Choosing an Assessment Method
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
When you create an assessment in Takumi, you choose one of three assessment methods: graybox assessment, whitebox assessment or blackbox assessment. This page explains which method to choose depending on what you can provide, and how the methods differ.
Recommended Method
If you can provide both the source code and a running environment, choose a graybox assessment.
A graybox assessment analyzes the source code to find candidate vulnerabilities efficiently, and reports only the ones it reproduces against the running application. Because it combines efficient discovery with accurate findings, it is the method Takumi recommends most.
How to Choose
The diagram below shows which method to choose depending on what you can provide. First check whether you can provide the source code, then whether you can provide a running environment.
Note that after a graybox or blackbox assessment, we recommend running a penetration test that carries over its results. It can look for vulnerabilities the assessment did not find and check whether the findings can be chained into more serious damage. A whitebox assessment does not use a running environment, so you cannot start a penetration test that carries over its results.
Comparison
The table below summarizes how the three methods differ. For details on each method, see Graybox Assessment, Whitebox Assessment and Blackbox Assessment.
| Graybox assessment | Whitebox assessment | Blackbox assessment | |
|---|---|---|---|
| What you provide | Source code and a running environment | Source code | A running environment |
| How vulnerabilities are found | Analyzing the source code | Analyzing the source code | Simulated attacks on the running application |
| Reported findings | Only those reproduced in the running environment | Those detected by source code analysis | Those detected by simulated attacks |
| Impact on the target environment | Yes | None | Yes |
| Follow-up penetration test | Available | Not available | Available |