‫Now, one of the basic questions of a penetration test is what should a pen tester, I think you understand
‫the word by now, the person who performs the pen test.
‫What should the pen tester know about this system that he or she will test?
‫There are typically different approaches, according to the knowledge that the pen testers have.
‫A black box pen test requires no previous information and usually takes the approach of an uninformed
‫attacker in a black box pen test, the pen tester has no previous information about the target system.
‫Wide box testing is a pen testing approach that uses the knowledge of the internals of the target system
‫to elaborate that test cases, for example, in application pen testing, the source code of the application
‫is usually provided along with design information or in an infrastructure bend test, network maps,
‫infrastructure details, etc. are provided.
‫The goal of a white box pen test is to provide as much information as possible to the pen tester so
‫that he or she can gain insight, understanding of the system and elaborate the test based on that.
‫Of course, each approach has some advantages as well as some disadvantages.
‫So let's have a look at that now.
‫The advantage of a black box pen test is that it simulates a very realistic scenario.
‫And these are the disadvantages of the black box pen test.
‫Testing time cannot be maximized in certain scenarios.
‫Some areas of the infrastructure might remain untested.
‫The advantages of a white box bend test are you can perform a deep and thorough test.
‫It maximizes the testing time, so you don't need to spend time to find out the system information.
‫It extends the testing area where black box testing cannot reach, such as the quality of code, application
‫design, et cetera.
‫Now, some people might think that the white box approach is not realistic as the pen testers.
‫Well, just not in the same position as a non informed potential attacker.
‫Don't agree with this, though, because there might be some inside attackers or a hacker might have
‫access on an insiders computer, and he or she can potentially learn all the information of the system.
‫Got it!