In a black-box engagement, the tester does not have access to any internal information and is not granted internal access to the client’s applications or network. It is the job of the tester to perform all reconnaissance to obtain the sensitive knowledge needed to proceed, which places them in a role as close to the typical attacker as possible. This type of testing is the most realistic, but also requires a great deal of time and has the greatest potential to overlook a vulnerability that exists within the internal part of network or application. A real-life attacker does not have any time constraints and can take months to develop an attack plan waiting for the right opportunity.
An engagement that allows a higher level of access and increased internal knowledge falls into the category of gray-box testing. Comparatively, a black-box tester begins the engagement from a strict external viewpoint attempting to get in, while the gray-box tester has already been granted some internal access and knowledge that may come in the form of lower-level credentials, application logic flow charts, or network infrastructure maps. Gray-box testing can simulate an attacker that has already penetrated the perimeter and has some form of internal access to the network.
Nullam quis risus eget urna mollis ornare vel eu leo. Aenean lacinia bibendum nulla sed