We are planning for a penetration testing for our network and application.

What should be shared with the penetration tester? For example, should we share the topology of our network? Should we provide descriptions of our servers? Will the testers need to have remote access to any of our servers? Will they need to visit our premises

Is there some kind of standard for this, or are there different types of penetration tests?

  • 4
    This is both very broad, and quite unclear. It essentially comes down to the contract between the tester and the entity being tested, which will be subject to commercial and time restrictions. As a result it's not really answerable. – Matthew Feb 9 '16 at 17:07
  • 2
    It will depend on the results you want from the test. Please edit the question to provide more context. – schroeder Feb 9 '16 at 17:21
  • Unfortunately, all these questions must be answered by the company doing your test. Typically, you draw up a contract before any work takes place. In my personal experience, a test can be done with multiple levels of access and knowledge, including none. It depends on the area being tested. – Ohnana Feb 9 '16 at 19:07
  • 1
    Your edits do make the question more clear, but the answers are the same: "it depends on the results you are looking for", and "it depends on what the tester asks for" – schroeder Feb 9 '16 at 19:44
  • 1
    You could always ask the people you hired... If you don't trust their answer, you're off to a bad start. – Dave Feb 9 '16 at 20:24

I'm guessing given that you've asked this question twice you're not able/planning to provide the additional details, but a comments too short to explain the problem with your question, so here's some more information untill this one gets closed :)

Your question is essentially unanswerable. The reason for this is that there are a huge range of security assurance techniques that get lumped under the term "penetration testing" and the best answer depends on which of those you're looking for.

Which one you're looking for will depend on what your goals are. Now I'm going to assume that by asking this question your organisation hasn't had a lot of "pen tests" before and base this advice on that premise (but you see here where if you'd provided some more details in the question I wouldn't have had to make what could well be an erroneous assumption which might make this answer irrelevant)

There are essentially two approaches to security testing (I dislike the term pen testing), white box and black box. In a white-box test you provide the tester with credentials and knowledge of your environment. This allows for much greater levels of information to be extracted in a safe unintrusive fashion and will provide you much more information (if done correctly) than a black box test. In my opinion, if it's your first test, this is likely the best approach. A white-box test is good for answering the question "what security problems do we have in this environment"

A black box test takes a more "adversarial" standpoint, where the tester is provided no credentials/access and has to try to get them. This is appropriate once you think you have a good level of security and are looking for a test to prove that you have achieved that level of security. This is good for answering the question "have we achieved the level of security that we think we have"

Another relevent question is "what's my goal with this security test" realistically you may want the tester to find things to improve your security or you may want to minimize findings (for example where this test is compliance driven and you want to have a "clean report" for the organisation that mandated you have the test).

In the latter case I recommend that you definitely go for "black box" and restrict the scope as much as you can, as that will likely limit what the tester can find :)

Realistically that is however unlikely to actually help you improve your security. If you want to improve your security, I'd recommend providing the tester with as much information as possible and working with them to target the areas you're actually concerned about so that you get the best benefit from the testing you're doing.


This could be opinion based and up to the agreed upon scope of work. If you don't want to share information just make sure both parties know that before a contract or scope is defined and signed. However here are a few scenarios that I see my company doing.

White Hat

This is a full assessment with access to any and all information I would need to provide a more detailed and thorough report. For example I've determined a Brute Force attack in infeasible so I ask for access to test the internals as well.

Black Box

This is where I know nothing about the network except what I can gather through my methods, this could and would (for my contracts) include social engineering attempts to gather whatever I could to penetrate a company.


This could be a combination of the two, for example the client could want a thorough test completed on the internal network and controls, but want a black box test of the web facing applications or vice versa.

All of my pentest so far have allowed me to simply stay on the premises while conducting my test, this way I can be comfortable and not worry about interrupting services. However if I client wanted me to try to get in and not be allowed access to the LAN (easily) then I may park in the lot access wifi with a device that calls back home then go to my office to do test.

IF you are asking about what information would be beneficial to share, then definitely share IP address to be tested, the total ip address ranges to be tested, the urls owned, gateways, any VLANs or VPNs to be aware of, and these are just a few.

Not the answer you're looking for? Browse other questions tagged or ask your own question.