Penetration testing attack vectors

One of our collaborators is planning a penetration test next week and has asked for a list of attack vectors to try to exploit. Where others have done a penetration test, what areas did you test? Does anyone have anything specific they’d like to be added to the test?