WHITE BOX PENETRATION TESTING
White box penetration testing of your source code, with AI
A white box pentest gives the tester full access to the source code, so nothing is hidden behind a login or an unknown endpoint. Nurbak runs an AI white box pentest on your GitHub repo: its own self-hosted model reads the code like an attacker with full access and reports what is actually exploitable.
Create account and connect GitHubWe never store your code. We only write when you ask for a fix PR.
Full coverage of the code
Every route, handler and query is in view, including admin paths and endpoints a black box tester would never discover from outside.
Business logic and IDOR
Authorization checks live in the code. Reading it is the fastest way to spot a missing ownership check or a broken role rule.
Faster than probing blind
No time spent on reconnaissance or guessing. Findings point to the exact file and line, with a CWE.
Fixes you can merge
Nurbak turns a finding into a pull request with the fix and a security regression test, in one click.
White box vs black box vs grey box penetration testing
| Aspect | Black box | Grey box | White box |
|---|---|---|---|
| What the tester knows | Nothing beyond what an outside attacker sees | Partial: usually a user account, some docs or the architecture | Everything: source code, configuration and documentation |
| What gets tested | The running system from outside | The running system as a logged-in user | The code and how it would behave when attacked |
| Best at finding | Exposed services, misconfigured servers, what the internet sees | Privilege escalation and flaws behind the login | Injection, IDOR, broken auth, logic flaws, hardcoded secrets |
| Blind spots | Code paths it never reaches | Areas outside the test accounts | Live infrastructure, network and deployment configuration |
| Speed and coverage | Slow, a lot of time goes to recon | Medium | Fastest route to broad code coverage |
What Nurbak's AI white box pentest checks
Exploitable flaws in your code
SQL injection, IDOR, SSRF, XSS, authentication and JWT flaws, CORS, CSRF, SSTI and XXE, each with file, line and CWE. How IDOR works.
Secrets, including git history
Hardcoded keys, tokens and passwords, even in old commits you thought were gone.
Vulnerable dependencies
Known CVEs from the OSV database, with the version that fixes them.
CI and infrastructure as code
Misconfigurations in GitHub Actions workflows, Dockerfiles, Terraform and Kubernetes manifests.
Critical code without tests
Security-sensitive code with no tests, where a regression could slip through unnoticed.
What it does not do
Nurbak does not exploit live systems or test your running infrastructure, network or cloud accounts. Pair it with a black box test for that. Penetration testing tools.
How it works
Create an account and connect GitHub. Public and private repos both work.
Pick a repo. Nurbak's own model reads the source on ephemeral infrastructure, not on OpenAI or Anthropic.
Get a 0 to 100 security score and findings with file, line, CWE and a plain-language explanation.
Open a pull request with the fix and a regression test in one click.
On a plan, the repo is rescanned daily, so new code gets tested too.
White box penetration testing FAQ
What is white box penetration testing?
It is a penetration test where the tester has full knowledge of the target, including the source code, configuration and documentation. Instead of probing the system from outside, the tester reads how it works and looks for vulnerabilities an attacker could exploit. For the basics, see what penetration testing is.
White box vs black box penetration testing: what's the difference?
A black box test starts with no inside knowledge and attacks the running system the way an outside attacker would. A white box test starts from the source code. Black box shows what is exposed on the internet today; white box reaches code paths a black box test may never find, like hidden endpoints or missing authorization checks. Many teams combine both.
What is a grey box pentest?
A grey box pentest sits in the middle: the tester gets partial knowledge, usually a user account, API docs or an architecture overview, and tests the running system as a logged-in user. It is good for finding privilege escalation and flaws behind the login, with less setup than a full white box review.
What are the advantages and limits of a white box pentest?
Advantages: broad coverage of the code, better detection of business logic flaws and IDOR, and less time lost on reconnaissance. Limits: it does not test the live environment, so server configuration, network exposure and deployment issues need a black box or infrastructure test.
Is Nurbak a white box pentester?
Yes, for your source code. Nurbak's own AI model reads your GitHub repo like an attacker with full access, tries to chain findings into real attacks and reports what is exploitable, mapped to categories like the OWASP Top 10 2025. It does not exploit live systems or test infrastructure. More in AI pentest and automated penetration testing.
Is my code sent to a third-party AI?
The analysis runs on Nurbak's own self-hosted model on ephemeral infrastructure, so your code is not sent to OpenAI or Anthropic to be analyzed, and every step is recorded in a hash-chained audit trail. Only if you ask for a fix pull request and give explicit consent is the fix generated with Claude.
How much does it cost?
The first scan is free and shows the 3 most important findings in full, plus 1 free fix PR. Plans are USD 79 per month for 1 repo and USD 199 per month for up to 5 repos, with daily scans. Above 5 repos there is an Enterprise plan. We charge per repo, not per developer. See pricing, or compare with penetration testing as a service.
Run a white box pentest on your repo
Connect GitHub and get your security score and your 3 most important findings free.
Scan my repo