How do I create a black-box target with no source code?

A black-box target tests the live URL only. It needs no source code, so you can set one up even when you cannot share a repository.

Steps

1. Go to Targets and click + New target.
2. Type a Name and the Main URL, for example https://staging.example.com.
3. Add any Backend / additional URLs, one per line. This is optional.
4. Under Scan type, choose Black-box. Repo URL (HTTPS) and Repo branch turn grey, and you will see the help text "Not used for black-box scans."
5. Choose an Environment (Dev, Staging or Prod) and, if you like, a Team.
6. Click Create target.

Good to know

Only test an application that you own, or one where you hold written permission to test. That rule explains why a black-box target needs proof of ownership before anything runs.

Once the target exists, its page shows an Ownership verification card, and that card is where you finish the job. Until it is verified, the scan button will not give you a black-box run. Check that the Main URL reads the way you want, since the dialog is the only place to set it.

Back to the options: You can prove ownership with a DNS TXT record or by asking Cyberlop staff to approve it. See how to prove ownership. Targets cannot be edited, so check the URL before you save. For help, use /contact.

Related questions

• How do I verify that I own a black-box target?
• What are the ways to prove I own a black-box target?
• What's the difference between a white-box and a black-box target?
• Why are the repository fields greyed out in the New target dialog?
• Why can't I run a black-box scan on my new target?

Full tutorial

How to add a target in Cyberlop: the New target dialog, field by field

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre