Black, grey and white box testing
black box · grey box · gray box · white box · crystal box · clear box · boîte noire · boîte blanche
How much information testers receive before an audit: nothing (black box), a user account or partial documentation (grey box), or everything, source code included (white box).
In practice
Black box testing mimics an outside attacker starting from scratch: realistic, but part of the paid time goes on reconnaissance. Grey box, the most common format, provides for example a customer account to test what a malicious user could do. White box gives access to the code and architecture: it is the most efficient way to find as many flaws as possible in a few days. The choice is written into the audit agreement, alongside the scope.
Fictional case: for its appointment booking app, a clinic chooses a grey box test with two accounts (patient and front desk). The tester checks that one patient cannot view another patient’s appointments, a check that a black box test might never have reached.
