Home / Help centre / Targets & repositories
Targets & repositories
What's the difference between a white-box and a black-box target?
A white-box target reads your source code from an HTTPS Git repository and tests the running app, so findings can point to a file and line. A black-box target tests only the live URL, needs no code, and requires proof that you own it.
The short version
Both types test your running application. The difference is what Cyberlop can see. White-box means it can read your code as well. Black-box means it sees only what a visitor could reach at the URL.
How it works in Cyberlop
You choose the type with the two cards under Scan type when you create a target.
| White-box | Black-box | |
|---|---|---|
| Needs | A Git repository URL over HTTPS and a branch | Only the Main URL |
| Sees | Source code and the running app | The running app only |
| Ownership proof | No ownership card | Required: DNS TXT record or Cyberlop staff approval |
| Finding location | File and line of code | The endpoint |
| Private code | Needs a read-only Git token | Not applicable |
With white-box, the scan reads the repository first and builds a picture of the app's frameworks, entry points and data flows. Later steps then test the live app with that knowledge. Because of this, a white-box finding can name the file and line to fix.
With black-box, the repository fields turn grey, and the help text reads "Not used for black-box scans." You can run black-box where you cannot share code, such as a hosted product you are authorised to test.
What to do next
Pick white-box when you own the code and want the most detail. Pick black-box when you have only a URL. You cannot switch a target between types later, because targets are immutable. Create another target if you want both views of one app. Read how to create a black-box target or how to connect a repository. Cyberlop also offers grey-box testing; ask us through /contact.
Related questions
- How do I create a black-box target with no source code?
- How do I connect a Git repository to a target?
- What are the ways to prove I own a black-box target?
- Do white-box targets need ownership verification?
- What does it mean that targets are immutable?
White-box vs black-box scans: how to choose a scan type in Cyberlop
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.