Skip to main content
Many important vulnerabilities are only reachable after login: authorization issues, sensitive APIs, upload workflows, admin functions, payment flows, and employee-only portals. An unauthenticated scan can only assess the public surface, so it may miss risk inside authenticated areas. CyStack VulnScan supports authenticated scanning by sending user-provided access context such as session cookies, custom headers, API tokens, or HTTP Basic Authentication credentials. Authenticated scan configuration

​
When to Use Authenticated Scanning

Use authenticated scanning when:
  • Critical application functionality appears only after login.
  • APIs require bearer tokens, API keys, or tenant headers.
  • A staging site is protected with HTTP Basic Authentication.
  • You need to assess customer, employee, or admin areas with a dedicated test account.
  • Public-only scan results do not represent the real application risk.
Use a dedicated test account with the minimum required permissions. Avoid personal administrator accounts unless the assessment plan explicitly authorizes them.

​
Supported Authentication Context

​
Web UI Workflow

  1. Sign in to the target application with a test account.
  2. Copy the required cookie or token from browser developer tools.
  3. Open the asset detail page in VulnScan.
  4. Choose Start scan.
  5. Add the cookie, header, or Basic Auth credentials.
  6. Review scope and start the scan.
  7. After completion, open the scan detail page to review findings from authenticated areas.

​
CLI Examples

Cookie-based session:
Bearer token or API key:
HTTP Basic Authentication:

​
What Authenticated Scans Improve

Authenticated scans improve coverage for:
  • Authorization and role-based access issues.
  • API vulnerabilities behind tokens.
  • File upload, form handling, and business workflows after login.
  • SQL injection, XSS, SSRF, CSRF, and misconfiguration in private areas.
  • Admin pages, debug endpoints, libraries, and plugins not exposed publicly.

​
Safe Practices

  • Use approved environments and test accounts.
  • Grant only the permissions required for the assessment.
  • Avoid real user accounts.
  • Avoid write/delete tokens unless the scan requires them and the test is approved.
  • Use test data where possible.
  • Rotate or revoke sensitive tokens after the assessment.

​
Troubleshooting