Penetration › Module 2 › Lesson 1
Box Types
Black, grey, and white box engagements change what intel you start with — all still require written RoE on $LAB_HOST.
Visual · pentest_box_types
Black/grey/white box literacy. $LAB_HOST only. Original Cyberlium.
Opening
Box color describes starting knowledge — not permission to skip RoE.
Black-box pentests start with minimal internal knowledge — like an external attacker with only scope targets listed. Grey-box provides partial credentials or network maps. White-box grants architecture docs, source access, or admin context. Each type changes recon depth and timeboxing — none authorize testing hosts outside written scope. Cyberlium teaches box-type vocabulary on $LAB_HOST planning notes. You will NOT label dorm nmap 'black-box homework' or exploit classmate VMs because grey-box sounds educational. Next: Scoping.
1. Black box: external adversary simulation
Black-box engagements assume the tester knows only what scope documents list — target IPs, domains, allowed hours. Recon and enumeration do more lifting. Reports emphasize what an unauthenticated outsider could reach on $LAB_HOST if named in scope.
Black-box on stranger production without contract is crime — not OSCP prep. Your lab black-box means $LAB_HOST only with zero insider docs.
Command guide
Try these commands — Black box: external adversary simulation
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, python3. Reference sites: Kill chain literacy (https://attack.mitre.org/tactics/enterprise/); PTES (http://www.pentest-standard.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Grey and white box: partial to full context
Grey-box might include a low-priv user account or VLAN diagram — common for internal red team exercises. White-box includes architecture, code review, or admin walkthrough — faster depth, different findings emphasis.
On $LAB_HOST notes, write which box type your lab simulates. Credentials from lab briefs stay on lab VMs — never recycled against classmates.
3. Box type does not expand scope
A white-box architecture PDF for Asset A does not authorize Asset B. Scope lists hosts; box type lists starting intel. Both live in RoE beside $LAB_HOST.
Ship: one-line definition each for black, grey, white on YOUR lab. Next: Scoping.
4. What you ship: black/grey/white definitions for $LAB_HOST
Document three box types. All require written RoE naming $LAB_HOST. No stranger targets. chmod 600.
5. What you record before the next lesson
Date. Three box definitions. $LAB_HOST named. File t19-m02-l01-box-types.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Call dorm exploitation 'black-box practice.' Use white-box docs from employer without contract.
Right
Write box-type definitions tied to $LAB_HOST scope. Next: Scoping.
Mission: name box types on YOUR lab scope
1) Define black, grey, white in one sentence each. 2) Pick which type YOUR $LAB_HOST lab simulates. 3) Note that box type never expands scope. Never test hosts not in RoE.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how enterprises pick box types — not how to exploit a dorm /24.
Knowledge Check
APPLY: Black-box pentest typically assumes:
Multiple choice
Knowledge Check
APPLY: True or False: White-box context authorizes testing hosts not listed in scope.
True or False
Knowledge Check
APPLY: On Cyberlium, box-type literacy applies to:
Multiple choice