⚠️ If you're thinking of an admin user when adding authentications, please read this article first: Adding an admin user when adding authentications

You can also add, view, update and delete authentications from your targets using our API. This can help if you wish to integrate vulnerability scanning as part of your CI/CD pipeline or otherwise update the authentication credentials automatically.

⚠️ If you're unsure of where to find the info needed, we have just the article for you.

📹 Prefer a video walkthrough?

We also have a video tutorial on adding HTTP Basic authentication which you can find here:

🎥 Video: How to add HTTP Basic authentication

Adding a new target with authentication

Throughout this example, we will be using vulnerablesite.intrud.es where we are hosting our test application.

⚠️ If you're unsure where to find the parameters needed, we have just the article for you.

Targets > Add target > External web application
Type the target into the top box, add the Entrypoint URL and any tags (if applicable), and then click the Add target button.
Select the 'HTTP (Basic, Digest and NTLM)' option and add the relevant parameters to the configuration, then click the 'Next ->' button.

Add the HTTP Authentication parameters:

Adding the Authentication to a pre-existing target

Head back to Targets > All > ... > Add authentication
Click the 'HTTP (Basic, Digest and NTLM)' option:

Adding the authentication

Throughout this example, we will be using 178.79.154.6 where we are hosting our test application, you may use a fully qualified domain name (FQDN) or IP address.

Entrypoint URL

In this example, we are starting our scan from the /basic/ page of our application (http://178.79.154.6/basic/). Unlike form-based authentication there is no login URL, instead the login details are sent with every request.

Logout URL

In our example, we specify that there is a Logout URL which we want to exclude from scanning (http://178.79.154.6/basic/logout). It is possible that you do not have a logout URL for your application if it uses HTTP authentication which is why it's optional, but it's worth noting that your scan may not run correctly if you fail to include a logout URL when one is present in your application.

Realm

We specify a Realm of Fake Realm in our example. To find out what realm you have active on your application please see instructions.

Username and password

Both of these are mandatory. They should be the values that you have configured for your user in your application.

Verifying the authentication

In progress

Before you get any responses, it'll look like this:

Complete

Given how nuanced apps are, we don't presume the accuracy of authentication – instead, we show you what the scanner encountered and allow you to decide whether it has worked or not (the screenshot in particular is helpful, as you can use that to gauge if the scanner can access pages behind the login).

You could get any combination of results, here are just a few:

Managing authentication(s)

Once you've completed this information you will see the authentication appear under the Authentications tab.

To disable an authentication

Click ... > Disable:

And the modal will update to this:

To re-enable, just click the ellipsis again > Enable:

To check the status of the authentication

Click the ellipsis > Check status:

The next modal to pop up will be this one, where you can Confirm the authentication; edit the details or close the modal and disable the authentication.