Questions tagged [whitebox]

White-box testing is a method of testing software that tests internal structures or workings of an application as opposed to its functionality i.e. black-box testing.

Filter by
Sorted by
Tagged with
0
votes
1answer
181 views

How to bypass the following PHP function [closed]

I need to write PHP code in an application in which I have access to the code, because it is a white box. However, I noticed that they use the following function: function stripbadchars($str_chain){ ...
0
votes
2answers
652 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
16
votes
2answers
3k views

Secure big, old ecommerce website from XSS?

I'm working for an ecommerce website written in C#.net (no CMS used, quite a lot of code) where security hasn't been a priority for a long time. My mission right now is to find and fix any XSS ...
1
vote
1answer
66 views

How secure is the CDM design?

A followup to How secure will EME be? What I don't understand is how the CDM prevents key leakage. Is it not enough to "simply"[*] inspect the browser's memory and derive keys? In other words - ...
-1
votes
1answer
39 views

White-box webpage testers [closed]

I wrote a webPage and i want to localy scan all files in search of somes common vulnerabilities. I searched on the internet a lot and i can't find white-box tools as I thought. Instead of this, there ...
2
votes
2answers
221 views

Pentesting - best bang for your buck? (credentialed versus non-credentialed)

My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed ...
4
votes
4answers
2k views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
3
votes
1answer
157 views

Test suite for a white-box fuzzer

I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
1
vote
1answer
117 views

How to protect integrity of resource files in a white-box attack context?

In a white-box attack context (e.g. PC, tablet, smartphone), there is no trusted entity, which can be used to guarantee some reasonable security. TPM is not considered a solution because it is not ...
16
votes
3answers
946 views

Getting a manual security code review done - What to watch out for?

We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
20
votes
3answers
6k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...