Author: Patrick Sauer

In the approach during a pentest – or actually in the amount and details of the information base made available to the penetration tester – three variants can be distinguished: whitebox, graybox and blackbox pentesting.

The blackbox pentest corresponds pretty closely to the information base of a typical external attacker over the Internet. He only knows the company to attack, he has to gather all the other information himself. Be it IP addresses, DNS entries, programming languages ​​​​used about job offers… the possibilities for information gathering are extensive, but also time-consuming. And thus increase the costs of a pentest in order to get the same result as with the whitebox or graybox approach.

The whitebox pentest is the opposite of the blackbox pentest: here a penetration tester is given all the information and data that he might need: documentation on the IT systems, information about configuration settings, network diagrams or even the source code of web applications by his client. A pentester quickly ends up in an information overload, which again costs time and money.

A good compromise between the whitebox and blackbox pentest is the graybox pentest. The penetration tester usually gets at least all the information here that simply saves him valuable time and that he would have found anyway. In addition, a client does not have to hand over all internal information and documentation. Typically, further information can also be obtained from the pentester by asking his client during the actual test, such as which database system is used by an application. In this way, he can carry out targeted attacks and identify all vulnerabilites in IT systems and IT applications as efficiently as possible.

A penetration tester is a professional IT security expert with a strong technical focus who, based on a structured approach, identifies vulnerabilities in IT systems and applications and exploits them if agreed by his client. As a penetration tester, he uses the same hacking tools and techniques that a malicious attacker uses.

The best Linux for beginners is Debian GNU/Linux. It is, in my opinion, the best Linux for beginners who want to learn as well as experts. It is a stable Linux distribution on which well-known other distributions such as Ubuntu or Kali Linux are based on, still Debian is not a hardcore distribution like Gentoo Linux either.

Personally, I started with Debian Sarge back when it was still testing. Now I’m still working with Debian. In the meantime I’ve tried various other distributions like Ubuntu, Linux Mint, Gentoo, SuSE, Fedora etc., but I’ve always came back to Debian.

The costs of a penetration test depend on the time spent and the daily rate of the penetration tester.

The daily rates for penetration testers are above average and range between €1,200 and €2,000, provided it is a reputable service provider for penetration tests. Lower daily rates usually indicate that the respective provider is trying to sell a vulnerability scan rather than a penetration test. Good staff with a lot of know-how and experience cost money and this is usually reflected in the daily rates.

The number of days invested mostly depends on the complexity of the scope or the system, application or company to be tested. The more complex the attack surface, the longer the check takes.

Shorter penetration tests take 2 days, larger systems can take several weeks. Usually 5-10 days is a realistic average, with deviations up and down.

Thus, the costs often start at €2,400-3,000 for a small pentest and reach the level of around €12-16,000 relatively quickly, although there are no upper limits.

A penetration test is basically a structured attack on a company’s IT infrastructure. During this, a penetration tester uses the same tools and techniques that a hacker uses in his attack. However, the objective differs between a malicious hacker and a professional penetration tester.

A hacker usually tries to hack a company in order to gain access to its IT systems and data. To do this, he only needs a single critical vulnerability that can successfully exploited.

However, companies that commission a penetration test do not primarily want to be successfully hacked, they want to know whether this is possible. For this purpose, a penetration tester will try to identify all vulnerabilities, regardless of their criticality. Many vulnerabilities are also attempted to be exploited, but not all. Because some further attacks pose a higher risk for the attacked IT systems.