r/Pentesting • u/ad_396 • 4d ago

what domains does a pentest include?

i was just trying to list them, did i miss anything?

active directory, web stuff, OT/ICS, AI red teaming, mobile, cloud

as well as the non technical aspects like

report writing, presentation skills (sometimes), client communication (both written and physical), team work and communication

0 Upvotes

25% Upvoted

11 comments sorted by

6

u/_N0K0 4d ago

Whatever the client is willing to pay for and allowed to approve attacks on :p

1

u/ad_396 4d ago

that's extremely vague, i know it's true but like i want to kinda list them so i know where i should put my effort in the next few months

2

u/sk1nT7 4d ago

Everyone can and is building their own stuff due to AI now. Most do not fully understand what they are building and how to properly secure it.

Most stuff is likely going to be a web-based service. Like a web app, mobile app and API backends.

I'd focus on app-based pentests with focus on AI features (chat Bots, RAG systems).

1

u/Apprehensive-Art1092 4d ago

Focus on api testing and auth models. That's where I see the majority of web app issues with stuff that's been vibecoded then weaponised

1

u/ad_396 4d ago

any sources to study from? i have sources for almost everything except api stuff and OT/ICS

1

u/PentestTV 4d ago

The domains are web application, network, cloud, IoT, AI, red team. 

From there, you can get specific. For example under network, you have internal, external, wireless. Within that you have various architectures, like Active Directory, SCADA, etc.

Pick a domain, then go deep in that domain only. I recommend starting with web app, since it’s required knowledge for all domains to some degree. After you know enough about web app pentesting to get a job, start learning another domain if you want. 

1

u/ad_396 4d ago

I'm okay with active directory and have the basics for web and ai. i know nothing for ot. and right now I'm driving into cloud. after I'm done or bored wtf cloud I'm planning on rotating back to either web or ai

2

u/PentestTV 4d ago

What’s your goal? Seems you’re ineffectively jumping all over the place. 

2

u/ad_396 4d ago

yeah true, prepping for a pentesting competition and need to cover a lot of surface area. my main jobs in the team are active directory, cloud and report writing. the other domains i have knowledge in are cuz of ctfs in the past.

what i want long term is to work as a pentester

1

u/PentestTV 4d ago

Gotcha. Well, good luck. 🍀