I have some issues regarding the concept of black, grey and white hat and my question is:

Were and in what penetration testing methodology I can find the black, grey or white hat concept definition?


When referring to black, grey and white hat the following is the definition:

White - A hacker who is hacking for profit with permission in order to test a system (This is called a penetration tester).

Grey - A hacker who works as a penetration tester but also as a illegal hacker.

Black - A hacker hacking illegally for any reason which can include all kinds of motives such as political, profit, revenge and so on...

When referring to black, grey and white box testing the definition is the following:

White - A tester has a deep understanding of the source code and the system and tries to build tailored tests to test the system

Grey - Almost same as white except the tester has less knowledge of the system and mixes black and white testing together.

Black - A tester will test the application as if he has no knowledge of application using all the normal testing techniques without diving into it deeper.

Notice: When speaking about "some_color box penetration testing" it is not common to do a grey box testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.