<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-black-box-penetration-testing
description: >-
  External zero-knowledge penetration testing with no prior access, source code, or architecture documentation. Simulates real-world attacker perspective using OSINT, scanning, enumeration, exploitation, and post-exploitation phases.
domain: cybersecurity
subdomain: security-testing
tags:
  - black-box
  - penetration-testing
  - external-assessment
  - owasp
  - ptes
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1595", "T1592", "T1589"]
  tools: ["nmap", "burp-suite", "ffuf", "nuclei", "sqlmap", "nikto", "metasploit"]
---

# Performing Black Box Penetration Testing

## Overview

Black-box penetration testing simulates an external attacker with zero prior knowledge of the target. The tester discovers attack surface through reconnaissance, identifies vulnerabilities through scanning and manual analysis, and validates exploitability through controlled exploitation.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `nmap` | Security tooling |
| `burp-suite` | Security tooling |
| `ffuf` | Security tooling |
| `nuclei` | Security tooling |
| `sqlmap` | Security tooling |
| `nikto` | Security tooling |
| `metasploit` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Passive Reconnaissance

```bash
# Subdomain enumeration
subfinder -d target.com -all -o subdomains.txt
amass enum -passive -d target.com -o amass_subs.txt

# DNS resolution and filtering live hosts
cat subdomains.txt | httpx -silent -status-code -title -o live_hosts.txt

# Certificate transparency log search
curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
  jq -r '.[].name_value' | sort -u

# Google dorking for exposed assets
# site:target.com filetype:pdf | filetype:xlsx | filetype:sql
# site:target.com inurl:admin | inurl:login | inurl:api
```

### Step 2: Active Scanning

```bash
# Port scanning — top ports with service detection
nmap -sV -sC -T4 --top-ports 1000 -oA nmap_scan target.com

# Full port scan on discovered hosts
nmap -sV -p- --min-rate 5000 -oA full_scan target.com

# Web application scanning
nikto -h https://target.com -output nikto_results.txt

# Directory and file brute-forcing
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -mc 200,301,302,403 -o ffuf_dirs.json
```

### Step 3: Vulnerability Analysis

```bash
# Automated vulnerability scanning
nuclei -u https://target.com -t cves/ -severity critical,high -o nuclei_results.txt

# SQL injection testing
sqlmap -u "https://target.com/page?id=1" --batch --level 3 --risk 2 \
  --output-dir=sqlmap_results

# XSS discovery
dalfox url "https://target.com/search?q=test" --silence --output xss_results.txt

# SSRF testing on URL parameters
echo "https://target.com/api/fetch?url=FUZZ" | \
  ffuf -w /usr/share/seclists/Fuzzing/ssrf-url.txt -u FUZZ
```

### Step 4: Exploitation & Evidence

```bash
# Controlled exploitation with evidence capture
script -t 2>timing.log exploitation_session.log

# Screenshot captured access
scrot -q 95 "exploit_evidence_%Y%m%d_%H%M%S.png"

# Hash all evidence for integrity
sha256sum evidence_* exploit_* > evidence_integrity.sha256

# Document exploitation chain
cat <<'CHAIN'
1. Discovered endpoint: /api/v2/export (via ffuf)
2. Parameter injection: export_type=csv;id (command injection)
3. Confirmed RCE: whoami returned 'www-data'
4. Impact: Full server compromise as web application user
CHAIN
```

## Detection

```yaml
title: Black Box Penetration Testing Detection
id: 1e4a182e-b8f9-4617-a38d-febe7963e65c
status: experimental
description: Detects suspicious activity related to performing black box penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*black*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1595
  - attack.t1592
  - attack.t1589
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Black Box Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1595, T1592, T1589 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
