How do White Hat Hackers Hack a System?

 

Who are White Hat Hackers: 

White hat hackers are legal security professionals who work for protecting organizations from cyber threats.

Remember, the only difference between black hat hackers and white hat hackers is the intention behind the hack. Both hack the computer systems, but white hat hackers hack for protecting the organization from cyber threats whereas black hat hackers hack for their own benefit illegally.

In the previous post, we have discussed how do black hat hackers hack a system. If you haven't seen it yet, I suggest you read that before reading this.
How do Black Hat Hackers Hack a System?

Now lets finally get into our topic - How do White Hat Hackers Hack a System?

Step-1: Legal Documentation

White hat hackers make sure they sign Memorandum of Understanding (MOU), which is a document that describes the testing activity and the steps that will be taken, on a legal paper. 
Along with MOU, there is another document called the Non-Disclosure Agreement (NDA), which is signed by both the parties (White hats and Organization). NDA is proof that white hat hackers will not disclose any details of the activity, cost and vulnerabilities of the organization to third parties.
Finally, A Financial Agreement is made which puts the cost to perform the activity on a legal paper.

Step-2: Scope Assessment

White hat hackers and the organizational client decides the scope of the audit and also the time required for the audit.
For example, if the client has a website, white hat hackers discuss which part of the website is to be tested (Scope) and the time required to perform the activity.

Step-3: Information Assessment

White hat hackers gather the information from the client and from various data mining tools like Maltego etc.
For example, if a part of the website is to be tested, then they collect information like on which server the website is running, alternate domain addresses for the website etc.

Step-4: Vulnerability Assessment

After gathering the required information in Step-2, white hat hackers scan for vulnerabilities from the gained information using manual and automated tools.
All the vulnerabilities found during this process will be documented in a clear and precise way.

Step-5: Penetration Testing and Gaining Access

After finding the vulnerabilities, the white hat hacker performs malicious activities implicitly to check the level of system compromise and documents every detail of the activity and writes Proof of Concept (POC).

Step-6: Report Generation

Now after completing the penetration testing of the system, a clear report is been made with vulnerabilities found, their impact on the organization and measures to be taken to avoid exploiting those vulnerabilities.

Step-7: Patch Assistance

After showing the report of vulnerabilities and their impact on the organization, the client decides which vulnerability should be patched and which should leave behind depending on the cost and effort to patch. Now the developer starts patching.

Step-8: Revalidation

After the developer patches the vulnerabilities, white hat hackers revalidate the system if it's been properly patched.

Now after reading the two posts, you've known the difference between black hat hackers and white hat hackers and the procedure followed by black hat hackers and white hat hackers to hack a system.