Black box testing is one of several types of penetration tests.
This is part 2 of the blog post about Penetration Tests. You can see part 1 here.
White, Gray, and Black Box Testing
It’s common to identify testing based on the level of knowledge the testers have prior to starting the test. These testers could be internal employees, or external security professionals working for a third-party organization to perform the test. The three types of testing are:
- Black box testing. Testers have zero knowledge of the environment prior to the test. Instead, they approach the test with the same knowledge as an attacker. When testing applications, black box testers wouldn’t have any prior experience with the application. When testing networks, they aren’t provided any information on the network before the test. This includes a lack of documentation and a lack of experience. Black box testers often use fuzzing to check for application vulnerabilities.
- White box testing. Testers have full knowledge of the environment. For example, they would have access to product documentation, source code, and possibly even logon details.
- Gray box testing. Testers have some knowledge of the environment but do not have access to all documentation or data.
Black box testers have zero prior knowledge of the system prior to a penetration test. White box testers have full knowledge, and gray box testers have some knowledge. Black box testers often use fuzzing.
You may also come across the terms black hat, white hat, and gray hat. These aren’t referring to testers but instead to different types of attackers. They are reminiscent of the Wild West, where you could easily identify the good guys and the bad guys by the color of their hat.
- Black hat identifies a malicious attacker performing criminal activities.
- White hat identifies a security professional working within the law.
- Gray hat identifies individuals who may have good intentions but their activities may cross ethical lines. For example, an activist, sometimes called a hacktivist, may use attack methods to further a cause, but not for personal gain.
CompTIA Security+ Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide
is an update to the top-selling SY0-201, SY0-301, SY0-401, and SY0-501 study guides, which have helped thousands of readers pass the exam the first time they took it. It includes the same elements readers raved about in the previous four versions.
Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Kindle edition also available.
Hackers and crackers are terms you may also come across. Originally, a hacker indicated someone proficient with computers who wanted to share knowledge with others. They weren’t malicious. In contrast, a cracker was a proficient hacker who used the knowledge for malicious purposes. However, English is a living language that continues to evolve and the media consistently uses the term hacker to identify malicious attackers. For clarity, this book uses the term attacker to identify an individual attacking a system for malicious purposes.
Security+ (SY0-601) Practice Test Questions
SY0-601 Practice Test Questions
Over 385 realistic Security+ practice test questions
At least 10 performance-based questions
All questions include explanations so you’ll know why the correct answers are correct,
and why the incorrect answers are incorrect.
Upgrade Your Resume with the Security+ New Version
Multiple quiz formats to let you use these questions based on the way you learn.
- Learn mode – randomized. View each of the questions in random order. Learn mode allows you to keep selecting answers until you select the correct answer. Once you select the correct answer, you’ll see the explanation. Click here to see how learn mode works.
- Test mode – randomized. View each of the questions in random order. In test mode, you can only see the correct answers and explanations after you complete the test. Click here to see how test mode works.
- Test mode – 75 random questions. View 75 random questions from the full test bank similar to how the Security+ exam has a potential maximum of 75 multiple choice questions.
Pass the First Time You Take It
Get the full bank of SY0-601 Practice Test Questions Here
Click here if you’re looking for SY0-501 Online Study Package
See Chapter 8 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on penetration tests.