Types of Penetration Testing Explained Network, Web, Mobile & Cloud

What Are the Main Types of Penetration Testing?

A separate classification — black-box, white-box, and gray-box — describes how much prior knowledge the tester is given, and applies across any of the domain types above rather than being a type on its own. For a full breakdown of that classification, see AimNxt's guide on what VAPT is.

What Is Network Penetration Testing?

Network penetration testing targets an organization's routers, switches, firewalls, servers, and internal network infrastructure to find misconfigurations and exploitable services. It's typically the first type organizations run because network weaknesses — open ports, weak protocols, unpatched services — are often the easiest entry point for an attacker to gain a foothold.

This is also the type most closely tied to the six-phase VAPT process — reconnaissance, scanning, exploitation, post-exploitation, and reporting — since a network test usually has the widest scope and the clearest path from a single open port to full internal access.

What Is Web Application Penetration Testing?

Web application penetration testing examines a website or web app for OWASP Top 10 issues like SQL injection, cross-site scripting, and broken authentication, alongside business-logic flaws that automated scanners miss. Because most customer-facing breaches start here, it's usually the highest-priority test for any organization running a public website or SaaS product.

What Is API Penetration Testing?

API penetration testing focuses on REST and GraphQL endpoints, targeting broken object-level authorization, excessive data exposure, and predictable IDs that let attackers access other users' data. It's the fastest-growing pentest category because most modern web and mobile apps run on APIs the browser never directly shows.

The OWASP API Security Top 10 is the standard reference framework testers use to structure an API assessment, and it's increasingly treated as a separate line item in pentest scopes rather than folded into a general web application test.

What Is Mobile Application Penetration Testing?

Mobile application penetration testing examines Android and iOS apps for insecure local data storage, weak API communication, and reverse-engineering risks specific to a device environment. It typically pairs with API testing, since most mobile apps are really a thin client talking to a backend that also needs its own assessment.

Testers commonly decompile the app package itself to check for hardcoded secrets, weak certificate pinning, and insecure data caching — issues that never show up in a web-only assessment because they depend entirely on how the app behaves on the physical device, not just what the server returns.

What Is Cloud Penetration Testing?

Cloud penetration testing checks AWS, Azure, or GCP environments for misconfigured storage buckets, overly broad IAM permissions, and exposed management consoles — issues a traditional network test won't catch. It's split into IaaS, PaaS, and SaaS testing depending on how much of the stack the cloud provider manages versus the customer.

Beyond these five core domains, three more specialized types round out a full VAPT program:

Most organizations don't need all eight types every year — the right mix depends on what's actually exposed. A company with no public-facing app might prioritize network and social engineering testing, while a SaaS company will lean almost entirely into web, API, and cloud testing.

What Is the Difference Between Internal and External Penetration Testing?

External penetration testing simulates an attacker with no internal access, probing only what's exposed to the internet. Internal penetration testing simulates an attacker — or a compromised employee account — already inside the network, which is why it usually uncovers far more critical findings.

The NIST SP 800-115 Technical Guide to Information Security Testing is a commonly cited reference for how organizations should scope and document both internal and external engagements consistently.

Many organizations run external testing more frequently — sometimes quarterly — because it's cheaper and faster, then schedule a deeper internal engagement annually or after a major infrastructure change, since internal testing usually requires more coordination with IT and a wider testing window.

How Does AimNxt Train You Across These Testing Types?

AimNxt's VAPT & Ethical Hacking program trains students hands-on across network, web, API, mobile, and cloud testing within a single 4-month curriculum, using real tools like Burp Suite, Nessus, and Metasploit in dedicated labs. The program closes with a capstone engagement covering multiple testing types in one project.

For the full 15-module curriculum breakdown, see AimNxt's guide on what a penetration testing course covers, and for the career and pay outlook once these skills are learned, see how to become a penetration tester.