This paper reviews web application penetration testing, common web security vulnerabilities, and how organizations can address web app security challenges.