BERRY9 IT Services, home +91 86868 92922

Web application penetration testing in Visakhapatnam

Vizag's customer portals range from hosting control panels to shipping-agent booking sites and vendor logins at industrial plants. Our engineers test them from Hyderabad, the large IT city closest to Visakhapatnam, and come to your site when a test needs a person there.

Request a scoping call Call +91 86868 92922
Typical duration
5 to 10 working days
Testing
Manual, by engineers
Report
Executive + engineering
Delivery
Remote from Hyderabad, visits by arrangement

Last reviewed

01 / Local need

Why Visakhapatnam organizations ask for a web application test

A port, a steel plant, a hosting company and an IT park each run web systems that outsiders depend on.

A hosting or data-center supplier gives customers a control panel to manage servers, billing and support, so a flaw in the panel is a flaw in every customer's estate. A shipping agent, freight forwarder or warehouse operator near the port runs sites for bookings, tracking and document upload that shipping lines and importers use daily. A plant or shipyard runs a vendor portal where hundreds of suppliers submit invoices and drawings. Software firms in the IT parks around Rushikonda and Madhurawada build products for clients elsewhere, and their clients ask how the product was tested.

Calls and readouts run smoothly from Hyderabad, the nearest major IT hub, in a language we share with Vizag; the testing itself needs nothing in your building. The web application testing page sets out the method, and for how Vizag buyers shortlist firms, see VAPT services in Visakhapatnam.

Support access deserves a word of its own. Hosting and portal suppliers need staff who can look inside a customer's account to help, and that power is exactly what an attacker wants. We test how support access is granted, limited and logged, and we ask whether a customer could ever use the same route, because a feature built for staff is often reachable by anyone who learns its address. In a small company that feature is sometimes added in a hurry during an outage and never reviewed afterwards.

02 / Scope

Web systems we test most often in Visakhapatnam

Most of the city's web work falls into six types of system.

  • Hosting control panels

    Customers sign in to manage servers, domains and invoices. We test whether one customer can reach another's resources, how support staff act on a customer's behalf and what the panel's admin side exposes.

  • Booking and tracking sites for port trade

    Agents and importers book slots, track containers and upload documents. We test document access, identifier handling and the limits on lookups.

  • Vendor and supplier portals at plants

    Hundreds of suppliers submit invoices and drawings. We test what each supplier can see, how uploads are handled and whether departed vendors still have access.

  • IT-park product applications

    Products built for clients elsewhere. We test tenant separation, roles and the sign-in flows that a client's reviewer will ask about.

  • Education and institutional portals

    Admissions, results and fee pages hold records of students. We test sign-in, recovery, result lookups and the staff consoles behind them.

  • Admin and operations consoles

    Staff pages for approving payments, changing records and exporting data. Who can open them, and whether the only barrier is a hidden button, are what we check.

03 / From our guide

From our guide: the flaw behind most portal findings

In portals where many parties share one application, the most common serious flaw is a missing ownership check on a record. This is how our guide explains it and how we test for it.

What IDOR actually is

An endpoint accepts an object identifier from the user — an integer, UUID, hash — and returns or modifies the matching record without checking that the authenticated user is authorized for it. The vulnerability is the missing check, not the predictable ID. Even UUIDs and signed IDs are vulnerable if the authorization check is missing downstream.

How we test for it

We authenticate as two low-privilege users in separate tenants. Then we walk every endpoint that takes an object identifier, swap user A's ID with user B's, and replay. A 200 response is a finding. A 404 is suspicious (404 vs 403 leaks existence). We do this systematically — for every CRUD operation, every nested resource, every export endpoint.

GET /api/invoices/4192          → user A's invoice (legitimate)
GET /api/invoices/4193          → user B's invoice (should be 403)
PATCH /api/invoices/4193        → modifying B's data from A's session
GET /api/exports/run/4193       → background export of B's data

Where IDOR hides in modern apps

  • Bulk operations — POST /api/items/bulk-delete with an array of IDs; the per-item check is missing
  • Filename in storage URLs — /files/{user_id}/{filename} served by a CDN with no authz layer
  • Webhooks and exports — async jobs that re-fetch data and skip the original session check
  • GraphQL nested resolvers — parent is authorized, child resolver is not

A hosting panel, a booking site and a vendor portal all depend on that one check being made everywhere. The design advice for removing the problem is in the full article on IDOR.

04 / What we find

Weak points we expect in Vizag panels, booking sites and vendor portals

Systems that many outside parties share break in recurring ways.

