Black Box vs White Box

Black box (external only)

Tests your application from the outside, like an attacker would. No access to source code.

Tools included (11):

Tool	Category	What it tests
Port Scanner	Network	Open ports
Web Scanner	Web app	XSS, injection, CSRF, misconfigurations
Vuln Scanner	Web app	Known CVEs, misconfigurations, exposures
Server Audit	Web app	Dangerous files, outdated server software
Enumerator	Web app	Hidden directories, backup files
Net Scanner	Vulnerability	Full network vulnerability assessment
TLS Analyzer	SSL/TLS	Certificate issues, weak ciphers, protocol vulnerabilities
Sub Hunter	Recon	Subdomain enumeration
Web Probe	Recon	HTTP response probing, tech detection
WAF Detect	Recon	WAF detection and fingerprinting
Security Checks	Multi	Additional vulnerability checks

When to use: You do not have a GitHub repository, or you only want to test the external attack surface.

Everything in black box, plus static analysis of your source code via GitHub.

Additional tools (3):

Tool	Category	What it tests
Code Scanner	SAST	Code-level vulnerabilities, insecure patterns
Dep Scanner	SCA	Vulnerable dependencies in package files
Secret Scanner	Secrets	Hardcoded API keys, tokens, passwords in code

Requirements:

The repository is cloned at depth 1 (latest snapshot only), so the code tools scan the current working tree rather than full git history.

When to use: You have a GitHub repository and want comprehensive coverage including code-level vulnerabilities that cannot be found from outside.

See GitHub Connection for setup instructions.