# Whitebox Agent

Whitebox pentesting is a [Cascade](<https://docs.escape.tech/documentation/ai-pentesting/multi-agent-pentest/index.md>) capability. When you attach repository source code to an assessment, Cascade reasons over that code alongside the running application, so findings can point to the exact file and function behind a vulnerability.

## What It Does

- **Consumes source**: Uses GitHub repositories or uploaded repository archives as whitebox context
- **Pre-seeds recon from the repo**: Maps architecture, auth model, entry points, and high-risk sinks before deep exploitation
- **Combines static triage with dynamic validation**: Uses source-aware findings to prioritize payloads and endpoints, then proves issues against the live target
- **Keeps evidence dynamic**: Static hits stay hypotheses until Cascade validates them on the running application

## How It's Used

In the New Profile form, open **Whitebox Configuration (Optional)**. It has two tabs: **Repositories** and **Archive Upload**. This step isn't available on mobile application profiles. Other context (prior reports, OpenAPI specs, documentation) belongs in **Fine-Tune (Optional)** \> **Artifacts**.

### Connect GitHub Repositories

The **Repositories** tab reads your code straight from GitHub through the Escape GitHub App.

1. In **Integrations**, open GitHub and install the [Escape GitHub App](<https://github.com/apps/escape-technologies>) on your organization. Under **Repository access**, select **All repositories**.
2. On the integration's **GitHub Installation** tab, enter the **Installation ID** and the **Organization login**. The Installation ID is the last segment of the app's configuration page URL in your organization settings. The Organization login is your organization handle.
3. Back in the profile form, select the repositories behind the application on the **Repositories** tab.
4. Each repository starts on its default branch. Pick another branch per row when you need one.

Until a GitHub App installation is connected, the **Repositories** tab links you to the GitHub integration.

### Upload an Archive

On the **Archive Upload** tab, upload a repository archive (`.zip`, `.tar.gz`, `.tgz`). Use it for code that isn't on GitHub.

Attaching source code enables whitebox testing automatically.

## Related

- [Quickstart](<https://docs.escape.tech/documentation/ai-pentesting/quickstart/#step-4-provide-source-code-optional>): Attach source code during pentest creation
- [The Cascade Engine](<https://docs.escape.tech/documentation/ai-pentesting/multi-agent-pentest/index.md>): How Cascade plans and validates findings
- [Proof of Exploit](<https://docs.escape.tech/documentation/ai-pentesting/proof-of-exploit/index.md>): Evidence, including code-file attachments
- [Regression Testing Agent](<https://docs.escape.tech/documentation/ai-pentesting/regression-testing-agent/index.md>): Replay prior findings from uploaded reports