The following is a transcript of Christian Espinosa’s explanation of Black Box Penetration Testing. Christian sold Alpine Security to CISO Global in 2020 and recently founded Blue Goat Cyber.
Hi, this is Christian Espinosa with Blue Goat Cyber, and this video will cover black box penetration tests. In a previous video, we covered gray box penetration test. I’ll put the link to that video beneath this one. With a black box penetration test, we have the least amount of knowledge from the scale of black, gray and white. A black box administration test. You typically know very little about the target, maybe the IP address or the URL. With a gray box, you have a little bit more knowledge. Typically, user level knowledge. And a white box, you typically have administrator level knowledge or access to the schematics, the source code, the design documents, et cetera. Also with black box, this is called, “Unauthenticated,” often because we do not have any level of access from a user perspective like gray box, or an administrator or root level perspective, like white box.
A black box penetration test can be used both internally and externally. We’ll go over more detail that in a second on the next slide. And the threats we’re trying to emulate with a black box penetration test are an external attacker with very little knowledge about your environment, a rogue device or an internal intruder, and we’ll cover those in more detail here in a second. With an external black box penetration test, so we’re looking at the perspective from the outside your network. So we’re testing your public facing systems. So if you’re in an organization, we’re testing the systems that are exposed to the internet. So this could be a firewall, a router, a VPN concentrator, your web server, anything you have exposed to the internet that your employees can access or your clients can access is what we’re testing from an external black box penetration testing perspective.
And what we’re trying to emulate is an external attacker. So this could be a script kitty, somebody in China just scanning and looking to see what they can get into. It can be a botnet that’s just trying to scan for vulnerable systems, or it could be an active attacker trying to get into your environment. An example of what we might test could be your external firewall. So if you’re a small organization and all of your internal systems are natted through a firewall, for instance, you want to make sure that those firewall rules are set up properly and you’re not allowing inbound traffic, you’re only allowing outbound traffic, and you have some rules in place. So as an example, if you type in from the internal network, “What is my IP” in Google, you can figure out what your public facing IP address is. And this is something we would want to test because if your public facing IP address, which is often your external router or firewall, has a hole in it, then the attacker may be able to exploit that hole and get access to your internal environment.
So, here on the picture we have, “What is my IP?” And we have 71.14.247.83. So as a quick example, Zen Map, which you can see right here, which is basically [inaudible 00:03:19], but a graphical user interface for [inaudible 00:03:21]. And this is just a quick example of reconnaissance. So if I put in that IP address here, which we put in 71.14.247.83, and let’s say I do a regular scan, so I’m looking for holes on your external facing router or firewall, or you could have a NextGen firewall, you could have a UTM, et cetera. So go ahead and click on scan here. And this is the first step with penetration testing. We’re trying to identify holes you may have, and right now I’m just using [inaudible 00:03:58] with a default settings, which looks for the top 1000 ports.
So it looks like we have four ports open 53, 80, 1111 and 2111. If somebody performed an external black box penetration test against your firewall or external router, this is what they would see. Granted, they should scan all 65,535 ports, but this is the top 1000, and we have four ports open out of the top 1000. So we can see here that there’s a web server running, DNS running a few other things. And now the next step would be to identify a vulnerability and then exploit that vulnerability if possible. And the reason this is important, because if you have a publicly exposed IP address with a vulnerability, somebody could exploit that vulnerability and potentially pivot from the external facing system. From there, they could pivot to your internal environment and get access to your internal environment or get access to like a SQL database or something else. So you want to make sure you test your environment from an external perspective.
With an internal black box penetration test. We’re looking at the environment from inside your firewall. So really, we’re trying to emulate two main threats here. One of them is a rogue device and one of them is an internal intruder. So basically, and these could bleed together as the same thing because an internal intruder could plant a rogue device. But the idea is, what if somebody walks into your environment and they plant a rogue device as we see here, this is a [inaudible 00:05:36] plug on the screen in the picture. Let’s say they plant this device on your network. This device is a rogue device which intercepts your traffic and can send it out via cellular network to somebody else. Or it could actually phone home through your network and duplicate the traffic that way, or it could serve as a pivot point. There’s a number of things it can do, but basically, the idea is can you detect or are you protected against a rogue device or an internal intruder?
An internal intruder example that might be, let’s say I walk into a dentist office, I’m waiting for my appointment, I’m sitting in a chair in the waiting room and I’ve got my laptop, I’m kind of bored because I’m waiting a long time, but I noticed there’s an ethernet jack exposed on the wall behind me. Let’s say I plug my laptop into that jack and I just started screwing around and see what I can see on the network. So if I can scan the network and maybe exploit a device on that network on that dentist’s network, that’s from an internal intruder perspective. So those are why we would do a black box penetration test.
So in summary, what we talked about are black box penetration test. A black is the least amount of information from gray to white. You have limited knowledge unauthenticated. A black box penetration test can be used to emulate an external attacker, as well as an internal attacker or internal rogue device. And that’s basically it. The black box is really the simplest type of penetration test, and it should definitely be something you consider. If you have any questions about black box penetration test, you can leave them beneath the video. You can also subscribe to our channel. And if you’re interested in a black box penetration test against your environment, you can contact us at www.bluegoatcyber.com. Thanks, have a good one.
