# Penetration testing guides

Source: https://penetrationtestservices.com/guides/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

Practical guides on planning a pentest, web and API testing, SaaS isolation, compliance evidence and reading a pentest report, from Excession Labs.

Written for founders, engineering leads and security teams who need to plan a test, prepare for one, or act on a report. Each guide shows real request examples, checklists or requirement text with sources.

- [After the pentest: remediation, retest and close-out](https://penetrationtestservices.com/guides/after-the-pentest-remediation-and-retest/): What to do after a penetration test: triage findings, assign fixes, verify them, request a retest and close out with evidence. Includes a tracker template.
- [Authentication testing checklist: login, reset, MFA, sessions and OAuth](https://penetrationtestservices.com/guides/authentication-testing-checklist/): An authentication testing checklist for web apps and APIs: login, password reset, MFA, sessions, OAuth and account enumeration, with proof and fixes.
- [Black box vs grey box vs white box penetration testing](https://penetrationtestservices.com/guides/black-box-grey-box-white-box-testing/): How black box, grey box and white box penetration tests differ, what each costs you in time and depth, and a decision table to choose one.
- [Bubble app security: privacy rules, Data API and workflow API checklist](https://penetrationtestservices.com/guides/bubble-app-security/): How to check your own Bubble app: privacy rules on every data type, Data API and Workflow API settings, search exposure and client-side data, with a test checklist.
- [Business logic vulnerabilities: examples, testing and fixes](https://penetrationtestservices.com/guides/business-logic-vulnerabilities/): What business logic vulnerabilities are, why scanners miss them, examples in pricing, workflows and limits, how testers prove them and how to fix them.
- [CSRF testing: how pentesters check tokens, SameSite and login CSRF](https://penetrationtestservices.com/guides/csrf-testing/): How to test CSRF protection: an 8-step method, a test-case table for tokens, Origin and SameSite, JSON endpoints, login CSRF, and proof in a real browser.
- [Does SOC 2 require penetration testing?](https://penetrationtestservices.com/guides/does-soc-2-require-penetration-testing/): Does SOC 2 require penetration testing? No. See the AICPA CC4.1 wording, why auditors still ask for a pentest report, and five questions to settle first.
- [Firebase security rules testing: Firestore, Storage and the emulator](https://penetrationtestservices.com/guides/firebase-security-rules-testing/): Firebase security rules testing for Firestore, Storage and Realtime Database: working unit tests for the Local Emulator Suite, safe example rules, and a checklist.
- [HIPAA penetration testing: what the Security Rule says today and what HHS proposed](https://penetrationtestservices.com/guides/hipaa-penetration-testing/): HIPAA penetration testing requirements as of November 2026: the Security Rule in force does not name a pentest, and the January 2025 HHS proposal is not final.
- [How often should you pentest? Standards, triggers and a schedule](https://penetrationtestservices.com/guides/how-often-should-you-pentest/): How often should you pentest? The PCI DSS 11.4 wording, SOC 2 and ISO 27001 position, ten changes that should trigger a test, and a schedule table by profile.
- [How to prepare for a penetration test: a checklist](https://penetrationtestservices.com/guides/how-to-prepare-for-a-penetration-test/): How to prepare for a penetration test: write the scope, create test accounts, load test data, pick an environment, name contacts and set a freeze window.
- [How to read a penetration testing report, section by section](https://penetrationtestservices.com/guides/how-to-read-a-penetration-testing-report/): How to read a penetration testing report section by section: the 13 parts, an annotated sample finding, severity versus priority, and how to plan fixes.
- [IDOR testing: how pentesters find broken object-level authorization](https://penetrationtestservices.com/guides/idor-testing/): IDOR testing step by step: prove it with two accounts and a read-back, use a 7-case test table and demo requests, and fix BOLA with a server-side check.
- [ISO 27001 penetration testing: what the standard asks and auditors check](https://penetrationtestservices.com/guides/iso-27001-penetration-testing/): ISO 27001 penetration testing requirements: the standard does not name a pentest. See Annex A 8.8, 8.29 and 8.34, an evidence pack, and what to ask your auditor.
- [Multi-tenant isolation testing: how to check that tenants cannot see each other](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/): Multi-tenant security testing for SaaS: a two-tenant matrix of 12 areas (IDs, search, exports, caches, files), a sample leaking request and row-level security fixes.
- [OWASP API Security Top 10 (2023): the list and how to test each risk](https://penetrationtestservices.com/guides/owasp-api-security-top-10/): The OWASP API Security Top 10 2023 list with exact IDs from API1 to API10, plus test ideas, sample requests, a test-case table and the usual fix for each risk.
- [OWASP Top 10 2025: the list and what pentesters check for each item](https://penetrationtestservices.com/guides/owasp-top-10-2025/): OWASP Top 10:2025 with exact IDs, a one-line meaning for each category, a 2021 to 2025 mapping table and the checks a penetration tester runs.
- [PCI DSS penetration testing requirements: Requirement 11.4 explained](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/): PCI DSS penetration testing requirements 11.4.1 to 11.4.7 (v4.0.1) in one table: test frequency, who may test, segmentation, and questions for your QSA.
- [Penetration testing rules of engagement: what to agree in writing](https://penetrationtestservices.com/guides/penetration-testing-rules-of-engagement/): Pentest rules of engagement: what to agree in writing (authorization, scope, test windows, off-limits actions, stop conditions, data) plus a template outline.
- [Pentest attestation letter: what it contains and what it cannot prove](https://penetrationtestservices.com/guides/pentest-attestation-letter/): Pentest attestation letter: what it contains, a letter outline you can adapt, how it differs from a full report, and what no letter can prove to a buyer.
- [Rate limiting and credential stuffing: how to test safely](https://penetrationtestservices.com/guides/rate-limiting-and-credential-stuffing/): Credential stuffing testing and rate limit tests done safely: OWASP OAT-008, a bounded test design, test cases for login, reset and MFA, and how to fix gaps.
- [Red team vs penetration testing: what is the difference?](https://penetrationtestservices.com/guides/red-team-vs-penetration-testing/): Red team vs pentest: how the two differ in goal, scope, stealth and who knows, with an 11-row comparison table and a decision table for choosing one.
- [Security questionnaire pentest questions: what buyers ask and how to answer](https://penetrationtestservices.com/guides/security-questionnaire-pentest-questions/): Pentest questions in security questionnaires (SIG, CAIQ, custom): 14 common questions with honest answer patterns, the evidence to attach, and what to avoid.
- [Supabase security audit: RLS, API keys, storage and RPC checklist](https://penetrationtestservices.com/guides/supabase-security-testing/): Supabase security audit for your own project: an 8-step checklist for RLS, publishable and secret keys, views, storage and RPC, with example policies.
- [What is penetration testing? A plain guide for software teams](https://penetrationtestservices.com/guides/what-is-penetration-testing/): What is penetration testing? What a pentest produces, the main types, how it differs from a vulnerability scan, five phases and one worked example finding.