Skip to content

Whitebox Agent

Whitebox pentesting is a Cascade capability. When you attach repository source code to an assessment, Cascade reasons over that code alongside the running application, so findings can point to the exact file and function behind a vulnerability.

What It Does

  • Consumes source: Uses GitHub repositories or uploaded repository archives as whitebox context
  • Pre-seeds recon from the repo: Maps architecture, auth model, entry points, and high-risk sinks before deep exploitation
  • Combines static triage with dynamic validation: Uses source-aware findings to prioritize payloads and endpoints, then proves issues against the live target
  • Keeps evidence dynamic: Static hits stay hypotheses until Cascade validates them on the running application

How It's Used

In the New Profile form, open Whitebox Configuration (Optional). It has two tabs: Repositories and Archive Upload. This step isn't available on mobile application profiles. Other context (prior reports, OpenAPI specs, documentation) belongs in Fine-Tune (Optional) > Artifacts.

Connect GitHub Repositories

The Repositories tab reads your code straight from GitHub through the Escape GitHub App.

  1. In Integrations, open GitHub and install the Escape GitHub App on your organization. Under Repository access, select All repositories.
  2. On the integration's GitHub Installation tab, enter the Installation ID and the Organization login. The Installation ID is the last segment of the app's configuration page URL in your organization settings. The Organization login is your organization handle.
  3. Back in the profile form, select the repositories behind the application on the Repositories tab.
  4. Each repository starts on its default branch. Pick another branch per row when you need one.

Until a GitHub App installation is connected, the Repositories tab links you to the GitHub integration.

Upload an Archive

On the Archive Upload tab, upload a repository archive (.zip, .tar.gz, .tgz). Use it for code that isn't on GitHub.

Attaching source code enables whitebox testing automatically.