists shared across dealers. A dealer account whose filter is applied by the screen, so a request edited by hand returns every dealer's prices.
- Drawings fetched by number. A file address with a sequential identifier that opens any drawing when the number changes.
- Uploads stored where they can run. Documents and images accepted in any format and kept where the web server may execute them.
- Logins that outlive their owners. Accounts of former dealers and contractors that still sign in years after the relationship ended.
- Admin pages with no extra protection. A management area on the same address as the public site, reachable by anyone who guesses the path.
- Outdated components. A portal built on a framework or plug-in from several years ago, with known weaknesses and nobody assigned to update it.
A portal that was built once and left alone is exactly the kind of system where the oldest weaknesses survive. The report therefore names the component, the page and the fix separately, so whoever maintains the portal, in-house or outside, can act on their own part.
05 / Rules and customers
Export questionnaires, ISO 27001 and what customers actually ask
In Coimbatore the push to test usually comes from a buyer, an auditor or a clause in a contract.
Show details for Export questionnaires, ISO 27001 and what customers actually ask
Export customers send spreadsheets of questions to their suppliers, and several of the rows come down to one thing: has an independent party tested the systems that touch our data, and were serious findings fixed? A dated summary of a portal test answers those rows directly. What to hand a buyer, from a single-page summary to the entire report, is covered in our piece on security questionnaires.
Groups pursuing ISO 27001 discover that the auditor wants a recurring testing habit plus proof that issues were closed. HR and attendance portals keep staff records, and the data protection law that India passed in 2023 treats those as personal data; its working rules start in 2027, and the DPDP page shows what testing adds.
06 / How it runs
How a web test fits a Coimbatore production calendar
Orders, shipments and month-end set the pace, so the test is planned around them.
Show details for How a web test fits a Coimbatore production calendar
Before day 1
Choosing the portals
A short call decides which portals to test first, usually the ones outsiders sign in to, and finds a window clear of dispatch peaks and month-end closing.
Day 1
Accounts for every role
You provide a test login for a dealer, a supplier, an overseas buyer and an administrator where those roles exist, together with any documents. We confirm that each works.
Days 2 to 7
Testing the portal as each role
We work through each role's view, the uploads, the exports and the admin area by hand, with tools for breadth, and call you the same day about anything serious.
OutputEvidence for every confirmed finding
07 / Questions to ask
Questions a Coimbatore manufacturer should put to a web tester
These help when the portal was built by someone who has since moved on.
Show details for Questions a Coimbatore manufacturer should put to a web tester
- Does the test use a separate account for each kind of dealer, supplier and buyer?
- How will you handle a portal built by a vendor that we can no longer reach?
- Will you test the admin area and the exports, not only the public pages?
- Can the summary be forwarded to an export customer without the technical detail?
- Do you check for old accounts that still sign in?
08 / Delivery
Delivery of web tests to Coimbatore manufacturers
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
What a web test costs a Coimbatore manufacturer
A company website with a few pages may fit a small scope, priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. A dealer, supplier or export portal with roles and data behind a login is a larger job, beginning from INR 27,000 + 18% GST and following roles, endpoints and environments. The web application testing cost guide lays out the factors.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you have staff in Coimbatore?
No. Our engineers work from Hyderabad, and we travel to a Coimbatore mill or office only when a test or a meeting needs it. See the section on Delivery of web tests to Coimbatore manufacturers above.
Which portal should a manufacturer test first?
The one that outsiders sign in to and that holds commercial secrets, usually the dealer or export buyer portal, followed by the supplier and drawing portal. See the section on Portals and sites that fill our Coimbatore web testing above.
Our portal was built by a freelancer who is unreachable. Can you still test it?
Yes. What is running gets tested; the report lists each component and its fix on separate lines so the current maintainer can act, and no source code is needed. See the section on Questions a Coimbatore manufacturer should put to a web tester above.
Will a test interrupt dispatch or production?
Not if it is planned well. We test a staging copy where there is one, keep noisy checks to agreed hours and avoid dispatch peaks and month-end. See the section on How a web test fits a Coimbatore production calendar above.
Does an export customer's questionnaire require a penetration test?
Often it asks for evidence of independent testing. What a given buyer accepts is their decision, but a dated summary of scope, method, findings and retest status is the usual answer. See the section on Export questionnaires, ISO 27001 and what customers actually ask above.
What should we budget?
A small scope comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest; a dealer or export portal begins from INR 27,000 + 18% GST. See the section on What a web test costs a Coimbatore manufacturer above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana