Domain overview
Advanced work means changing the model, not just the tooling. Cloud, mobile, identity, supply chain, AI and OT all require different assumptions, different evidence and different operator choices.
Related certification context
These certifications map to parts of the specialist surface collected here.
- OffSec OSAI+ / AI-300Dedicated AI red teaming across LLMs, agents and AI infrastructure.
- OffSec OSWE / WEB-300Useful for API- and source-guided exploitation in complex web-backed systems.
- OffSec OSEP / PEN-300Useful for mature operator workflow where specialist targets intersect with internal operations.
Specialist field briefs
Direct routes into the original advanced collection, preserved for fast discovery and complete topic coverage.
API Pentesting
API Pentesting: object authorization, token trust, schema behavior and workflow controls at service boundaries.
Cloud Pentesting (Azure, AWS, GCP)
Cloud Pentesting (Azure, AWS, GCP): control-plane permissions, workload identity, automation and configuration drift across modern infrastructure.
eMAPT - Mobile Pentesting Certification
eMAPT - Mobile Pentesting Certification: certification scope, expected competencies and a practical route from objectives to hands-on validation.
Game Pentesting
Game Pentesting: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Introduction
Introduction: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
IoT Pentesting
IoT Pentesting: device identity, firmware provenance, communications trust and safety-relevant command paths.
JWT Token Pentesting
JWT Token Pentesting: object authorization, token trust, schema behavior and workflow controls at service boundaries.
LLM (Large Language Models) Pentesting
LLM (Large Language Models) Pentesting: prompt boundaries, retrieval trust, tool invocation and model-backed application behavior.
Mobile Pentesting
Mobile Pentesting: client storage, platform trust, runtime instrumentation and transport behavior across mobile applications.
Microsoft Exchange testing
Microsoft Exchange testing: service exposure, credentials, segmentation and controlled movement across internal infrastructure.
OT Pentesting
OT Pentesting: industrial communications, engineering trust, segmentation and safety constraints where availability matters.
OWASP API Top 10
OWASP API Top 10: object authorization, token trust, schema behavior and workflow controls at service boundaries.
OWASP Mobile Top 10
OWASP Mobile Top 10: client storage, platform trust, runtime instrumentation and transport behavior across mobile applications.
SAP Pentesting
SAP Pentesting: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Tenable.io
Tenable.io: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Vulnerability Assessment With Nessus
Vulnerability Assessment With Nessus: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Vulnerability Assessment With Nexpose And Metasploit Pro
Vulnerability Assessment With Nexpose And Metasploit Pro: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Vulnerability Assessment With OpenVAS
Vulnerability Assessment With OpenVAS: specialist assessment context, safe validation choices and evidence requirements beyond routine application testing.
Selected public references
- OWASP API Securityowasp.org/www-project-api-security/
- OWASP MASmas.owasp.org/
- OWASP API Security Top 10 2023owasp.org/API-Security/editions/2023/en/0x00-header/
- OWASP MAS · MASVSmas.owasp.org/MASVS/
- PortSwigger · JWTportswigger.net/web-security/jwt
- Frida Documentationfrida.re/docs/home/
- GitHub · MobSF / Mobile-Security-Framework-MobSFgithub.com/MobSF/Mobile-Security-Framework-MobSF
- Microsoft Learn · Exchangelearn.microsoft.com/en-us/exchange/
- PX4 Documentationdocs.px4.io/
- MAVLink Developer Guidemavlink.io/en/
- ArduPilot Developer Documentationardupilot.org/dev/
Domain index
Cloud Offensive Security
Cloud IAM, exposed control planes, workload identity and configuration drift across Azure, AWS, GCP and Kubernetes.
API Security
Object authorization, token handling, schema exposure, workflow abuse and rate-control failures across modern APIs.
Mobile App Pentesting
Mobile application behavior under instrumentation, local-state review and transport validation.
Identity / Entra / Okta / SSO Abuse
Identity flows, token trust, consent behavior and federation-linked privilege paths.
Adversary Emulation / Tradecraft
Threat-informed emulation plans, delivery chains, command infrastructure and detection objectives for controlled exercises.
DevSecOps / Supply Chain / CI-CD
Build systems, repositories, runners, packages, artifacts and the trust paths that ship software.
OT / ICS Security
Industrial protocols, engineering trust and process-level exposure in operational environments.
AI Security
Model-backed attack paths across prompts, retrieval, orchestration and tool invocation.
Drone / Robotics Security
Vehicle links, telemetry, ground control, firmware trust and safety-critical robotic systems.