Types of Penetration Tests
The broad types of penetration testing can be divided into black box, gray box and white box categories. In addition, you are increasingly seeing terms such as “mobile penetration test” or “API pentest” - these usually only contain statements about the target system, but not how the specific procedure is carried out.
Blackbox Pentest
A black box penetration test is usually a realistic way in which a company is attacked today. The attacker starts with no information and has to acquire it. For this purpose, various phases are passed through, which ultimately enable the attacker to carry out a successful cyberattack on the target. This approach is based heavily on military approaches, in which a lot of time is invested in reconnaissance and information gathering before the actual attack. Various sources can be used here. As a rule, the attacker has no internal information here.
Depending on the type of order, an information gathering phase is often not really necessary because, for example, the so-called scope is a specific application and the tester's job is to look for security gaps from the outside.
Greybox-Pentest
Penetration tests that follow the gray box approach are often similar to the classic black box pen test. Here, however, the tester has the opportunity to obtain certain information. For example, he is granted part of source code, documentation, API schema, access data to accounts with few rights. There is often close collaboration with the customer, who provides further information depending on the situation.
Here, too, the goal is to concentrate on what is actually important: finding relevant security gaps in the system being tested, without losing time in the reconnaissance phase. Typically, this approach has the best cost-benefit ratio. Find out more in out article "How much does a penetration test really cost?"
Whitebox-Pentest
In a white box pen test, all information is made available to the testers. This allows the tester to get a comprehensive picture of the system being tested, it is clear how it communicates with other systems and, thanks to the source code that is usually available, even complex security gaps can be found. It is to be expected that the results here will be particularly good. The disadvantage, however, is that the white box test can often be very lengthy and therefore expensive.
What are the pros and cons of all pentest-types?
Blackbox | Greybox | Whitebox | |
---|---|---|---|
Goals | Simulation of a realistic external attack and identification of external vulnerabilities. | Simulation of a partially informed attack and identification of vulnerabilities with limited knowledge. | Comprehensive analysis of the system and identification of internal and external and external weaknesses. |
Initial situation | No prior knowledge and no access to internal resources | Limited prior knowledge and access to internal resources | Full access to all resources and source codes |
Advantages | Realistic simulation of a cyberattack No internal influence |
Combines elements of black and white box tests More efficient identification of vulnerabilities |
In-depth analysis possible Identification of vulnerabilities in source codes and configurations |
Disadvantages | Potential overlooking of internal & more complex vulnerabilities. | Possibly not as profound as a whitebox test. | Requires a lot of time and only simulates realistic attack scenarios to a limited extent. |
Time effort | Low | Medium | High |
Get a pentest offer