The Security of a Company Starts with Penetration Tests
Everything you need to know about the different types of Penetration Tests!
Everything you need to know about the different types of Penetration Tests!
Security is an important issue for any company, regardless of its size or industry. A crucial first step in improving security is often a Penetration Test. In our second article, we will find out what a Penetration Test is and what different types of Penetration Tests there are.
A Penetration Test is a security test in which an expert, also known as a "Pentester," attempts to check a system (such as servers, networks, and applications) for vulnerabilities that would allow them to test various attack vectors. This can include acquiring data, taking over the entire system, etc. The testers should think and act like real attackers to achieve realistic results. The attacks are documented, and the results are evaluated to provide the client with a risk assessment and necessary actions to fix the identified vulnerabilities.
Penetration Tests are divided into three categories: Black Box, White Box, or Grey Box. But how can this classification help in deciding on the appropriate Penetration Test? The choice of the Pentest type determines the depth or potential of the results achieved. Depending on the scenario chosen for the Penetration Test, also determines the focus and possible vulnerabilities that can be discovered during the test. Another factor influencing the choice of a Penetration test is, for example, economic benefit (effort, cost).
This is a type of Penetration Testing where the tester has minimal information, e.g., URL or IP, about the system to be tested. The Tester does not have access to internal system documentation or source code but tries to attack the system from the perspective of an external attacker. This approach allows the tester to obtain a realistic assessment of the system's security. During the test, the tester tries to simulate various attack scenarios that an attacker would also use. Examples of attack vectors can be Cross-Site Scripting (XSS), SQL Injection, or Remote Code Execution (RCE). An example of a Black Box Penetration Test: A tester who receives the URL for a web portal consisting of only a login page, but otherwise offers no obvious attack points. The goal is to identify one or more vulnerabilities using various techniques, which may be combined into an attack vector.
White Box Penetration Testing refers to a type of Penetration Testing where the Tester has extended access to the system to be tested. The Tester has detailed information about the system, including access to internal documentation and source code. This approach allows the Tester to thoroughly examine the system's security and find specific vulnerabilities. An example of a White Box Penetration Testing method is static code analysis. This involves examining the source code of a system to identify potential vulnerabilities and attack points. This can be done using specialized tools and techniques that check the code for specific characteristics or anomalies. Another example is the Joint Code Review. In this case, the code review is conducted in a technical discussion, following the best practices of the OWASP-ASVS framework.
In Grey Box Penetration Testing, the Tester has some information about the system to be tested. The Tester may have access to API documentation or user access, for example. This approach allows the tester to execute more specific attacks on the system and find vulnerabilities. An example of a Grey Box test is the review of a web portal. The Tester receives access credentials for a regular user of the portal but does not have access to the source code or other internal details. The Tester checks for various types of vulnerabilities based on the OWASP Top-10, such as SQL Injection.
Penetration tests are an essential part of the security process for any company. They help uncover and fix vulnerabilities in systems and applications before real attackers can exploit them. The different types of penetration tests are suitable for various purposes and threat scenarios, and each company should select the type of penetration test that best meets its needs.