Gray box testing method

‘Gray box’ testing (Translucent testing) is somewhat in between ‘Blackbox’ and ‘White box’, and implies deep knowledge of the tested application’s architecture, design and purpose, which is, however, not necessarily complete or up to date.. Gray box testing may be performed by either a third party or the developers themselves. The idea is to combine the best of Black and White box security testing methods and test both network security and the security of physical environments (such as ‘perimeter devices’ like a hardware firewall, etc.). It provides valuable insights concerning the potential degree of damage attackers can cause and relies on a combination of pentesting techniques, which include:

• Network scanning;
• Vulnerabilities scanning;
• Social engineering vulnerability analysis;
• Manual source code review.

Already having some information about the target, the testing experts can simulate the actual experience of the application users and secure the system from outside attacks.

Gray box testing techniques

Gray Box pentesting involves multiple techniques, the most important of which are:

• Matrix testing. It helps to test the software thoroughly, identify and remove unnecessary variables which can reduce program efficiency and lead to problems.
• Regression testing. It helps to test software components for defects brought about by changes. It ensures the absence of weaknesses (introduced or reintroduced) by modification of the initial development and shows if the software works without failures.
• Orthogonal array testing (OAM, OATM, Orthogonal test set). It provides representative depiction of all data combinations and is especially useful with large amounts of data presented in just a few test cases . It uncovers the majority of bugs, detects all single mode, double mode, and multimode faults and exercises complex combinations of all variables.
• Outsider threat testing. It helps to foresee an attacker's behavior and prevent their malicious actions once they have broken into. It is very useful for detecting errors, exploits and security flaws which the possible attackers may take advantage of.

How Gray box testing is performed

Gray box texting is usually carried out by taking five successive steps, which are the following:

• Planning and requirement analysis. It is the initial stage, when the security team requests some information concerning the application in question (including dummy credentials, access roles and the like). It involves learning the scope of application, execution of tech stack and documentation map preparation.
• Discovery phase (Reconnaissance). It involves discovering the IP addresses, hidden endpoints and API endpoints. It also includes not just the network activity, but also the so-called ‘Social engineering stage’ when the necessary information about the employees may be collected.
• Initial exploitation. At this stage the attacks which are going to be launched are planned. Also possible misconfigurations in the servers and cloud-based infrastructure are detected. The gathered information helps the security team with creating attack scenarios.
• Advanced penetration testing. At this stage the planned attacks on the discovered endpoints come into action. All types of possible vulnerabilities are found and combined to help with creation of real attack situations simulating.
• Document and report preparation. At the final testing stage a list of attempted attacks and detailed reports on each endpoint are prepared by the security testing team.

Pros and cons of Gray box testing

Like any other type of security testing, Gray box method has its benefits and downsides:

Pros:

• Insider information. The knowledge of the specific structures of the ‘target’ is very helpful and allows focusing on the critical cases.
• Less time consuming. Testing experts can plan and prioritize the process, avoid excessive and ambiguous test-cases, which happen with no understanding of unfamiliar networks or codebases.
• Non-intrusive and unbiased method. The testing method is non-intrusive and fair, the testing specialists are aware how the program components interact with each other but do not deal with detailed program functions and operations.

Cons:

• Absence of access to the source code. Thus, the possibility of code analysis and test coverage are limited.
• Ambiguous test cases. If the developer is testing their code with the help of unit-tests along with the main testing process the whole thing can become too excessive.
• Complete testing of all possible inputs and outputs can be time-consuming.

Conclusion

The gray box testing is a useful method to check the system for vulnerabilities with partial overlap with both white box and black box methods. The method has both its strengths and weaknesses and, like any technique, it should be tailored to the task at hand and can be combined. After all, the more methods and ways of verification you know and can usefully apply,  the higher the quality of the final result is going to be.