What types of pentests exist? Blackbox, Greybox, Whitebox explained

Types of Penetration Tests

The broad types of penetration testing can be divided into black box, gray box and white box categories. In addition, you are increasingly seeing terms such as “mobile penetration test” or “API pentest” - these usually only contain statements about the target system, but not how the specific procedure is carried out.

Blackbox Pentest

A black box penetration test is usually a realistic way in which a company is attacked today. The attacker starts with no information and has to acquire it. For this purpose, various phases are passed through, which ultimately enable the attacker to carry out a successful cyberattack on the target. This approach is based heavily on military approaches, in which a lot of time is invested in reconnaissance and information gathering before the actual attack. Various sources can be used here. As a rule, the attacker has no internal information here.

Depending on the type of order, an information gathering phase is often not really necessary because, for example, the so-called scope is a specific application and the tester's job is to look for security gaps from the outside.

Greybox-Pentest

Penetration tests that follow the gray box approach are often similar to the classic black box pen test. Here, however, the tester has the opportunity to obtain certain information. For example, he is granted part of source code, documentation, API schema, access data to accounts with few rights. There is often close collaboration with the customer, who provides further information depending on the situation.

Here, too, the goal is to concentrate on what is actually important: finding relevant security gaps in the system being tested, without losing time in the reconnaissance phase. Typically, this approach has the best cost-benefit ratio. Find out more in out article "How much does a penetration test really cost?"

Whitebox-Pentest

In a white box pen test, all information is made available to the testers. This allows the tester to get a comprehensive picture of the system being tested, it is clear how it communicates with other systems and, thanks to the source code that is usually available, even complex security gaps can be found. It is to be expected that the results here will be particularly good. The disadvantage, however, is that the white box test can often be very lengthy and therefore expensive.