Typorithm · medium

Engagement Types

pentest-typespentestexternalinternalred-team

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Engagement Types

Engagement

Engagements come in types: external (internet-facing), internal (assume-breach LAN), web-app (OWASP-focused), wireless, and red team (objective-based and stealthy, testing the defenders). Knowledge level is black-, grey-, or white-box. Each type has its own scope and deliverable.

External tests attack internet-facing assets as a remote attacker would, while internal (assume-breach) tests start inside the LAN to model what someone with an initial foothold could reach. Web-app assessments dig into a specific application's logic and OWASP-class flaws, and wireless tests look at RF and Wi-Fi exposure.

A red team is different: it is objective-based and stealthy. Rather than enumerating every vulnerability, it pursues a concrete goal (such as reaching a crown-jewel system) while deliberately staying quiet, which tests the blue team's ability to detect and respond.

Engagements also vary by knowledge level. Black-box means you start with no inside information, white-box means you get source, credentials, and architecture up front, and grey-box sits in between. Each type and knowledge level shapes the scope and the deliverable the client receives.

External vs internal (assume-breach) define where the attack starts.

Red team is goal-based and stealthy, testing the blue team's response.

Black-, grey-, and white-box describe how much you know going in.

types:
  external: internet-facing-assets
  internal: assume-breach-lan
  web_app: owasp-focused
  wireless: rf-and-wifi
  red_team: goal-based-stealth

Read the implementation

Connect each part of the code to the concept before you type.

1. External test

An external test attacks internet-facing assets the way a remote, untrusted attacker would.

external: internet-facing-assets

2. Internal test

An internal (assume-breach) test starts on the LAN to model an attacker who already has a foothold.

internal: assume-breach-lan

3. Web app test

A web-app assessment focuses on application logic and OWASP-class flaws in a specific app.

web_app: owasp-focused

4. Wireless test

A wireless test examines RF and Wi-Fi security at the in-scope physical location.

wireless: rf-and-wifi

5. Red team

A red team is goal-based and stealthy: it pursues an objective while testing the blue team's detection and response.

red_team: goal-based-stealth

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.