Diffrence between Black Box , white box and grey box testing

White Box Testing Vs. Black Box Testing

    >  Black box testing is easy to use, as the tester does not have to be bothered about the internal workings of the software. The test cases have to be written around the application, exactly the way the end user would use the application.

    > However, with white box testing, the tester has to look inside the application and design the test cases.

    > Since the tester is only concerned about the interface, the task of designing test cases in black box testing does not take very long, as the internal paths do not have to be identified as is the case with white box testing. The task of testing is simplified, as the focus of attention is only the valid and invalid inputs and the outputs received.

    > However, in white box testing digging into the application helps in thorough testing of the application, which is not possible with black box.

 The other difference between white box and black box testing is that :

> black box testing a script is used to test the application. When the interface changes, the valid and invalid input and the output also changes, due to which it becomes very difficult to maintain a script.

> However, with white box testing, the objects to be tested are identified programmatically, which proves to be useful in changing interface scenarios

Gray box testing

When we talk about gray box testing, we're talking about testing a system while having at least some knowledge of the internals of a system. This knowledge is usually constrained to detailed design documents and architecture diagrams. Example : Data Encryption of credit card  no.
Gray box testing allows security analysts to run automated and manual penetration tests against a target application. And it allows those analysts to focus and prioritize their efforts based on superior knowledge of the target system. This increased knowledge can result in more significant vulnerabilities being identified with a significantly lower degree of effort and can be a sensible way for analysts to better approximate certain advantages attackers have versus security professionals when assessing applications.