Stepping in the Unknown

There is a say in Cyber security “To stop a hacker, one needs to think like one” and penetration testing is what is all about thinking the way a hacker thinks to help an organization. They are also sometimes referred to as Ethical Hacker. If you are working in a cyber security industry, we often come across the terms like external penetration testing, internal penetration testing, black-box penetration testing, white-box penetration testing, and grey-box penetration testing but it is sometimes difficult to understand this black-box, white-box kind of terms.

Ever wondered about stepping into the unknown without any knowledge and then coming out with information that is new to everyone, just like you went to some unknown place without the map but anyhow you find a way to escape that place.

The same is the case with black-box testing. Here a penetration testing team or penetration tester does not have any knowledge about implementation details, no access to the code, networks, systems, or applications of an organization and are aimed at testing the security level of an organization to trigger an attack a hacker may undertake to gain sensitive information from an organization and generally relies on dynamic analysis of systems and applications on a target network. This type of testing shows you what your attack surface looks like to an adversary attacker and this can be used as a Safeway to test an organization’s Incident response policies and Digital forensics capabilities. Here a testers attempt to mimic the behavior of malicious players attacking an application from the outside. Testers try to create attack scenarios that are as close as possible to how black hat hackers might behave in order to ensure that all attack vectors are covered. A good example, and one of the most popular black box security testing technologies, is dynamic application security testing (DAST), in which an application’s security is checked during run time. DAST testing helps teams uncover major security risks like cross-site scripting, SQL injection or command injection, path traversal, and insecure server configuration.

One should be familiar with the automated scanning tools and different ways to approach a problem as the accurate outcome of the testing highly depends on them.

The objectives of the Black Box Penetration Testing service are:

1. Simulate a real hacking scenario (i.e. Think like a hacker)

2. Validate the configurations of Information Technology (IT) Assets and produce a list of known vulnerabilities present in systems.

3. Provide a detailed report on each security bug and suggest better remediation guidelines for each security issue.

The steps involved in the black-box penetration testing includes -

Reconnaissance

Reconnaissance is the process of gathering preliminary information about the target system. The Intel may include information like — IP addresses, email addresses, employee information, websites, exposed pain points, and so on.

Scanning & Enumeration

Scanning & Enumeration is where more reconnaissance is done. This is where the tester looks for more data about the target like types of running software, operating system, versions, connected systems, user accounts, user roles, etc.

Identify vulnerabilities

With the above reconnaissance, the tester now looks for public vulnerabilities in the target systems & networks. This may include known CVEs in the system, versions, or third-party applications used by the target.

Exploitation

Exploitation is where the tester crafts a malicious request, or social engineer to exploit the identified vulnerabilities. The goal of this step is to get to the heart of the system via the shortest route possible.

Privilege escalation

After the tester breaks into the system, they try to escalate their access level to gain complete access to the system and database. This stage is called Privilege Escalation.

Types of Black Box Testing

The term black box testing covers an extremely wide variety of tests. Three of the most common types of black box testing are functional testing, non-functional testing, and regression testing.

Functional testing

A type of black box testing that focuses on specific functions in the application. This includes sanity checks, integration testing, or system testing. Functional testing is performed by providing a certain input and checking if the output meets the software requirements and specifications.

Non-functional testing

This includes a number of black box testing types that don’t examine functionality. Non functional testing focuses on other aspects and requirements, like usability, load, performance, compatibility, stress, or scalability, to name a few.

Regression testing

Performed after vulnerability remediation, version updates, or other types of system upgrades and maintenance. Regression testing checks whether changes made to the software hurt the existing functional or non-functional aspects of the code.

6 Common black-box penetration testing techniques

1. Fuzzing

Fuzzing is a process to test web interfaces for missing input checks. It’s done by injecting random or well-crafted data, also called noise injection. The goal is to identify unusual program behavior that results from noise injection. The success of Fuzzing may indicate the lack of proper checks in the software.

2. Syntax testing

Syntax testing is a process to test the data input format used in a system. Usually, this is done by adding input that contains garbage, misplaced or missing elements, illegal delimiters, etc. The aim is to find out the outcomes in case the inputs deviate from the syntax.

3. Exploratory testing

Exploratory testing is testing without any pre-formed test plan or expectation of a specific outcome. The idea is to let outcomes or anomalies of one test guide another. It is especially helpful in black-box penetration testing, where a big find may shape the whole test.

4. Data analysis

Data Analysis in black-box penetration testing refers to the review of the data generated by the target application. It helps the tester understand the target’s internal functions.

5. Test scaffolding

Test Scaffolding is a technique to automate intended tests with tools. This process helps the tester find out critical program behavior otherwise not possible in manual testing. These tools usually include debugging, performance monitoring, and test management tools.

6. Monitoring program behavior

Monitoring program behavior helps the tester understand how the program responds. With this technique, the tester may find unspecified symptoms that are indicative of underlying vulnerabilities. This process can be automated to save testers from manually checking for anomalies in program behavior.

Conclusion

Security of software is an ongoing process. You develop, test, secure, and repeat.

Black-box penetration testing helps you test your live application for implementation, validation, and other errors.

On its own, black-box penetration testing does not reveal everything wrong with the application’s security.

Combining a black-box penetration test with other tests, such as source code review, increases its effectiveness.

That was all for today. I will be coming-up with such articles. Till then…

Get connected with me here :

LinkedIn: https://www.linkedin.com/in/yash-gorasiya/

Twitter: https://twitter.com/r3v3Ncl4W

Instagram: https://www.instagram.com/r3v3ncl4w.go/