A penetration tester has been hired and given access to all code, diagrams, and documentation. Which type of testing is being conducted?

A full knowledge test, also known as a white-box or crystal-box test, is a penetration testing methodology where the testers are provided with comprehensive information about the target system. This includes source code, architecture diagrams, network maps, and documentation. This level of access allows for a more thorough and efficient examination of the application's internal structure and logic to identify vulnerabilities that might be missed in other testing types. The goal is to simulate a threat from an insider or an attacker who has already gained significant internal knowledge.

B. Unlimited scope refers to the range of targets the tester is permitted to assess, not the amount of information provided to them beforehand.
C. No knowledge testing, or black-box testing, is the opposite approach, where the tester has no prior information about the target system besides what is publicly available.
D. Partial knowledge testing, or grey-box testing, provides the tester with limited information, such as user-level credentials, but not full source code or architectural details.

1. Scarfone, K., Souppaya, M., & Orebaugh, A. (2008). Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115). National Institute of Standards and Technology. Section 5.3, "Security Testing and Examination Techniques," describes knowledge-based testing levels, including white box (full knowledge).

2. MIT OpenCourseWare. (2016). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology. Lecture 22, "Web Security," discusses different testing models, including white-box where the "attacker" (tester) knows the full source code.

3. OWASP Foundation. (n.d.). Penetration testing methodologies. The OWASP documentation, often used in academic settings, describes white-box testing as a scenario where the "auditor has full knowledge of the application and the source code."