Before performing a penetration test, the question arises as to how the pentest should be performed. Here, pentesters distinguish between the following approaches:
- Blackbox test
- Whitebox test
- Graybox Text
Which test is best suited for an audit?
Black box or black box test
With this penetration test method, the pentester does not receive any information about the systems in operation, neither which firewall is in use nor which external services the company uses. Therefore, the pentester has to spend more time on research. For this purpose, pentesters also use background information about the company from the darknet and special search engines such as Shodan.
Customers like to use this testing approach to find out what information real hackers can find out about the company. For liability reasons, however, the customer must always disclose the actual IP addresses of its infrastructure, and authorize the audit company with a declaration of authorization for the pentest attack.
The advantages:
Disadvantages and the cost factor:
White box or white box test
During the whitebox test, there is an intensive exchange of information between the operator and the pentester about the IT infrastructure used, the security infrastructure, the IT services and authentication methods. Often, protective measures such as firewall IPS are disabled in advance to allow the security scan to run efficiently. To test web applications, the pentester often also receives different active user IDs to run within a web application, for example, the OWASP Top 10 attacks. Often the pentester also gets insight into source code or internal configurations.
This testing approach is very efficient! The pentester actively communicates with the customer and tests the IT services and applications in great depth. The results can go as far as recommendations for the software developers, as login functions, authentication and underlying algorithms are also discussed. By sharing information about the infrastructure, the pentester can make structural recommendations about network design and security infrastructure, which is often not possible with a black box test.
Many advantages:
Also disadvantages:
Graybox / Gray-Box Test
In this mixed form between white-box and black-box testing, partial knowledge about internal infrastructures is exchanged. This includes at least the relevance of the published services.
The advantages are obvious:
The disadvantages:
What does a pentest cost?
The cost of a penetration test also results from the time spent on the following services:
- The preparation time and arrangements with the customer.
- The setup of the security scanner and the automated scanning tools
- The time for the manual penetration tests into the customer’s systems by the pentester
- The report preparation and coordination of the draft report
- The final presentation
Small pentest projects can already be offered with an effort of 2–3 days due to the high degree of automation of phase 2. For black box tests, additional hours or days are needed for research. The turnaround time is usually around 1 week.
For medium-sized projects or more demanding IT services, 5–7 days or more should be invested in the pentest. The security scan includes, among other things, an externally created service inventory and can run for many days if there are a large number of IP addresses. During this time, the pentester monitors the scanner, but there is usually no work time involved. The working time is focused exclusively on phase 1, 3, 4 and 5.
Large pentest projects with a large number of IP addresses or the testing of very demanding web applications can also take 10+ days. If you schedule or invest too few days for the pentest, there is a risk that the pentester will not be able to identify relevant vulnerabilities in the given time and the test will be incomplete as a result. For large pentests, the turnaround time can also be 3–4 weeks.
