Web Pentesting Guide: Methodology, Tools and Prices

Web pentesting (web application penetration testing) is an offensive security audit that simulates a real attack against a web application to identify, exploit and document vulnerabilities before real attackers can take advantage of them.

Unlike a simple vulnerability scan — which only produces a list of possible problems — a professional web pentest involves the controlled manual exploitation of each vulnerability found to demonstrate its real impact on the business. It is not enough to say "you have SQL Injection": you have to prove that, through that injection, an attacker could access the entire customer database.

The end goal is not just to find flaws, but to deliver a prioritized remediation plan that allows the organization to fix vulnerabilities in order of criticality. A good pentest does not end with the report: it ends when all critical vulnerabilities have been fixed and validated.

Web pentesting is mandatory to comply with regulations such as ISO 27001, ENS, DORA, PCI-DSS and NIS2. It is also an increasingly common requirement in cyber insurance policies and in contracts with large clients that want to verify the security of their suppliers.

A professional web pentest follows internationally standardized methodologies. The three most recognized are:

At MagnoSec we use a combination of these three methodologies, adapting them to each client's specific context: a startup that needs to validate its MVP does not require the same approach as a bank subject to DORA that needs a TLPT (Threat-Led Penetration Testing).

The price of a professional web pentest in Spain varies depending on the scope, the complexity of the application and the depth of the testing. These are the indicative ranges for 2026:

Why these prices? A professional web pentest is not running an automated scanner. It involves between 20 and 80 hours of work from a senior consultant with certifications such as OSCP, OSWE or BSCP. It includes manual analysis, controlled exploitation, a detailed report with evidence, results presentation and post-remediation follow-up. The average cost of a security incident in a Spanish company is €75,000 according to the National Institute of Cybersecurity.

If you are looking to hire a web pentest, make sure the consultant holds at least one of these internationally recognized certifications:

At MagnoSec, our team holds OSCP, OSWE, OSWP, BSCP and eWPTXv2 certifications. See our full certifications in the certifications guide.

Not all pentesting companies are the same. Here are 7 criteria to choose well:

1. 1Team certifications: Ask for the certifications of the consultants who will run your pentest. OSCP, OSWE, CRTO and BSCP are the standard. Be wary of companies that do not publish their team's certifications.
2. 2Documented methodology: The company should specify which methodology it uses (OWASP, PTES, OSSTMM) and why. If they cannot explain their methodology in 2 minutes, they do not have one.
3. 3Detailed technical report: Ask to see a sample report (anonymized). A good report includes CVSS scores, evidence, reproduction steps and prioritized recommendations. If the report is 5 pages of automated scanner screenshots, it is not a real pentest.
4. 4Manual exploitation: Ask explicitly whether they manually exploit vulnerabilities. Many companies sell automated scans as pentesting. The price difference is abysmal for a reason.
5. 5Verifiable references: Ask for client references in your sector. A pentester who has audited 50 fintechs knows exactly what to look for in yours. Industry experience matters.
6. 6Post-delivery support: A good pentest includes at least one results presentation meeting and follow-up during remediation. If the company disappears after delivering the PDF, look elsewhere.
7. 7Professional liability insurance: The company must have liability insurance that covers possible damage during testing. Especially important for production applications. Ask for the insurance certificate.