Penetration testing is a safe imitation of a hacker attack to prevent them in the future.
The test has lots of variations. But the main criterion is that the hacker is aware of the attacked object.
Depending on the degree of his awareness, there may be one of the following techniques:
“Black-box”. The black-box testing involves imitating the hacker’s actions who has no information about the company and its corporate network. This is exactly how most hackers are forced to act by going through all the available tools to identify and exploit vulnerabilities in the security system. In most cases, they do find trap doors.
“White-box”. That’s the completely opposite end of the “black” version. White-box testing plays out a scenario where you are attacked by a hacker who has been given access to everything, such as the network architecture and the security system. In real-life situations, this can often be a current or former employee using their own account. In the worst case, the hacker also has administrator rights.
“Gray-box”. The gray-box testing is an intermediate option when the hacker does not have the entire picture, but still aware of important aspects. This can be an ordinary employee or a client with basic access to the system and limited information about your network, or a third-party hacker who has got information that will help him select the appropriate attack vector.
Why black-box testing? Wouldn’t it be better to hack the system knowing everything about it? Sometimes it can play into the hands. But you need to understand that for one well-aware and strategy-thinking hacker dozens of hackers that act by guessing and putting forth their entire arsenal. The black box pentest is about these people. By the way, awareness also has a downside. Your experts can be confident in some aspects of security and bypass them by making your auditors aware. But unchecked aspects may have the trap-doors. The black-box eliminates blinkered vision, that’s why information security experts will carry out full-scale testing of the system.
A pentest, just like real hacking, has 3 key stages:
Scanning. After hackers have found the company’s network entry points, they consider the IDS and IPS systems, routers, ports, firewalls, and operating systems, looking for common software and hardware vulnerabilities.
Preparation of hacking. Found loopholes in the security suggest where and how to attack and, accordingly, the tools that may be needed. In the case of a real hack, these are exploits, and in the case of a pentest, they are the same, but they don’t carry any malicious components.
Hacking. The company is attacked by a multi-vector attack using all protocols and communication channels. It is targeted not only at the internal network but also at the external services associated with it.
Therefore, according to its classical definition black-box penetration testing is a comprehensive penetration test on all kinds of data sets.
Otherwise speaking, if the system has security vulnerabilities, they will most likely be discovered.
This is one of the rare occasions when you can see all the issues by acting blindly.