The consultant is a white hat hacker, also known as an ethical hacker. This classification applies to security professionals who are explicitly authorized by an organization to use hacking techniques to test and identify vulnerabilities in their systems. The consultant was hired for this purpose, and their actions, such as using SQL injection in a controlled test, were performed with permission to improve the organization's cyberdefenses. The intent is constructive and defensive, which is the defining characteristic of a white hat hacker.

A. Cybercriminal: A cybercriminal engages in illegal activities for financial gain. The consultant's actions were legal, authorized, and contractual, not criminal.

C. Cyberterrorist: A cyberterrorist is motivated by political or ideological goals to cause widespread disruption or fear. The consultant's motive is professional security assessment.

D. Black hat hacker: A black hat hacker accesses systems without authorization and with malicious intent (e.g., theft, data destruction). The consultant had explicit permission.

---

1. Palmer, C. C. (2001). Ethical Hacking. IBM Systems Journal, 40(3), 769–780.

Reference: Page 770, Paragraph 2. The paper defines ethical hackers as individuals hired by companies to perform penetration tests. It states, "A company can hire an ethical hacker to perform a penetration test on its network... The ethical hacker is given a contract that specifies what he or she is to do." This directly aligns with the scenario.

DOI: https://doi.org/10.1147/sj.403.0769

2. Engebretson, P. (2013). The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy (2nd ed.). Syngress.

Reference: Chapter 1, "What Is Penetration Testing and Ethical Hacking?", Section "White, Black, and Gray," p. 5. The text explicitly defines a white-hat hacker as someone who "has the express consent of the system owner" to identify vulnerabilities, which perfectly describes the consultant in the question.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference: Lecture 1: Introduction, Section "Who are the adversaries?". The lecture notes differentiate between adversaries, including "White hats / ethical hackers" who are "security professionals, find flaws for good." This contrasts with "Black hats / crackers" who "break into systems, steal data, hold for ransom." The consultant's role is clearly that of a white hat.