Gray-box testing