Web pentesting, or web application penetration testing, is the authorized testing of websites and web apps to find security weaknesses before real attackers do. A pentester behaves like an adversary, but within an agreed scope: they probe login flows, session handling, input validation, access controls, and business logic for flaws such as SQL injection, cross-site scripting, broken authentication, and insecure direct object access.
This matters because web applications are a common attack surface and often expose sensitive data or critical transactions. In defense, web pentesting helps teams validate security controls, prioritize fixes, and measure whether patches actually close the gap. In practice, it combines automated checks with careful manual review, since many serious issues only appear when a tester manipulates requests, reuses tokens, or chains small weaknesses into a larger compromise. Good web pentesting is controlled, documented, and repeatable.