Show details for Weak points we expect in Vizag panels, booking sites and vendor portals
  • Resources reachable by identifier. A server, invoice or consignment number that opens another customer's record when it is changed.
  • Support access without a trail. A support login that lets staff act as any customer, with no record of who did it.
  • Document links that never expire. Bills of lading, invoices and certificates fetched by anyone who holds the address.
  • Vendor accounts that outlive contracts. Supplier logins that still work after the work ended.
  • Uploads accepted without checks. Files of any type taken and stored where they can be fetched or run.
  • Bulk lookups without a ceiling. A tracking page that answers thousands of numbers a minute, which makes harvesting a customer list cheap.

For a hosting supplier the stakes are doubled, because one panel flaw can expose many customers at once. The report therefore marks which findings cross customer boundaries and ranks them first.

05 / Rules and customers

CERT-In panel questions, tenders and customer reviews in Visakhapatnam

Here the question about who may do the test often comes before the question about price.

Show details for CERT-In panel questions, tenders and customer reviews in Visakhapatnam

Government-adjacent, education and some public-sector buyers should settle first whether a rule or tender requires an auditor from CERT-In's panel. BERRY9 is not on that panel; our article on whether you need a CERT-In empanelled auditor explains how to read a requirement, and we say so before you pay if a requirement names one. For private buyers, the question is usually what a customer or an auditor will accept.

Industrial groups and exporters working toward ISO 27001 want a routine and evidence of closed findings. Student, patient and customer records are personal data under India's 2023 data protection statute, with working rules from 2027; DPDP Act testing explains where we fit.

06 / How it runs

How a web test fits Visakhapatnam's operations

Port schedules and plant shifts decide the windows, so we plan around them.

Show details for How a web test fits Visakhapatnam's operations

  1. Before day 1

    Rule check and scope

    A first call confirms whether any tender or contract names the kind of auditor required, then fixes the systems, the roles and a window clear of vessel peaks and month-end.

  2. Day 1

    Customer, agent and staff accounts

    You provide test logins for a customer, an agent or vendor, and a staff member, plus any documents. We check each one and tell you the addresses our traffic will come from.

  3. Days 2 to 7

    Crossing boundaries by hand

    Our engineers try every route the application offers from one customer, agent or vendor into another's data, and ring you if anything serious appears.

    OutputProof for each confirmed finding

07 / Questions to ask

What to ask before choosing a tester in Visakhapatnam

These questions separate a tester who understands shared systems from one who runs a scanner.

Show details for What to ask before choosing a tester in Visakhapatnam
  • Do you test whether one customer, agent or vendor can reach another's data, with separate accounts?
  • Does our tender or contract name a CERT-In panel auditor, and have you told us where you stand?
  • How do you treat support and admin access that can act for any customer?
  • What do you do with a finding that crosses customer boundaries?
  • Will the summary be readable by someone who did not attend the readout?

08 / Delivery

Delivery of web tests to Visakhapatnam organizations

Where the work happens

Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.

What you receive

One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.

How to prepare

Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.

If a tender names an auditor

If a tender, department or contract requires an auditor from CERT-In's panel, tell us before we scope the work. BERRY9 is not on that panel, and we would rather say so now than let you find out later. For buyers without that requirement the method and the report are the same. Our article on whether you need such an auditor explains how to read a requirement.

09 / Price

What a web test costs in Visakhapatnam

A simple company site may be a small scope, which comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. Panels, booking systems and vendor portals sit in the standard band, beginning from INR 27,000 + 18% GST; roles, endpoints and environments decide where in the band a given job lands. See the web application testing cost guide.

The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.

10 / FAQ

Frequently asked questions

Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.

Are you on the CERT-In panel?

No. BERRY9 is not a CERT-In panel auditor. If a rule or tender requires one, we tell you before you pay, and for every other buyer the test and report are the same. See the section on CERT-In panel questions, tenders and customer reviews in Visakhapatnam above.

Can you test a hosting control panel safely?

Yes, on a test account and a staging copy where one exists. We never touch other customers' real resources, and the rules of engagement spell out what is off limits. See the section on Web systems we test most often in Visakhapatnam above.

Do you test shipping and booking sites used by many agents?

Yes. We test whether one agent can reach another's bookings and documents, how identifiers behave and what bulk lookups return. See the section on Web systems we test most often in Visakhapatnam above.

How do you handle a vendor portal with hundreds of suppliers?

We use accounts for a few supplier types and test what each can see and upload, then check how accounts are issued and removed. See the section on Web systems we test most often in Visakhapatnam above.

Will a test interfere with vessel schedules or plant shifts?

Not if it is planned around them. We test staging where we can, keep heavy checks to agreed hours and avoid vessel peaks and month-end. See the section on How a web test fits Visakhapatnam's operations above.

What will a web test cost us?

A small scope comes from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest; a panel or portal with roles begins from INR 27,000 + 18% GST. See the section on What a web test costs in Visakhapatnam above.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp