Repository navigation
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the new option to paste session cookies into a target's Auth instructions instead of a password. The quickstart now has an example, says which formats work (a
Cookie:header or a cookie-editor JSON export), points out the 2,000-character limit, and says the session must stay valid until the pentest finishes. The scope checklist now lists session cookies under Authentication.Draft until the feature reaches production. Related PRs: HacktronAI/agent#73, HacktronAI/web#1720, and the engine PR.
🤖 Generated with Claude Code
Note
Low Risk
Documentation-only change with no runtime or security logic; it describes handling session cookies in auth instructions, so readers should still follow the existing warning about test environments and revoking access after assessments.
Overview
The white-box pentest quickstart now documents session-cookie authentication as an alternative to username/password in Auth instructions.
It adds a step-by-step example (open URL, paste a
Cookie:session value, confirm the expected user), plus guidance on copying cookies from a signed-in browser as aCookie:header or cookie-editor JSON export, the 2,000-character instruction limit, keeping the session alive until the pentest completes, and ending the session afterward. The scope checklist Authentication row now explicitly includes session cookies alongside test credentials and SSO/MFA notes.Reviewed by Cursor Bugbot for commit 36ea784. Bugbot is set up for automated code reviews on this repo. Configure here.