Offensive Security Archetypes

The Archetypes & Specialized Classes of Hackers

Overview

Most hackers try to gain as much knowledge as they possibly can across many different domains. But the world of tech is such a rapidly evolving, unfathomably large body of information that learning every single aspect is impossible. That is why I created the "OSA": to standardize umbrella attack vectors (archetypes) and their specializations within each one (classes).

This list is best imagined as a skill tree, not a checklist. Hackers tend to follow a "T-shaped" learning model: knowledge starts broad and general, but due to the sheer volume of information, hackers zone in on specific classes as they improve. OSA aims to make that natural mental model easier to navigate and standardized.

An archetype earns its place on this list by one test: does it represent a distinct enough surface, toolset, and practitioner identity that people specialize in and build reputations around it? If a skill supports multiple archetypes rather than defining one on its own, it's a tool that travels, not an archetype itself. Every archetype below is a vector, something acted upon or exploited. This is not a ranked list, and no archetype is ordered above another.

The Hacker Archetypes & Classes

Web

  • Client Side — exploiting browser side trust and logic, like XSS or DOM based attacks

  • Server Side — exploiting backend logic and data handling, like SQLi or SSRF

  • API — exploiting programmatic interfaces through broken auth or schema abuse

Networks

  • Radio/Wireless — attacking Wi-Fi, Bluetooth, and RF communication

  • Active Directory — compromising enterprise identity and domain infrastructure

  • Protocol — manipulating routing and protocol level behavior, like ARP or DNS attacks

Cloud

  • IAM/Access — abusing permission and role misconfigurations

  • Container/Orchestration — escaping containers or exploiting Kubernetes

  • Serverless/Control-Plane — attacking cloud functions and provider level APIs

Social Engineering

  • Phishing/Vishing — mass remote manipulation through email or voice

  • OSINT - deep reconnaissance to build highly convincing attacks

  • On Site - live, in person manipulation and pretexting

Mobile

  • iOS - exploiting sandboxing, entitlements, and platform specific flaws

  • Android - exploiting the app layer and native code on Android

  • Mobile Web - exploiting hybrid and WebView based mobile apps

Crypto

  • Solidity/EVM - finding logic flaws in smart contract code itself

  • Bridge - exploiting cross chain and interoperability systems

  • Perceptual - Address poisoning, approval phishing, poisoned air drop

IoT

  • Firmware - extracting and analyzing device firmware

  • Hardware - attacking the physical device directly, like JTAG access or chip off

  • Embedded Protocols - exploiting device level communication like Zigbee or MQTT

Binary

  • Memory Corruption - weaponizing low level bugs like buffer overflows

  • Kernel - Kernel level exploitation

AI

  • Prompt Injection - prompt injecting an AI to perform unauthorized actions

  • Model Poisoning - corrupting weighting and training data sets to skew actions

Conclusion

Hackers use the T shaped learning model to stay generalists across archetypes, while zoning in on their respecting archetype and class. This list is also not fixed, it will evolve as the field does, and is open to pruning, editing, or enhancement from any reader. The OSA is to help conceptualize the distinct roles hackers can take, encounter, and how to help conceptualize their own T shaped learning model.