There is still creativity at the edges (devising new exploits, figuring out how to defeat an input santiser) but day-to-day pentesting work is pretty mundane: y

There is still creativity at the edges (devising new exploits, figuring out how to defeat an input santiser) but day-to-day pentesting work is pretty mundane: you go through all the ports, services, API endpoints looking for standard vulnerablities (CSRF, XSS, SQL injection), look for common login and session issues, if you see XML or file upload you try some standard ways of subverting those, and you test for access control or application logic errors. Proxies like Burp can make it easy to intercept and modify requests or replay them with different sessions.