From the course: Complete Guide to Application Security

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Penetration testing

Penetration testing

From the course: Complete Guide to Application Security

Start my 1-month free trial Buy for my team

Penetration testing

“

- [Instructor] In my opinion, a penetration test is the high point of your application security testing activities. When you're performing any other kind of security test, you're collecting information with the ultimate goal of identifying weaknesses that an attacker might exploit to damage your application. But during a penetration test, you try to actively exploit those weaknesses. I'm an advocate of using the output from all your security testing activity when scoping your penetration test. The more information you can put in the hands of your pen testers, the more value you're going to get from the time they spend hacking your applications. But not all pen tests are scoped and conducted in the same way. There are three approaches to pen testing that I want to discuss: white box, black box, and gray box. White-box pen testing refers to a test where the organization provides the tester with a considerable amount of internal information. This might include reports from your SAS…

Contents