Scan behind a login
Most of an application is behind a login, and an unauthenticated scan never sees any of it. This is the single change that most increases what a scan finds.
Contents
Before you start
- An account on the target application that you are allowed to test with.
- A crawl or scan you have already run without it, so you can compare.
1Add the credential
Arsenal, then Credentials, then Add. Name it for what it is, so that "Admin session for shop.example.com" is what you see later rather than "cred 3". Give it a role label: it costs nothing now and it is what the authorization testing tutorial builds on.
You should seeAn identity waiting for an authentication method.
2Pick the method that matches the app
A static token or API key sent as a header or cookie, a form login where a username and password are posted, OAuth2 or OIDC in either the non-interactive or the authorization-code shape, or a full SSO and MFA flow driven by a headless browser. For a form login you supply the login URL, the field names the form actually uses, and where in the response the token comes back.
You should seeThe configuration form for the method you chose.
3Test it before you save it
The wizard performs the sign-in and shows you the result. Do this now rather than discovering at the end of a scan that a field name was wrong. A credential that cannot authenticate produces a scan that looks like it ran and tested nothing.
You should seeA successful sign-in, with the resolved session shown back to you.
4Use it in a scan
Launch a web crawl or a vulnerability scan and select the credential in the config step. The broker signs in and hands the engine a resolved token. Your raw secrets are encrypted at rest, never put on the message bus, and never reach an engine.
You should seeThe credential named on the running workflow.
5Check it actually stayed signed in
Compare the endpoint count against the unauthenticated run. If it barely moved, the session is not sticking: usually a token that expires mid-run, or a logout link the crawler followed. The Web Tracer is the shortcut here, because you can browse the application yourself while capturing and save the session you were really using.
You should seePost-login endpoints in the asset graph that the first run never had.
When it does not work
The crawler logged itself out
It followed a logout link. Exclude it in the crawl scope, and prefer a credential the broker can re-resolve so an expired session is renewed rather than lost.
Where do my secrets actually go?
Encrypted at rest, scoped to a workspace and to the hosts you attach them to. At scan time the broker does the sign-in and the engine receives only a resolved token. That is the reason the two are separate pieces.
Which plan does this need?
Authenticated scanning unlocks on Pro, and the gate is enforced server-side rather than hidden in the interface.