It is good to define an attack surface before security testing.
Different places to attack:
- Open pages & services (like login)
- Attack to underlying layers/servers/etc
- Attack to other users
Different kind of attacks:
- Owasp list attacks (XSS, injection, ...)
- Burte force, DoS
So I was wondering what methods do you use? Attack surface analyzing is a part of for example Microsoft's The Security Development Lifecycle (SDL).