Characterising the input-output photon-number distribution of an unknown optical quantum channel is an important task for many applications in quantum information processing. Ideally, this would require deterministic photon-number sources and photon-number-resolving detectors, but these technologies are still work-in-progress. In this work, we propose a general method to rigorously bound the input-output photon number distribution of an unknown optical channel using standard optical devices such as coherent light sources and non-photon-number-resolving detectors/homodyne detectors. To demonstrate the broad utility of our method, we consider the security analysis of practical quantum key distribution systems based on calibrated single-photon detectors and an experimental proposal to implement time-correlated single photon counting technology using homodyne detectors instead of single-photon detectors.