diff --git a/white-box-pentest/quickstart.mdx b/white-box-pentest/quickstart.mdx
index 3690b04..07b98c0 100644
--- a/white-box-pentest/quickstart.mdx
+++ b/white-box-pentest/quickstart.mdx
@@ -178,6 +178,22 @@ For a public target:
 3. Confirm the help center and search page load.
 ```
 
+For a target where you sign in with session cookies instead of a password:
+
+```text
+1. Open https://staging.example.com/dashboard.
+2. Sign in with this session cookie: Cookie: session=[session cookie value]
+3. Confirm the dashboard loads as qa-user@example.com.
+```
+
+Copy the cookies from a browser that is signed in to the target, either as a
+`Cookie:` header (`name=value; other=value`) or as a JSON export from a cookie
+editor extension. Hacktron adds them to its browser and sends them with its own
+HTTP requests. Instructions are limited to 2,000 characters, so include only the
+cookies that hold the session. The session must stay valid until the pentest
+finishes, so don't sign out of the browser you copied it from. End the session
+after the assessment.
+
 <Warning>
   Auth instructions are shared with AI agents for testing. Use a test
   environment and dedicated test accounts. Keep personal credentials and
@@ -192,7 +208,7 @@ For a public target:
 | Repository          | Primary repository URL, branch, and any related repositories.                      |
 | Source paths        | Folders or path patterns to include or exclude in each repository.                 |
 | Application targets | Staging, production, API, admin, or tenant-specific URLs in scope.                 |
-| Authentication      | Test credentials, SSO notes, MFA bypass instructions, or invite steps.             |
+| Authentication      | Test credentials or session cookies, SSO notes, MFA bypass steps, or invite steps. |
 | Sensitive areas     | Auth, billing, permissions, file upload, webhooks, AI agents, or admin paths.      |
 | Exclusions          | Systems, data, tenants, destructive actions, or rate limits that are out of scope. |
 | Context documents   | Architecture notes, threat models, API specs, or prior pentest reports.            |