Home / Knowledge hub / White-box testing
Knowledge hub
White-box testing
Testing with access to the source code, not just the running application.
What it means
White-box testing means testing with the source code in hand as well as the running application. The tester watches how the application handles a request, not only what it sends back.
Black-box testing is the opposite: probe from outside with no view of the inside. Grey-box sits between them, and most commercial web application testing lands somewhere in that middle.
Why it matters
Some questions have no answer from outside. When a permission check passes and should not have, the response often looks identical either way. With the code in view you can see which branch ran, which turns a suspicion into a specific line.
It makes the report usable as well. The report puts the fix where it has to happen, rather than describing a symptom an engineer then traces backwards. It also shortens the argument about whether a finding is real. Naming the file and the line is harder to wave away.
How it shows up
The trade-off is that seeing everything can mean reaching nothing. Reading code turns up patterns that may never be reachable, so the useful version combines both. Read the code to know where to look, then send the request that proves it.
Access is the practical question. Read access to a repository is a serious thing to hand over. Ask where the code goes, how long it stays and who can see it. That combination is how Cyberlop works, which is also why it needs repository access. Our self-hosted agent exists for teams who would rather the code never left. What it reads and runs.
Questions people ask
White-box testing, answered
What is the difference between white-box, black-box and grey-box?
Black-box gives the tester nothing but the address. White-box gives them the source and often the configuration. Grey-box gives partial knowledge, commonly credentials and architecture notes.
Grey-box is what most web application tests are in practice, even when the invoice says something else.
Is white-box testing the same as a code review?
No. A code review reads the code and stops there. White-box testing reads the code and then sends requests to the running system to confirm what it found.
That second half is what separates a suspicious line from a demonstrated problem.
Do I have to give a tester my source code?
Not necessarily, but you get less for your money without it. Refusing access means paying somebody to rediscover from outside what the code would have told them in a minute.
If access is the blocker, ask about the handling instead. Where does the code sit? How long do they keep it? Who can read it? Can the whole thing run inside your own network?
Which approach finds more bugs?
White-box finds more, particularly in authorisation and in error handling, where the response gives nothing away from outside.
It also produces more noise. Code can contain a nasty-looking pattern on a path nothing ever reaches, which is why the request still has to be sent.
Is black-box more realistic, since that is what an attacker sees?
Only for a first day attacker. Anybody serious will read your JavaScript bundle, your public repositories, your job adverts and your API documentation until the box turns grey.
Withholding the code slows the test far more than it slows an attacker.
Related
Terms that sit next to this one
Black-box testing
Testing an app from outside, with no access to the source code.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
SAST
Tools that read your source code without ever running it.
DAST
Tools that attack a running application from the outside.
Authorization
Deciding what a proven user is then allowed to do.
Willing to give a tool your source?
Cyberlop reads the repository and tests the running application, which is how a finding can point at the line that allowed it. Ask what access a run actually needs.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.