---
title: "Black Box vs White Box"
description: "Understand black-box vs white-box pentesting in TurboPentest, what each covers, and when to connect GitHub source code for deeper white-box analysis."
canonical: https://turbopentest.com/docs/pentesting/black-box-vs-white-box
source: "TurboPentest Docs"
---

# Black Box vs White Box

## Black box (external only)

Tests your application from the outside, like an attacker would. No access to source code.

**Tools included (11):**

| Tool | Category | What it tests |
|------|----------|---------------|
| Port Scanner | Network | Open ports |
| Web Scanner | Web app | XSS, injection, CSRF, misconfigurations |
| Vuln Scanner | Web app | Known CVEs, misconfigurations, exposures |
| Server Audit | Web app | Dangerous files, outdated server software |
| Enumerator | Web app | Hidden directories, backup files |
| Net Scanner | Vulnerability | Full network vulnerability assessment |
| TLS Analyzer | SSL/TLS | Certificate issues, weak ciphers, protocol vulnerabilities |
| Sub Hunter | Recon | Subdomain enumeration |
| Web Probe | Recon | HTTP response probing, tech detection |
| WAF Detect | Recon | WAF detection and fingerprinting |
| Security Checks | Multi | Additional vulnerability checks |

**When to use:** You do not have a GitHub repository, or you only want to test the external attack surface.

## White box (external + code analysis)

Everything in black box, plus static analysis of your source code via GitHub.

**Additional tools (3):**

| Tool | Category | What it tests |
|------|----------|---------------|
| Code Scanner | SAST | Code-level vulnerabilities, insecure patterns |
| Dep Scanner | SCA | Vulnerable dependencies in package files |
| Secret Scanner | Secrets | Hardcoded API keys, tokens, passwords in code |

**Requirements:**
- A `repoUrl` supplied on the pentest request
- GitHub repository connected via OAuth or GitHub App
- Repository access granted to TurboPentest

The repository is cloned at **depth 1 (latest snapshot only)**, so the code tools scan the current working tree rather than full git history.

**When to use:** You have a GitHub repository and want comprehensive coverage including code-level vulnerabilities that cannot be found from outside.

## Setting up GitHub access

See [GitHub Connection](/docs/integrations/github) for setup instructions.