The purpose of grey box testing is to find vulnerabilities resulting from flawed design or improper use of applications. The grey box test is a combination of white box and black box testing. With this method, we usually examine applications and networks that the testers already partly know and have access to certain elements of.
In a web application assessment, the grey box approach means that all user levels of the application are tested. The system contains the data (usually test data) needed for the test. In agreement with the operator of the application, we schedule the work around the operation and load of the site.
Injection attacks play an important role in the OWASP approach to the assessment, but we also examine whether the separation of permissions between user levels is adequate. It may turn out, for example, that a malicious user can access other users’ orders, personal data or even health or payment information. Insiders, including dissatisfied employees, are behind a significant share of data loss incidents.
In network testing, the essence of the grey box method is that the elements of the network designated for testing are examined with enough information to use the system. Such information includes the structure of the network and the description of its subnets, the software in use, the authorisation management system and the login details of test users.
An important element of this assessment is also checking for privilege escalation from each authorisation level. The results provide effective support to system operators. Connections between network segments can be a common problem here, and unauthorised access to data on shared folders is a major concern too.
We have been carrying out grey box testing for our clients for many years as part of our penetration tests and web application testing. Can we help? Contact us!