Home / Knowledge hub / Black-box testing
Knowledge hub
Black-box testing
Testing an app from outside, with no access to the source code.
What it means
Black-box testing means testing an application from outside with no access to the code, the way an anonymous attacker first meets it. The tester works from what the application gives back: pages, responses, error messages, timing.
White-box testing is the opposite arrangement, with the source available. Most real testing sits between the two, with logins but no code.
The name describes access, not effort. A black-box tester can work for a week and still see only what the outside shows.
Why it matters
Its value is honesty about reach. When a black-box test reaches your customer data, nobody argues about whether the path was realistic, because the tester held exactly what an outsider holds.
The result also sets expectations properly. A clean result means a stranger could not get in through the paths that were tried. That is a genuine statement, and a much narrower one than saying the application is secure.
This is also the cheapest thing to buy badly. A tester with no login sees your marketing site and your sign-up form, writes a tidy report, and never reaches the product you sell.
How it shows up
The blind spots are just as predictable. An outside in test walks past anything that needs a second account to prove. It walks past anything behind a role the tester never received. It walks past anything visible in the source and invisible in the response.
Do not pick a side. Give the tester real logins for every role you have and the worst of the blind spots closes. We ask for exactly that, then return the request, the response and the source line.
Questions people ask
Black-box testing, answered
What is the difference between black-box and white-box testing?
Access, and nothing else. A black-box tester works from outside with no source code. A white-box tester reads the code as well. Grey box sits between the two, usually with logins but no source.
People treat white box as the thorough one. It is not that simple. The two answer different questions, and the cheaper order is normally to fix what the outside shows first.
How much does a black-box test actually find?
Less than people hope, and we will not put a number on it. It finds what the outside reveals in the days you paid for, which leaves out anything needing a second account or a role the tester never held.
Judge a test by what it reached rather than by the length of the report. One finding that names a real record is worth more than a page of observations.
Does a black-box tester need logins to our application?
Strictly no, and you should hand them over anyway. With no login, the test covers your sign-up page and your marketing site, which is rarely the product you sell.
Give one account per role. That single change moves a test from the front door into the rooms behind it, and it costs you nothing.
What should we hand a third party tester before they start?
The scope in writing, the environments they may touch, a login for each role, a contact who answers during the test, and permission signed by somebody entitled to give it.
Say what is out of bounds too. Denial of service testing, real customer data and anything you do not own should be named rather than assumed.
What should a black-box test cost, and how long does it take?
It depends entirely on scope, and anyone quoting a figure before seeing the application is guessing. The useful question to put to a supplier is how many days they will spend, and on what.
For comparison, our own pilot runs 30 days on one application for $199. Prices exclude 18% GST for customers we invoice in India.
Related
Terms that sit next to this one
White-box testing
Testing with access to the source code, not just the running application.
DAST
Tools that attack a running application from the outside.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
SAST
Tools that read your source code without ever running it.
Red team
A simulated adversary given a goal and left to reach it however they can.
Testing blind, or with real logins?
Give us a login for each role and the blind spots of outside in testing close up. You get the request, the response and the line of code behind each finding. Talk to us about scope.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.