Tests of this type are performed without any prior knowledge of the targeted infrastructure or application. The main goal of a black box penetration test is to simulate a real hacker attack where the hacker has to make his way from the outside to the inside of a given system by exploiting the publicaly available endpoints in a given network or system.

This type of test combines both other types and we have the knowledge of a basic user in the system or perhaps a user with elevated privileges. These type of tests are performed for more focused effort and faster completion. A possibility exists that the attacker will not be able to penetrate and thus leaving vulnerabilities undiscovered.

Also known as clear-box or logic-driven testing. It is the most time consuming test of all three types because the attacker has to process a lot of information. He has access to everything so he could provide comperhensive assessment of both internal and external vulnerabilities. It is usually very effective when testing applications and their source code.