A white hat hacker looks for security weaknesses before criminals can exploit them. The goal is defensive: expose vulnerable access points, document the risk, and help get flaws fixed. section 1.1
White hats may perform penetration testing as part of a client security audit. They use the same readily available automated tools and scripts that black hats use, but apply them to find weaknesses rather than exploit them. section 1.1
White hat work can include:
- Scanning systems for vulnerable access points during a security audit. section 1.1
- Finding flaws through bug bounty programs, where companies reward reported security issues. section 1.1
- Researching, documenting, and demonstrating vulnerabilities in common software so patches can be produced and issues cataloged. section 1.1
Audit versus exploitation
A tester can use Kali Linux to scan a client system for weaknesses during an audit. A black hat can use the same tools to locate flaws to exploit; the difference is the defensive purpose and handling of what is found. section 1.1
