‍Black-Box External Web App Pentest: Know What an Attacker Sees From the Outside‍

If you're looking for a focused external assessment that tells you what an unauthenticated attacker can find, reach, and exploit in your web application, a black-box external web app pentest is likely what you need. Most breaches start from the outside, so knowing your external attack surface, and fixing weaknesses before an attacker finds them, is the single highest-value first step in application security.

‍

‍What it is

A black-box external web app pentest is a time-boxed assessment of one web application, from the perspective of an anonymous attacker: no insider knowledge, no credentials provided by you, no privileged access. Where the application offers public self-registration, testers sign up as any member of the public would. It is a strong baseline that sets up deeper assessments later and pairs naturally with a SOC 2 audit.

It is the right starting point when:

• You want to establish a security baseline before scaling up your testing program
• A customer or partner is asking for proof that security testing was performed

Most modern SaaS products are built around a web application, making this one of the most common and practical assessments available.

Related: Why AI in Pentesting Must Stand up to Independent Scrutiny

‍

What's included

• AI-assisted testing: Broader coverage in the allotted time, with every finding validated by a human before it reaches your report.
• Reconnaissance and fingerprinting: We map the public-facing application and its technology stack to understand what is exposed before testing begins.
• Paths, files, and directories: A significant portion of a black-box engagement is spent on enumeration. Without authenticated access, we focus on what is visible and reachable from the internet.
• Known vulnerabilities in detected technologies: We identify CVEs in the technologies and versions in use and attempt exploitation where the environment allows. Some CVEs are constrained by environmental controls; others can be validated and documented with proof.
• Common web weaknesses visible without authentication: This includes injection points, security misconfigurations, leaked sensitive data, and missing security headers.
• Exposed secrets and sensitive information: Publicly accessible source code, API responses, and configuration files are a common source of critical findings in black-box assessments. Hardcoded credentials, third-party API keys, and authentication tokens reachable in client-side code fall into this category.
• Authentication weaknesses visible from the outside: This includes missing brute-force protection on login forms, exposed administrative or internal login panels and unauthenticated API endpoints that expose PII.

‍

What you get

• A full report: Every finding documented with severity ratings, steps to reproduce, and remediation guidance.
• An executive summary: A shareable document for customers, partners, and auditors as proof the application was tested, with no sensitive technical details included.

You also get 90 days of unlimited retests included, with an updated report you can share with auditors and customers once fixes are applied.

‍

Scope

This engagement is intentionally focused. Understanding what it covers helps you get the most out of it.

• One web application: Hosted on a single domain or subdomain.
• External only: Unauthenticated testing from the perspective of an anonymous attacker. Testers self-register where the application supports it.
• Time-boxed effort: A set amount of testing time, sized for one application.
• Larger than expected? If the application proves larger than the package covers, Thoropass sends a notification and either prioritizes the highest-risk areas within the allotted time or quotes the additional effort.

‍

How fast can it be delivered?

No prep work is required on your end, and all we need is the target URL. A black-box web app pentest for a single application is delivered in 2-3 business days. Applications with a larger unauthenticated surface may take slightly longer depending on the volume of exposed functionality.

‍

For compliance

A pentest is not mandatory for SOC 2, but many customers and auditors expect to see it. This engagement satisfies that expectation and can be delivered alongside your audit.

If a customer, partner, or framework requires a web application security assessment, this engagement produces a full technical report and an executive summary you can share with the relevant parties.

‍

Why Thoropass?

‍We run web app pentests every day, across a wide range of industries including education, healthcare, AI solutions, CMS, fintech, e-commerce, legal tech, and HR platforms. That breadth of experience means we know how different application types are built, where they tend to fail, and what good remediation looks like in each context.

‍Our advantages include:

• CREST-accredited, the recognized standard for penetration testing services
• 1,200+ pentest engagements delivered
• Pentesters hold hands-on offensive certifications including OSCP+, BSCP, OSEP, eWPT and more
• Direct Slack channel with the lead pentester throughout the engagement, with immediate escalation of critical findings
• Every finding validated by a human, with false positives removed before the report is delivered
• 90 days of unlimited retests included, with an updated report for auditors and customers

‍

What our customers say

As with everything, you should always look for what real customers say, and not just take the vendor's word for it. That's why you should look at an unbiased source like G2 - you'll see why Thoropass' pentests have a 4.6/5 rating. Here's just a few things that our customers have said about our pentests:

"Everything was super easy. Communication was top notch. Retest scheduling couldn't have been easier."

"The team was extremely professional and organized. The pentest was very thorough."

"The best pentest report presentation we have seen."

"The 90-day retest period was very much appreciated, and not something I've seen offered by competitors."

‍

When to go further

A black engagement shows what an opportunistic attacker sees from the outside. When the time is right to test deeper, our more advanced packages take it further:

• Gray-box approach: authenticated testing across user roles and permissions, with API and business logic coverage guided by docs and workflows
• White-box approach: everything in gray-box, plus source code access
• Additional applications, portals, subdomains, and environments

This engagement offers the best value when bundled with a SOC 2 audit. To discuss the right scope for your needs, reach out to the experts at Thoropass.

‍

‍