E-commerce & Retail Penetration Testing

We map the storefront, the checkout, the customer and admin areas, any headless or mobile API, and the full set of third-party scripts loaded on payment pages. Using Burp Suite, nmap and ffuf we enumerate endpoints and identify the platform and its extensions, flagging outdated Magento, WooCommerce or plugin versions with known vulnerabilities early.

Here we attack the buying flow as a fraudster would. We try to set prices and quantities from the client, apply and re-apply discount codes, stack vouchers with gift cards, change currency to gain a rounding advantage, and complete an order without a successful payment or after a cancelled one. We also test refund and store-credit paths, which are a favourite for turning a small flaw into real money out the door.

Because client-side skimming is now the dominant way card data is stolen from retailers, we look hard at what runs on your checkout. We review every third-party script for integrity, test whether an attacker could inject or swap a script through a compromised tag manager or a vulnerable dependency, and check whether Subresource Integrity and a Content Security Policy are actually enforcing what loads. PCI DSS 4.0 now requires exactly this attention to payment-page scripts.

When we find a way to buy for less than we should, take over an account, or exfiltrate card fields, we prove it with a working request set using test cards and test accounts only. You get the report within days, a live walkthrough, and a free retest after remediation.

Prices, quantities, shipping costs and totals that are trusted from the client instead of recalculated on the server let a shopper decide what to pay. We test every field in the cart and checkout request for tampering, including negative quantities and rounding tricks that turn a large order into a small charge.

A single malicious line of JavaScript on your checkout can copy every card number entered and ship it to an attacker, without ever touching your server or your logs, and it often sits in a script you did not write and do not monitor. We assess third-party script exposure, tag-manager access, dependency risk and CSP coverage, because this is the breach most likely to end in a PCI forensic investigation and card-brand fines.

Discount logic is deceptively hard to get right. We test whether codes can be reused, stacked, brute-forced, or applied to already-discounted items, whether gift-card balances can be checked or drained by enumeration, and whether refunds and store credit can be issued beyond what was paid.

Weak password resets, guessable order references, and endpoints that return another customer’s order by changing an ID expose personal data and shipping details at scale. We test authentication, session handling and object-level authorization across the customer account and order-history features.

In most compromised stores we look at, the entry point was an out-of-date extension, not a novel exploit. We identify vulnerable plugins and themes, insecure custom code, and misconfigured admin panels, and we test the admin and fulfilment back office for privilege escalation and order manipulation.

Headless and mobile commerce move the logic into APIs, where broken object-level authorization on cart, order and customer endpoints becomes the main risk. We test those endpoints for the same price, discount and data-exposure issues as the web checkout, plus mass assignment and over-shared responses.

Beyond individual bugs, we look at how well the store resists automation: credential stuffing against the login, card-testing against the payment endpoint, and bots that hoard limited stock at drop time. Missing rate limits, weak bot defences and unthrottled gift-card checks turn an ordinary flaw into a scalable loss, so we flag where a single request becomes ten thousand.

PCI DSS requirement 11.4 calls for regular penetration testing of the systems in and connected to your cardholder data environment, and the 4.0 revision adds specific requirements around managing and monitoring the scripts on your payment pages, aimed squarely at Magecart. Our report and attestation letter are written to support your PCI assessment and to give your QSA the evidence they need.

Customer names, addresses and order histories are personal data, so we test with GDPR in mind, and we measure the application against OWASP ASVS and the OWASP Top 10. For mobile shopping apps we use OWASP MASVS. Beyond the test, we give you practical e-commerce security best practices your team can adopt: enforce server-side pricing, lock down payment-page scripts with SRI and CSP, patch extensions on a schedule, and separate admin access from the public store.