Performing penetration tests on web applications

Directly interacting with the target's application

Analyzing the target’s infrastructure without arousing suspicion

Testing for specific vulnerabilities