Mobile application security audit, penetraton testing

White Box vs. Black Box Penetration Testing

When it comes to hacking, there are many technical aspects that can be difficult to grasp without an extensive background in the field. One of the most common sources of confusion is the comparison between black box penetration testing and white box penetration testing.

White Box Penetration Testing

White box penetration testing can also be called glass box penetration testing or clear box penetration testing. In any case, it's an approach to penetration testing that relies on the knowledge of the target system's internal configuration. It uses this information for the test cases.

For applications, the source code of the application will usually be provided for white box penetration testing. Design information and even interviews with the developers may also be included. For infrastructure penetration tests using the white box method, the test cases will use infrastructure details and network maps.

Regardless of the test case, the goal of a white box penetration test is to get as much info as can be had. The penetration tester is trying to collect as much feedback as they can so that they can gain further insight and, ultimately, understand the system so that they can further elaborate their penetration tests.

Black Box Penetration Testing

A black box penetration test does not require any up-front information to be given to the penetration tester. Instead, the penetration tester will approach the test case like a real hacker would. This means they have little to no background information about the system and they don't have internal maps or other information either.

This allows testing to get started with very little prep work, and it allows the penetration tester to identify weak spots based on what a real-world hacker is most likely to target. However, that can leave some spots of the infrastructure untested.

Making a Decision

Each method has its own set of advantages and drawbacks.

For white box tests, the advantages include:

  • White box penetration tests are deep and thorough
  • These tests maximize the use of time spent testing
  • The testing area tests even areas that black box testing can't reach, like the quality of the code

For black box tests, the advantages include:

  • A black box test is a more realistic attack because it takes the stance of a non-informed potential attacker.
  • It simulates a very realistic scenario, helping a business be on their highest guard.

The biggest disadvantage to a black box penetration test, of course, is that some scenarios can't maximize testing time. Some areas of the infrastructure may also remain unreached and, therefore, untested in a black box scenario. But, the testing of a black box penetration will focus on the areas hackers are most realistically likely to target.

Keeping all of this in mind, there is no right or wrong decision when it comes to choosing a type of penetration testing. It really depends on the scenarios you are looking to test and what you feel will make the most of your resources.

About the Author

Pavel Enderle

Sales Executive at TeskaLabs




You Might Be Interested in Reading These Articles

You Can Build Apps for the Apple TV, But Do You Know How to Do It Securely?

Apple will want to dominate the market for TV apps. To achieve this objective, it’s understandable that Apple makes it easy for app developers to create apps and games for the Apple TV platform using tvOS and profit from them just as they have already done so for the iPhone and iPad devices. Developers can leverage similar frameworks and technologies since tvOS is just a modified version of the iOS. They can even retrofit the apps that were previously developed for iOS to support the Apple TV’s tvOS.

Continue reading ...

mobile security

Published on June 29, 2016

TeskaLabs SeaCat PKI deployment for NordicWay C-ITS pilot in Norway

In many respects, today's motor vehicles function as connected devices. With this in consideration, joint EU initiatives have broadened the impact of Cooperative Intelligent Transport Systems (C-ITS) to include more expanded connections, including road infrastructure. This enhanced connectivity is expected to result in significant improvements to both road safety and traffic efficiency.

Continue reading ...

press automotive c-its v2x security

Published on June 15, 2021

How to Teach Your Kids to Safely Play Pokemon GO

This summer something strange has occurred in my household. Suddenly, all of my children ranging in age from 9 to 18 are willingly piling into our van the minute I mention driving anywhere- even to the grocery store. And it’s not my company or the possibility of picking out this week’s cereal they are seeking. No, they are merely wanting a ride to aid them on their hunt for elusive Pokémon.

Continue reading ...

security mobile musing

Published on August 30, 2016