After years of pen testing enterprise infrastructure, there are patterns. The same classes of vulnerabilities show up over and over — not because teams are bad, but because these bugs hide in blind spots of standard security tooling.

1. SSRF in internal microservices

Your WAF protects the front door. But service-to-service calls behind the load balancer? Most teams never test those. Attackers pivot through them to reach cloud metadata endpoints and credential stores.

2. Broken object-level authorization

You check if someone is authenticated. But do you check if user A can access user B's data? BOLA is the #1 finding on API pen tests — automated scanners almost never catch it.

3. Dependency confusion in CI/CD

If your build pipeline pulls from both public and private registries without strict scoping, an attacker can publish a higher-versioned malicious package and your pipeline will install it.

4. Misconfigured cloud IAM policies

Overly permissive IAM roles with wildcard actions are everywhere. One compromised service account and the attacker owns your entire cloud.

5. Subdomain takeover via dangling DNS

Old CNAME records pointing to decommissioned services? Free real estate for phishing pages on your domain, inheriting your SSL cert and brand trust.

These aren't exotic zero-days. They're configuration gaps that automated scanners miss but manual testing catches every time.

That's what we do at HexHunt.