Box Types

Black, grey, and white box engagements change what intel you start with — all still require written RoE on $LAB_HOST.

Box Types• Audio Walkthrough

00:00/03:49

Visual · pentest_box_types

Black/grey/white box literacy. $LAB_HOST only. Original Cyberlium.

Box color describes starting knowledge — not permission to skip RoE.

Black-box pentests start with minimal internal knowledge — like an external attacker with only scope targets listed. Grey-box provides partial credentials or network maps. White-box grants architecture docs, source access, or admin context. Each type changes recon depth and timeboxing — none authorize testing hosts outside written scope. Cyberlium teaches box-type vocabulary on $LAB_HOST planning notes. You will NOT label dorm nmap 'black-box homework' or exploit classmate VMs because grey-box sounds educational. Next: Scoping.

1. Black box: external adversary simulation

Black-box engagements assume the tester knows only what scope documents list — target IPs, domains, allowed hours. Recon and enumeration do more lifting. Reports emphasize what an unauthenticated outsider could reach on $LAB_HOST if named in scope.

Black-box on stranger production without contract is crime — not OSCP prep. Your lab black-box means $LAB_HOST only with zero insider docs.

Command guide

Try these commands — Black box: external adversary simulation

═══ LINUX / KALI (Penetration Testing & Service Audit) ═══

Port scan and service banner grabbing against authorized target

Command — copy this

nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}

Enumerate web directories and hidden endpoints

Command — copy this

gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hosts

Metasploit framework module inspection (Safe lab syntax)

Command — copy this

msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"

═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings

Command — copy this

netstat -ano | findstr /i "LISTENING"

Primary tools to practice this lesson: curl, python3. Reference sites: Kill chain literacy (https://attack.mitre.org/tactics/enterprise/); PTES (http://www.pentest-standard.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Grey and white box: partial to full context

Grey-box might include a low-priv user account or VLAN diagram — common for internal red team exercises. White-box includes architecture, code review, or admin walkthrough — faster depth, different findings emphasis.

On $LAB_HOST notes, write which box type your lab simulates. Credentials from lab briefs stay on lab VMs — never recycled against classmates.

3. Box type does not expand scope

A white-box architecture PDF for Asset A does not authorize Asset B. Scope lists hosts; box type lists starting intel. Both live in RoE beside $LAB_HOST.

Ship: one-line definition each for black, grey, white on YOUR lab. Next: Scoping.

4. What you ship: black/grey/white definitions for $LAB_HOST

Document three box types. All require written RoE naming $LAB_HOST. No stranger targets. chmod 600.

5. What you record before the next lesson

Date. Three box definitions. $LAB_HOST named. File t19-m02-l01-box-types.txt chmod 600.

6. Wrong vs right: stranger nets vs YOUR lab VMs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Call dorm exploitation 'black-box practice.' Use white-box docs from employer without contract.
Right: Write box-type definitions tied to $LAB_HOST scope. Next: Scoping.

Hands-on Exercise

Mission: name box types on YOUR lab scope

1) Define black, grey, white in one sentence each. 2) Pick which type YOUR $LAB_HOST lab simulates. 3) Note that box type never expands scope. Never test hosts not in RoE.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Ask Mentor how enterprises pick box types — not how to exploit a dorm /24.

Practice QuizQuestion 1

Multiple choice

APPLY: Black-box pentest typically assumes:

Practice QuizQuestion 2

True or False

APPLY: True or False: White-box context authorizes testing hosts not listed in scope.

Practice QuizQuestion 3

Multiple choice

APPLY: On Cyberlium, box-type literacy applies to: