What is the difference between gray-box testing and black-box testing?

Black Box Testing is based on verifying the functionality of a system without knowledge of its internal structure and code. Gray Box Testing combines elements of both black and white box testing: the tester has partial knowledge of the internal structure or algorithms of the system, which allows for creating more effective test cases.

Key differences:

Description	Black Box Testing	Gray Box Testing
System knowledge	No knowledge of internal structure and code.	Partial knowledge of internal structure and logic.
Focus	Verifying functionality from the user's perspective.	Combining functionality testing with some knowledge of internal logic.
Test writing	Based on requirements and specifications.	Based on requirements and partial knowledge of code/architecture.
Defect coverage	Finding functional defects, interface errors.	Finding functional defects, logical errors in specific code areas.
Examples of tests	Equivalence partitioning, boundary value analysis, state tables.	Database testing, integration testing based on API knowledge, security testing considering architecture.

Example test case for black box (authentication):

• Valid username, valid password -> Successful login.
• Invalid username, valid password -> Error message.
• Valid username, invalid password -> Error message.
• Empty username, empty password -> Error message.

Example test case for gray box (authentication considering knowledge of max_login_attempts in DB):

• Attempt login with invalid credentials max_login_attempts times -> Account is locked (checking that after max_login_attempts attempts, it indeed locks, based on internal limit knowledge).