Types of VAPT: Web, Mobile, Network, API and Cloud Explained

VAPT is not one test. A company that asks for "a VAPT" usually means a vulnerability assessment and penetration test of one thing: a website, a mobile app, an office network. What changes from one job to the next is the target, and the target decides the tools, the skills and the report. This guide lists the types you will meet and how each is done.

Two Ways to Sort VAPT: By Target and by Knowledge

By target is the usual way: web application, API, mobile app, thick client, internal network, external network, wireless and cloud configuration. By knowledge describes what the tester is told before starting. In a black-box test the tester gets only a name or an address, like an outsider. In a grey-box test the tester gets some access, such as a normal user account. In a white-box test the tester also gets documents or source code. Grey box is common because it finds more in the same time.

If the words vulnerability assessment and penetration test are new, read what VAPT is first.

Web Application VAPT

The target is a website or web portal. The tester maps the application, then checks logins and sessions, access control, input handling and business rules, usually following the OWASP Top 10 and the OWASP Web Security Testing Guide. Typical findings are SQL injection, cross-site scripting and IDOR. The main tool is an intercepting proxy such as Burp Suite.

API VAPT

Modern apps talk to servers through APIs, and many flaws live there: one user reading another user's data, missing limits, weak tokens. API testing follows the OWASP API Security Top 10 and often includes GraphQL and JWT checks.

Mobile Application VAPT

For an Android or iOS app the tester looks at the app package, the data it stores on the phone, how it talks to its server and how it protects itself. The reference documents are the OWASP MASVS and MASTG. Our guide to Android app penetration testing shows the method.

Thick-Client VAPT

A thick client is a desktop program that does real work on the user's machine and talks to a server or database, such as an accounting or billing tool. It is tested for local storage of secrets, weak server communication and tampering. See thick-client penetration testing explained.

Network VAPT: Internal and External

An external test attacks what the internet can reach: servers, firewalls, VPN gateways. An internal test starts from inside the office network, as a visitor with a cable or a compromised laptop would, and often centres on Active Directory. The method follows the phases of a penetration test: discovery with Nmap, assessment with a scanner such as Nessus, then manual validation and, where agreed, exploitation and pivoting. See Active Directory attacks for the usual internal path.

Wireless VAPT

This checks an organisation's Wi-Fi: the encryption in use, weak passphrases, rogue access points and whether guest and office networks are really separate. It is done on site, with permission, on the client's own equipment.

Cloud VAPT

Cloud testing is mostly configuration review: public storage, over-wide permissions, exposed keys, missing logging. It depends on the provider's rules for testing and on who is responsible for what, which our guide to the shared responsibility model explains. We should be plain about our own scope: the courses below teach web, API, Android, thick-client, network, Active Directory and wireless testing, and do not teach cloud penetration testing.

Which Type Should a Learner Start With?

Most learners start with web and API testing, because the lab is cheap, the flaws are well documented and every company has web applications. Network and Active Directory testing is the natural second step. In our VAPT Track the Application Security course covers web, API, Android and thick-client testing, and the Network and Active Directory course covers the rest. Each course is ₹20,000 + GST, and the track of both is ₹30,000 + GST.

Sources and Further Reading

• OWASP Web Security Testing Guide
• OWASP Mobile Application Security (MASVS and MASTG)
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment