{"id":4980,"date":"2021-04-15T08:16:13","date_gmt":"2021-04-15T06:16:13","guid":{"rendered":"https:\/\/wp.pentestfactory.de\/testing-methods\/"},"modified":"2026-05-04T14:21:08","modified_gmt":"2026-05-04T12:21:08","slug":"testing-methods","status":"publish","type":"page","link":"https:\/\/www.pentestfactory.de\/en\/testing-methods\/","title":{"rendered":"Testing methods"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
approach<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Testing methods<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the field of offensive security the terms Black-, Grey and White-Box Testing are frequently used. But what do they mean?<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Term usage<\/h2>\t\t\t\t
\n\t\t\t\t\t

During a penetration test configuration or assessment, the terms Black-Box, Grey-Box and White-Box are frequently used.
They occur with the following pentests for instance:<\/p>\n\t\t\t\t<\/div>\n\t\t\t

<\/div><\/div><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Active Directory Assessment <\/h3>\n \t\t \t

Attacks without credentials (black-box), as a valid domain user (grey-box) or Domain Admin (white-box)<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Pentest of Applications <\/h3>\n \t\t \t

Test without credentials (black-box), as a regular application user (grey-box) or source code assisted (white-box)<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Scenario-based tests und assessments <\/h3>\n \t\t \t

Analysis without prior information or credentials (black-box) or with additional information and valid accounts (grey-box)<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n \n \n \n <\/i> <\/span>\n\n \n\n\n <\/div>\n

Black-Box<\/h2>\n \n

Perspective of an external attacker without knowledge about the target. The attacker does not have documentation nor credentials.<\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n \n \n \n <\/i> <\/span>\n\n \n\n\n <\/div>\n

Grey-Box<\/h2>\n \n

Perspective of an attacker with deeper knowledge of the target, e.g., a valid application user with access to the target.<\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n \n \n \n <\/i> <\/span>\n\n \n\n\n <\/div>\n

White-Box<\/h2>\n \n

Perspective of a developer or auditor with access to internal documents and the source code of the target.<\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n
\n
\n
<\/div>\n