Web application penetration testing in Kochi
Behind Kochi's websites are guests booking rooms, patients opening reports, borrowers applying for loans and shippers tracking containers. Our engineers test those sites from Hyderabad, where our one office is, and come to Kochi only when a test truly needs someone in the room.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, visits by arrangement
Last reviewed
01 / Local need
Why Kochi businesses ask for a web application test
Tourism, healthcare, shipping and lending put very different websites in front of the public, and each has its own worst day.
Hotels, resorts and tour operators take bookings and payments on their own sites and through channel partners. Hospitals that draw patients from across Kerala run portals for appointments and reports. Banks and NBFCs with roots in the state run customer sites for applications and statements, and exporters and logistics firms near the port run tracking and document portals. The worst day differs: a stolen guest list, an exposed lab result, a loan file opened by the wrong person, a shipment document quietly altered.
We say plainly that BERRY9 is not a Kochi firm. Testing a website needs no one in your building, but a kickoff meeting at your office or a readout at head office can be arranged when you prefer, with the cost written into the proposal. For how we test, read the web application testing page; for how Kochi buyers judge a firm based elsewhere, read VAPT services in Kochi.
02 / Scope
Kochi sites that fill our web testing calendar
Six kinds of site make up most of the Kochi work.
Booking and reservation sites
Hotels, resorts and tour operators sell rooms and packages online. We test availability and price steps, cancellation and promo logic, payment hand-off, and whether one guest can ever see another's booking.
Hospital and clinic portals
Appointment booking, report download and billing pages hold the most personal data a site can. We test sign-in, recovery, report links and what the pages return for another patient's identifier.
Loan and customer portals
NBFC and bank sites take applications, identity documents and repayments. We test the upload handler, one-time passcodes, role boundaries and the logic around limits and approvals.
Cargo and shipment tracking sites
Tracking pages are public on purpose. We see what appears when a number is altered, whether documents come back without a login and whether bulk lookups are capped.
Channel-manager and partner extranets
Rates and inventory are pushed to travel partners through logins. We test whether one partner can read another's rates, and how partner accounts are created and removed.
Admin and reporting consoles
Staff pages that issue refunds, edit prices and export guest or patient lists carry the most power in the application, so we check who can open them and whether a hidden button is the only barrier.
03 / From our guide
From our guide: gray box, and what to prepare
Most Kochi teams hand over test accounts and ask the tester to start from them, which is gray box testing. This is how our guide describes it and what each approach needs from you.
Gray box: accounts and documentation
In a gray box test the tester gets what a normal user, or a determined insider, would have: test accounts for each role, API documentation and a short briefing on how the application works. This is the most common choice, and for good reason. The tester skips the discovery work and spends the time on the questions that matter most in business applications:
- Can user A open user B's record by changing an identifier?
- Can an ordinary user reach an admin function?
- Can a step in a workflow be skipped, repeated or reordered?
- Can a price, a role or a status be changed in a request that should not allow it?
These authorization and logic flaws are the ones that hurt customers and the ones scanners are worst at finding. Gray box testing reaches them directly.
What to prepare in each case
For gray box, create test accounts for every role and check they work before the engagement starts. Add sample data that does not belong to real customers. Provide API documentation or a Postman collection, and name one person who can answer questions. For white box, add repository access, build instructions and an architecture overview. Our preparation checklist covers the rest.
For an out-of-town tester, a clean set of accounts and a staging address matters even more, because there is no walking across the office to ask. The two ends of the scale, black box and white box, are in the complete guide.
04 / What we find
Weak points we expect in Kochi booking, care and lending sites
Sites that serve guests, patients and borrowers tend to fail in familiar ways.
Show details for Weak points we expect in Kochi booking, care and lending sites
- Booking references that can be guessed. A confirmation number that opens another guest's name, dates and phone number when its digits change.
- Prices settled in the browser. A room rate or promo code applied on the page and accepted by the server without a second check.
- Report links that never expire. Lab results and discharge summaries shared by a link that works for anyone, indefinitely.
- Loan uploads accepted blindly. Identity documents taken in any file type and stored where they can be fetched without signing in.
- Partner logins that see too much. A travel partner's extranet account that can read other partners' negotiated rates.
- Export buttons without checks. Guest and patient lists that any staff account can download in full.
Seasons matter in Kochi: tourist months and festival weeks load booking sites heavily, so we schedule around them and keep heavy checks off peak days.
05 / Rules and customers
DPDP, card payments and lender rules in Kochi
The request for a test usually arrives from outside, and each source wants something slightly different.
Show details for DPDP, card payments and lender rules in Kochi
The records of guests, patients and borrowers count as personal data for India's DPDP Act, with duties that begin in 2027. Our DPDP checklist lists the safeguards, and the page on DPDP testing shows where a test fits in. Booking pages that handle card data bring PCI DSS into view, although a hosted payment page removes much of that burden.
A bank or NBFC answers to its regulator's own directions on testing, for itself and its vendors; go through those with your compliance people and let us know which apply. For clients abroad, a dated summary is usually enough, and our article on what to send lists the options.
06 / How it runs
How a web test fits a Kochi calendar
Online meetings carry most of the work, so the main constraint is your season.
Show details for How a web test fits a Kochi calendar
Before day 1
Scoping call
We settle the sites in scope, the roles, a staging copy and the dates, and we agree to keep heavy checks away from tourist peaks and festival weeks.
Day 1
Accounts and addresses
You send an account for each role and the documents you have. We confirm that they work and share the addresses our requests will come from.
Days 2 to 7
Testing in quiet hours
We test bookings, reports, uploads and portals by hand, run noisy checks in agreed quiet hours and tell you at once about anything serious.
OutputProof for each confirmed finding
07 / Questions to ask
Five questions to put to a web tester from out of town
Distance is not a problem if these are answered clearly.
Show details for Five questions to put to a web tester from out of town
- Who is the named engineer, and how do we reach them during testing?
- How will you handle a booking or payment flow without touching real money?
- Will you test the roles our partners and staff use, and not only the public pages?
- How do you keep noisy checks away from our busiest days?
- What do we receive that we can forward to a client abroad?
08 / Delivery
Delivery of web tests to Kochi businesses
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
What a web test costs a Kochi business
A brochure site or one booking page may fit a small scope, which comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. A site with partner logins, patient accounts or loan files is a bigger job and begins from INR 27,000 + 18% GST, with roles, endpoints and environments moving the figure. The web application testing cost guide sets out the factors.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Will anyone from BERRY9 visit your premises in Kochi?
Not for a website test. The engineers work from Hyderabad, and a visit happens only if the test or a meeting calls for it. See the section on Delivery of web tests to Kochi businesses above.
Can you test a hotel booking site without real payments?
Yes. We use a staging copy or test mode of the payment step, with test cards, so the whole booking journey can be tried without real money moving. See the section on Kochi sites that fill our web testing calendar above.
Do you test hospital report portals?
Yes. We test sign-in, recovery, report links and what the portal returns for another patient's identifier, using fictional patients where we can. See the section on Kochi sites that fill our web testing calendar above.
Can partner extranets be tested too?
Yes. We test each partner role, how accounts are created and removed, and whether one partner can read another's rates or bookings. See the section on Kochi sites that fill our web testing calendar above.
When is the best time to test for a tourism business?
Outside the peak months. We plan the window with you, keep heavy checks to quiet hours, and avoid festival weeks. See the section on How a web test fits a Kochi calendar above.
What should we budget?
A small scope comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest; a site with partner or patient logins begins from INR 27,000 + 18% GST. See the section on What a web test costs a Kochi business above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana