How Much the Tester Gets Told (Black, Grey, White Box)

Why this matters

Three engagement types, increasing knowledge given to the tester. Black-box: tester has only what an external attacker would have (a URL). Grey-box: tester has limited internal info (user credentials, network diagrams). White-box: tester has source code, architecture, internal docs. White-box finds more bugs faster; black-box is more realistic; grey-box is the typical commercial engagement.

Demo

Choosing: 'we want to know what an external attacker would find in 5 days' → black-box. 'We want maximum coverage in 5 days' → white-box. 'We want both realistic and broad' → grey-box (some white-box info, some black-box discovery).

Try it yourself

1. Pick a product. Plan three different engagements (black/grey/white). Compare what each would find.
2. Discuss white-box assist: does giving the tester source change the threat model?
3. Read a public bug bounty report — usually black-box. Compare to a published external audit (Trail of Bits) — often white-box.

References

• PTES — Engagement Types
• Trail of Bits — Audit reports (white-box)