<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-white-box-security-assessment
description: >-
  Full-knowledge security assessment with access to source code, architecture diagrams, network maps, and credentials. Combines static analysis, code review, and targeted testing for comprehensive coverage.
domain: cybersecurity
subdomain: security-testing
tags:
  - white-box
  - code-review
  - sast
  - security-assessment
  - source-code-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1190", "T1552", "T1078"]
  tools: ["semgrep", "bandit", "sonarqube", "checkmarx", "burp-suite", "gitleaks"]
---

# Conducting White Box Security Assessment

## Overview

White-box security assessment leverages full knowledge of the target including source code, architecture, and credentials to identify vulnerabilities that black-box testing would miss. Combines automated static analysis with manual code review and targeted dynamic testing.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `semgrep` | Security tooling |
| `bandit` | Security tooling |
| `sonarqube` | Security tooling |
| `checkmarx` | Security tooling |
| `burp-suite` | Security tooling |
| `gitleaks` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Static Analysis Setup

```bash
# Semgrep — multi-language SAST
semgrep scan --config auto --config p/owasp-top-ten \
  --sarif -o semgrep_results.sarif ./src/

# Bandit — Python-specific security linting
bandit -r ./src/ -f json -o bandit_results.json -ll

# Gitleaks — secrets in source code
gitleaks detect --source . --report-format json --report-path gitleaks.json

# Dependency vulnerability scanning
pip-audit --format json --output pip_audit.json
npm audit --json > npm_audit.json 2>&1
```

### Step 2: Manual Code Review

```bash
# Identify high-risk patterns
grep -rn "eval\|exec\|os\.system\|subprocess\.call" src/ --include="*.py"
grep -rn "innerHTML\|document\.write\|eval(" src/ --include="*.js"
grep -rn "SELECT.*\$\|INSERT.*\$\|DELETE.*\$" src/ --include="*.py"
grep -rn "password\|secret\|api_key\|token" src/ --include="*.env*"

# Authentication and authorization review
grep -rn "login\|authenticate\|authorize\|jwt\|session" src/
grep -rn "@login_required\|@auth\|@permission" src/

# Input validation review
grep -rn "request\.get\|request\.form\|request\.args" src/ --include="*.py"
grep -rn "req\.body\|req\.params\|req\.query" src/ --include="*.js"
```

### Step 3: Architecture Review

```bash
# Network diagram analysis checklist
cat <<'EOF'
ARCHITECTURE REVIEW CHECKLIST
==============================
[ ] Trust boundaries identified and documented
[ ] Data flow diagram with sensitivity classification
[ ] Authentication mechanisms at each boundary
[ ] Encryption in transit and at rest verified
[ ] API gateway and WAF placement reviewed
[ ] Database access patterns and credential storage
[ ] Third-party integration security assessment
[ ] Secrets management solution evaluated
[ ] Logging and monitoring coverage mapped
[ ] Backup and disaster recovery security
EOF
```

### Step 4: Targeted Dynamic Testing

```bash
# Test specific code paths identified in review
# Example: Testing SQL injection on identified vulnerable parameter
sqlmap -u "https://target.com/api/users?search=test" \
  --batch --technique=BEUSTQ --level 5

# Test authentication bypass on identified weak endpoint
curl -s -X POST https://target.com/api/admin/reset-password \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@target.com"}'

# Verify identified hardcoded credentials
curl -s https://target.com/api/health \
  -H "Authorization: Basic $(echo -n 'admin:admin123' | base64)"
```

## Detection

```yaml
title: White Box Security Assessment Detection
id: 50f65d21-79be-43a6-81b1-59b6e5df5a0e
status: experimental
description: Detects suspicious activity related to conducting white box security assessment techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*white*"
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.t1190
  - attack.t1552
  - attack.t1078
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| White Box Security Assessment Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059, T1190, T1552, T1078 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
