PayPal Integration Penetration Testing
PayPal moves the money. Your integration decides when an order counts as paid. We pen test the part you built: the order that gets marked as paid before your server has confirmed anything, the webhook a forged request could trigger, and the refund path with no check on who is asking. CREST-certified testers, fixed price from £3,120 for a 2-day single-integration scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
PayPal’s checkout tells the browser the buyer approved the payment. The money only moves once your backend calls capture and checks what PayPal actually returns.
Why a successful checkout on screen is not a captured payment
PayPal’s checkout separates approval, what happens in the buyer’s browser, from capture, what happens on your server. The Orders v2 API only marks an order COMPLETED once your backend calls capture and PayPal returns that status. An integration that treats its own onApprove callback as proof of payment can be tricked into fulfilling an order PayPal never actually captured.
PayPal also posts the outcome to your webhook listener, and that message needs the same scepticism. PayPal’s own webhooks integration guide sets out how to check a notification really came from PayPal, either by calling the verify-webhook-signature endpoint or by recomputing the signature yourself from the PAYPAL-TRANSMISSION headers and PayPal’s certificate. A listener that skips this acts on whatever is posted to it.
The rest of the risk sits in configuration rather than code: which credentials the integration uses, whether the client secret ever reaches a browser, and whether a sandbox slip-up can touch a live account. None of this requires attacking PayPal’s platform. It is entirely about what your team built on top of it.
SCOPE
What we pen test on a PayPal integration
Server-side order verification
Whether your backend calls PayPal to capture or get the order rather than trusting a client-side onApprove callback, and what a forged or replayed success message achieves if it reaches your fulfilment code first.
Order and amount integrity
Whether the order total is recomputed server-side from your own catalogue and cart data before you call PayPal, rather than read back from a client-supplied value, and how currency or discount changes are handled between create and capture.
Webhook signature verification
Whether your listener checks the PAYPAL-TRANSMISSION-ID, PAYPAL-TRANSMISSION-SIG and PAYPAL-CERT-URL headers against your own stored webhook ID, using the verify-webhook-signature endpoint or the CRC32 self-check, rather than acting on whatever event_type arrives.
Capture and webhook idempotency
Whether a repeated PAYMENT.CAPTURE.COMPLETED event, or a retried capture call reusing the same PayPal-Request-Id, can trigger a second fulfilment, and what a duplicate or out-of-order webhook does to order state.
Refund and dispute authorisation
Who can trigger a refund against a capture, whether the amount and currency are checked against the original transaction, and whether one authenticated customer can act on another customer’s order or capture ID.
Account and payer binding
Whether the payer ID and email PayPal returns are checked against the authenticated session before an order is linked to an account, so a completed payment cannot be attached to a different customer by manipulating the order ID in the return flow.
Sandbox and live credential separation
Whether sandbox client IDs, secrets and webhook IDs can reach the live environment or vice versa, and what your integration does if a sandbox event is posted to the endpoint that expects live traffic.
Client ID and secret handling
Whether the client secret used to obtain an OAuth access token ever reaches browser-side code, how it is stored and rotated, and what an exposed client ID alone actually grants an attacker.
Approval and return-URL handling
How the return_url and cancel_url are validated on return from PayPal, whether the order ID in that redirect can be substituted for another customer’s order, and what happens if the cancel path is hit after a capture already succeeded.
Currency and multi-item cart integrity
Rounding and zero-decimal currency handling, mismatches between the purchase_units total and its item breakdown, and quantity or discount manipulation across multi-item carts assembled before the order is created.
OUR PROCESS
PayPal Integration Penetration Testing: From Scope to Attestation
Scope the integration
We list every PayPal touchpoint in your application: order creation, capture, webhooks, refunds and any stored payment methods, and confirm which credentials belong to sandbox and which belong to live.
Test against sandbox first
Order, capture, webhook and refund logic is tested against your PayPal sandbox accounts wherever the check allows; anything that genuinely needs live PayPal is agreed with you first and run read-only.
Exploit the business logic
CREST-certified testers chain findings across the order, webhook and refund flow, covering forged webhooks, amount tampering, replayed events and account-binding gaps rather than relying on scanner output alone.
Report and retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, free retest after remediation, and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST PayPal pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent PayPal Integration Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test PayPal For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From PayPal Integration Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need?
A sandbox client ID and secret for the integration under test, and a sandbox business and personal account pair. We do not need your live PayPal password or dashboard login, and only need scoped, read-only production access where a specific check requires it.
Does this touch live PayPal accounts or real transactions?
No, wherever the check allows. PayPal’s sandbox mirrors the live API and lets us run orders, captures, refunds and webhook events with mock money that never moves. Anything that must run against live PayPal is agreed with you in advance and scoped tightly.
How long does a PayPal integration test take?
A single integration is a 2-day scope. Multiple PayPal products in the same checkout, custom card fields, or a second payment provider sitting alongside PayPal add testing days, which we agree before the engagement starts.
We use the hosted Smart Buttons, not a custom checkout. Is there still anything to test?
Yes. The buttons remove some client-side risk, but order creation, capture, the return and cancel URLs and your webhook listener are still your code, and that is where the risk sits regardless of which checkout component renders the button.
What is out of scope?
PayPal’s own infrastructure, authentication systems and fraud engine. We test the integration your team built: your order and capture logic, your webhook endpoint, your credential handling and your refund authorisation, never PayPal’s platform itself.
Does PayPal have a policy on this kind of testing?
PayPal’s Developer Testing Agreement sets the Sandbox as the environment for testing PayPal-enabled services, using non-live data with no real money moving between accounts. We test against your sandbox credentials for exactly that reason, and treat any live-environment check as a separate, pre-agreed, read-only exception.
Do you test PayPal Subscriptions or Payouts as well as Checkout?
If your integration uses them, yes, they are scoped in alongside orders and webhooks. Tell us at quoting stage which PayPal products your application calls so the scope and day count reflect what is actually integrated.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your PayPal integration
PayPal moves the money. Your integration decides when an order counts as paid. We pen test the part you built: the order that gets marked as paid before your server has confirmed anything, the webhook a forged request could trigger, and the refund path with no check on who is asking. CREST-certified testers, fixed price from £3,120 for a 2-day single-integration scope, quoted within 24 hours.
