White Box Penetration Testing

White box penetration testing is an authorised test that simulates an attack by a malicious insider — someone who already has legitimate access to an organisation's systems and knows how they are set up.

The organisation gives the testers permission to look for weaknesses, which makes the test legal and planned rather than a criminal attack. Testers report what they find so it can be fixed.

What the testers start with

White box testers may be given basic credentials, such as a standard staff login, so they can begin inside the system rather than guessing passwords from outside. They may also be given network and system information: the layout of the network, the names of servers, which software and versions are running, and how the different parts connect. This inside knowledge lets them aim at the places most likely to be weak instead of trying random attacks.

What they can check

• Internal policies and procedures — for example, whether accounts for people who have left are closed quickly, or whether staff really follow the password rules.
• Access rights — whether a login meant for a part-time receptionist can open files it should not, such as payroll records.
• Controls — whether logging, permissions and approval steps actually stop someone with a low-level account from doing damage.
• System pathways — the routes through menus, services and data. Testers follow these routes to see if a normal user can reach administrator tools or sensitive areas.

A youth theatre runs an online booking system. Its white box testers are given a volunteer's login and the network layout, which shows the booking database shares a server with the group's email. They sign in as the volunteer, follow the booking pages to an admin menu a volunteer should not reach, and try to read a file of another volunteer's details. Their report shows which access rights and controls let an insider go too far.

Because the tester already has inside knowledge, the test shows what an authorised insider could do — which is different from black box testing.