Not all penetration tests are the same. Before starting an audit, client and pentester must agree on which type of test will be carried out, because that decision drives the scope, the time, the cost, and the information handed to the assessing team. In this lesson you will learn to classify pentests according to three complementary criteria—prior knowledge, the assessor's position, and the target surface—and you will see how these criteria combine to design the specific engagement for TechNova S.L.

Mastering this taxonomy is fundamental: when a client asks for a "pentest," they may actually mean very different things. Knowing how to ask and to propose the right type is part of professional judgment.

1. Classification by prior knowledge: black, white, and gray box
2. Classification by position: external and internal
3. Classification by target or surface
4. Comparison table of types
5. How the type is chosen for TechNova's engagement

The first criterion refers to how much information the pentester receives about the target before starting. This simulates different attacker profiles and balances realism against efficiency.

The pentester receives no internal information: they only know the minimum (for example, a domain name or an IP range). It simulates a real external attacker starting from scratch.

• Advantage: maximum realism relative to an external attacker without insider information.
• Drawback: it consumes a lot of time on reconnaissance; some deep vulnerabilities may never be discovered within the deadline.

The pentester receives complete information: network diagrams, source code, credentials, architecture documentation.

• Advantage: maximum depth and coverage; time is spent analyzing rather than discovering.
• Drawback: less representative of an external attacker without access to that information.

A middle ground: the pentester receives partial information, such as standard user credentials or a general overview of the network.

• Advantage: a good balance between realism and efficiency; it closely simulates an attacker with some access (an employee, a customer, a partner) or an outsider who has already gained a foothold.
• Drawback: it requires agreeing precisely on what information is handed over.

The second criterion refers to from where the test is carried out—that is, which threat scenario is simulated.

It assesses what is accessible from outside the organization, usually from the Internet: web servers, email, VPN, exposed services. It answers: "What can an attacker do from the Internet?".

It assesses security from inside the corporate network, as if the attacker were already in (a disgruntled employee, a visitor, or an outsider who has already compromised a machine). It answers: "If someone is already inside, how far can they get?".

Both approaches are complementary. Many full audits include both positions, because the perimeter and the interior present very different risks.

The third criterion refers to what is tested. Each surface demands specific knowledge and tools:

• Web: applications and APIs (injections, authentication, business logic...). It is one of the most common surfaces.
• Network / infrastructure: network services, protocols, servers, devices.
• Wireless (Wi-Fi): Wi-Fi network security, encryption, rogue access points.
• Social engineering: the human factor (phishing, pretexting). It tests people, not just machines.
• Physical: physical access to facilities, access control, server rooms.
• Cloud: configurations of cloud environments, permissions, exposed storage.
• Mobile: smartphone applications and their communication with the backend.

Each surface has its own methodology and its own reference guides; for example, for the web surface there is a specific guide (the OWASP WSTG) that we will see in lesson 01-05 (Methodologies and Standards). Here it is enough to recognize that "a web pentest" and "a network pentest" are technically very different projects.

The following table summarizes the three criteria and helps show that they are not mutually exclusive: a single project combines one value from each column.

A real engagement is described by combining the three dimensions. For example: "an external, gray-box pentest, on the web surface". That seemingly simple phrase defines much of the project.

Let's recall our client: TechNova S.L., an e-commerce company with an online store at tienda.technova.lab (PHP/MySQL) and an internal network at 10.10.10.0/24. Which type of test fits best?

Let's reason through the decision following the three criteria:

Choosing gray box is very common in e-commerce: it realistically reflects an attacker who registers as a customer (something anyone can do) while at the same time letting us make the most of our time instead of spending it all on blind reconnaissance. The combination external + web + gray box will be our starting point, and later we will expand toward the internal side to assess the Linux server, the network controller, and the workstations.

This decision is not arbitrary: it must be recorded in writing in the scope and the Rules of Engagement of the contract, which we will cover in lesson 01-04. Defining the type of test well is the first step toward delimiting the scope.

Remember that all of this takes place in TechNova's legal and authorized lab. Choosing the type of test is a design decision for the audit, not a license to test anything: always within the agreed scope.

• Believing that one type is "better" than another. There is no such thing: each type simulates a different threat. The right question is "which threat do we want to assess?".
• Confusing black box with "deeper." Black box is more realistic relative to an outsider, but it is usually less deep than white box within the same timeframe.
• Forgetting the human surface. Social engineering is often the weakest link; ignoring it leaves out a very common attack vector.
• Not documenting the choice. The type of test must be stated in the contract; otherwise, misunderstandings arise about what was going to be tested.
• Tip: when a client asks for "a pentest" with no detail, your job is to help them pin down the three dimensions. That conversation demonstrates professional judgment.

Exercise 1. A startup wants to know "what an attacker who found our website on the Internet would see, without giving them any hints." Indicate the type of test across the three dimensions (knowledge, position, surface).

Exercise 2. Explain why a full audit usually combines external and internal pentesting instead of choosing only one.

Exercise 3. For TechNova, justify why gray box was chosen instead of black box or white box. Give at least one argument in favor and one limitation of the chosen option.

Solution 1. Knowledge: black box (no hints given). Position: external (from the Internet). Surface: web (their site). The statement—"what an attacker who found it would see, without hints"—points directly to simulating an outsider with no insider information about the web application.

Solution 2. Because the perimeter and the interior represent different threats and suffer from different flaws. External pentesting measures whether someone can get in from the Internet; internal pentesting measures how much damage someone who is already inside can do (an insider or an attacker who has already compromised a machine). Assessing only one leaves a blind spot: a solid perimeter is useless if, once inside, everything is wide open, and vice versa.

Solution 3. In favor: gray box realistically simulates an attacker who registers as a customer (trivial in an online store) and avoids spending all the time on blind reconnaissance, achieving more depth than black box in the same timeframe. Limitation: by not handing over the source code (as white box would), certain deep code vulnerabilities may not be discovered within the available time. It is a conscious balance between realism and coverage.

We have learned to classify pentests according to three complementary criteria: prior knowledge (black, gray, or white box), position (external or internal), and target surface (web, network, wireless, social engineering, physical, cloud, mobile). These criteria are not mutually exclusive: a real engagement combines one value from each dimension. For TechNova we have designed a starting point of external + web + gray box, with a later expansion to the internal side, and we have seen that this decision must be recorded in writing.

We now know which type of test we will run. In the next lesson, 01-03 Pentesting Phases, we will see how the work is organized over time: the cycle of phases that runs from reconnaissance through reporting and remediation, and how each phase maps to the following modules of the course.