A black hat hacker performs malicious and illegal acts for financial or political gain. For a web application, the practical risk is unauthorized access: attackers look for weaknesses they can exploit rather than report. Their goals distinguish them from white hat hackers, who identify vulnerabilities before criminals use them, and gray hat hackers, who may report a flaw when doing so is more profitable than exploiting it. section 1.1
Black hats and defenders can use many of the same accessible tools:
- Automated tools and scripts scan systems for vulnerabilities and vulnerable access points. section 1.1
- Kali Linux packages popular forensic and hacking tools; penetration testers can use it for audits, while black hats can use it to locate exploitable flaws. section 1.1
- Public vulnerability research and patches can expose known risks in software such as Apache Tomcat, making patching part of defense. section 1.1
Same scanner, different intent
A penetration tester scans a client system to identify vulnerable access points for a security audit. A black hat can scan for the same access points, but seeks flaws to exploit for criminal gain. Tool choice alone does not establish whether activity is defensive or malicious. section 1.1
