The costing of the whole web app VAPT depends on the number of days it takes for the ethical hacker to identify weaknesses and hack them. The cost essentially depends on the time taken to thoroughly evaluate app weaknesses.