Black box penetration testing strategy provides the tester with:

In black box testing, the tester receives only a target list - such as IP address ranges, domain names, or application URLs - that defines the authorized scope of the engagement. All other information including network topology, credentials, and source code must be uncovered through active reconnaissance and testing, mirroring the perspective of an external attacker with no prior knowledge. This methodology validates how well the environment withstands attacks from an uninformed adversary.

A network diagram is provided in white box (crystal box) testing, where the tester receives full knowledge of internal architecture before the engagement begins.

Source code access is a characteristic of white box testing that enables static analysis - it is never provided in a black box engagement.

Privileged credentials are supplied in white box or certain gray box engagements to assess internal systems, not in black box testing where no prior access is assumed.