How do I verify that I own a black-box target?

Cyberlop only tests applications you are allowed to test, and for a black-box target you show that by proving ownership, so that nobody can point a scan at a site that belongs to someone else.

Steps

1. Create a target with the Black-box scan type, or open an existing one from Targets.
2. On the target page, find the Ownership verification card. It sits under Target details.
3. Pick a method. Prove control with a DNS TXT record on your domain, or ask Cyberlop staff to approve the target. Staff approval needs no DNS change at all, which helps when another team looks after your domain.
4. For staff approval, write to /contact and name the target and its URL.
5. Reload the target page. A Verified badge appears when it works, with the text "Ownership confirmed via Cyberlop staff on" followed by the date, and "Black-box scans can run."
6. Press ▷ Scan on a profile.

Good to know

The exact wording of the DNS record is shown in the app when a target is unverified. The captured pages we worked from only show verified targets, so we do not list a record format here. Follow the card, and ask us if anything is unclear. Staff approval is the simplest route when you cannot edit DNS yourself, since no record is needed. Either way, the badge is the only sign you need that scans can run.

• White-box targets do not show this card.
• A black-box target that is not yet verified cannot start a scan.
• Verification applies to that target only. A new target needs its own proof.

See the ways to prove ownership for a comparison.

Related questions

• What are the ways to prove I own a black-box target?
• Where can I see whether a target's ownership has been verified?
• Why can't I run a black-box scan on my new target?
• Why can't I find the Ownership verification card on my target?
• How do I create a black-box target with no source code?

Full tutorial

Verify target ownership in Cyberlop: DNS TXT record or staff approval

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre