Black Box Testing and More
Black box testing is one of several types of penetration tests.
This is part 2 of the blog post about Penetration Tests. You can see part 1 here.
White, Gray, and Black Box Testing
It’s common to identify testing based on the level of knowledge the testers have prior to starting the test. These testers could be internal employees, or external security professionals working for a third-party organization to perform the test. The three types of testing are:
- Black box testing. Testers have zero knowledge of the environment prior to the test. Instead, they approach the test with the same knowledge as an attacker. When testing applications, black box testers wouldn’t have any prior experience with the application. When testing networks, they aren’t provided any information on the network before the test. This includes a lack of documentation and a lack of experience. Black box testers often use fuzzing to check for application vulnerabilities.
- White box testing. Testers have full knowledge of the environment. For example, they would have access to product documentation, source code, and possibly even logon details.
- Gray box testing. Testers have some knowledge of the environment but do not have access to all documentation or data.
Black box testers have zero prior knowledge of the system prior to a penetration test. White box testers have full knowledge, and gray box testers have some knowledge. Black box testers often use fuzzing.
You may also come across the terms black hat, white hat, and gray hat. These aren’t referring to testers but instead to different types of attackers. They are reminiscent of the Wild West, where you could easily identify the good guys and the bad guys by the color of their hat.
- Black hat identifies a malicious attacker performing criminal activities.
- White hat identifies a security professional working within the law.
- Gray hat identifies individuals who may have good intentions but their activities may cross ethical lines. For example, an activist, sometimes called a hacktivist, may use attack methods to further a cause, but not for personal gain.
Hackers and crackers are terms you may also come across. Originally, a hacker indicated someone proficient with computers who wanted to share knowledge with others. They weren’t malicious. In contrast, a cracker was a proficient hacker who used the knowledge for malicious purposes. However, English is a living language that continues to evolve and the media consistently uses the term hacker to identify malicious attackers. For clarity, this book uses the term attacker to identify an individual attacking a system for malicious purposes.