Penetration testers inspect many different application functionalities, but the main parameters are: Architecture design Network communication Data storage Privacy Authentication and session controls Misconfiguration errors in code