Penetration testing is an activity that involves in-depth
analysis of website or network to uncover hidden vulnerabilities. A penetration
tester actually performs the exploit to create a proof-of concept for the
weakness and opposed to vulnerability assessment that limits itself to scanning
resources to identify vulnerabilities.
Across the Globe, Penetration Testing is considered illegal
if not authorized by the host organization.
Types of Penetration Testing
1. White Box / Full
knowledge test. The penetration testing team has as much knowledge as possible
about the systems to be evaluated. This penetration test simulates the possible
attacks that might be mounted by a person with knowledge about the victim, eg
employees, vendors etc.
2. Gray Box / Partial knowledge test. The testing personnel
will be provided with some information that is related to the specific type of
information vulnerability that is desired.
This knowledge is usually constrained to detailed design documents and
architecture diagrams. It is a combination of Black Box Testing method and
White Box Testing method.
3. Black Box / Zero knowledge test. The testing team is
provided with no specific information and begins the testing by gathering
information on its own initiative. Information gathering activities like
reconnaissance and social engineering are some ways of collecting information.
This type of test closely links with the hacker’s methodology.
The testing approach chosen depends on a number of factors,
including time available for the assessment, knowledge and access to internal
application resources and the identified goals of the test.
Typically a type pf penetration test is chosen based on the
following:
1. Tests intended to broadly approximate the
short-term efforts of targeted attackers with limited resources and knowledge
can be conducted using black box methodologies.
2.
Tests intended to reflect longer-term efforts by
attackers who have more significant resources like design documents, used
technology, algorithms and architecture diagrams; gray box tests can help to
reflect on the knowledge that attackers need about application internals to
expend the full amount of resources that would be available to attackers.
3.
Teams that need to make the most detailed and insightful
future recommendations about applications within a limited amount of time
should use white or clear box testing.