Web applications remain the front door for most modern businesses, which is precisely why they take such a battering. Attackers automate their reconnaissance, throw thousands of payloads at every form they find, and follow up by hand on anything that looks promising. The depressing part is how often the same handful of flaws keep working, year after year, on apps built by competent teams. Knowing what those flaws look like in the wild helps you spot them before someone less friendly does.
Broken Access Control Tops the List
OWASP has placed broken access control at the top of its list for several years now, and there is a good reason for that. Apps frequently check whether someone is logged in, then forget to check whether the logged-in user actually has permission to perform the action they have just requested. Change a user ID in a URL, swap a tenant identifier in a JSON body, or replay a request from a low-privilege account, and suddenly you are reading data that was never meant for you. These bugs rarely get caught by scanners because they require understanding the application’s intended logic.
Injection Has Not Gone Away
SQL injection sits in a supposed grave that nobody bothered to fill in. It still appears in modern frameworks when developers reach for raw queries, mishandle input in stored procedures, or trust an ORM blindly without checking how it builds its statements. Cross-site scripting persists for similar reasons, especially in apps that render user-controlled HTML, embed third-party widgets, or build pages from untrusted templating data. Proper web application penetration testing pulls these issues out of the shadows by combining manual probing with the kind of edge-case payloads automated tools rarely try.
Expert Commentary
Name: William Fieldhouse
Title: Director of Aardwolf Security Ltd
Comments: I find injection bugs in roughly half the web apps I assess, even on platforms that have been live for years. The pattern is almost always the same: one corner of the codebase that nobody touched in a while, written before the team adopted parameterised queries, quietly accepting whatever the user types. Old code is dangerous code.
Authentication and Session Mistakes
Login pages attract attention. Weak password policies, missing rate limits, poorly randomised tokens, predictable password reset flows, and session cookies without proper flags all surface regularly. Multi-factor authentication helps, but only when implemented properly. I have seen MFA bypassed because the second factor verification did not actually bind to the original session, allowing an attacker to authenticate as anyone after stealing a single API call. Test the unhappy paths as well as the happy ones.
Server-Side Request Forgery and File Uploads
Modern apps love to fetch URLs on behalf of users. They generate previews, validate webhook endpoints, and pull profile pictures from arbitrary sources. Each of those features can become a server-side request forgery if input is not validated carefully, giving an attacker a foothold inside your network or against your cloud metadata service. File uploads cause similar trouble. Letting users send files without strict type, content, and storage controls invites everything from web shells to stored XSS via crafted SVGs.
What to Do About It
Patch the libraries, sure, but also test the application as a whole rather than the individual components. Most of the bugs above survive patching because the underlying logic still trusts something it should not. Schedule regular hands-on testing rather than relying solely on automated tools, brief your developers on the patterns above, and request a penetration test quote that covers the whole user journey rather than just the public landing pages.
