docs(whitebox): sign in to a target with session cookies

white-box-pentest/quickstart.mdx

@@ -1,9 +1,9 @@
 ---
 title: "Quickstart"
 description: "Prepare scope, estimate credits, and start a white-box pentest."
 ---
 
 Use this guide to prepare scope and start a White-box Pentest from the Hacktron
 dashboard.
 
 ## Prerequisites
@@ -11,10 +11,10 @@
 Before you start, make sure the organization has:
 
 - A connected repository or an uploaded archive to assess
 - The branch or commit you want Hacktron to use
 - For dynamic testing, the domains or URLs of the applications to test and
   instructions for accessing each one, even if no sign-in is required
 - Enough Whitebox Scan credits, or an organization owner who can add a payment
   method and buy credits
 
 <Card
@@ -178,6 +178,22 @@
 3. Confirm the help center and search page load.
 ```
 
+For a target where you sign in with session cookies instead of a password:
+
+```text
+1. Open https://staging.example.com/dashboard.
+2. Sign in with this session cookie: Cookie: session=[session cookie value]
+3. Confirm the dashboard loads as qa-user@example.com.
+```
+
+Copy the cookies from a browser that is signed in to the target, either as a
+`Cookie:` header (`name=value; other=value`) or as a JSON export from a cookie
+editor extension. Hacktron adds them to its browser and sends them with its own
+HTTP requests. Instructions are limited to 2,000 characters, so include only the
+cookies that hold the session. The session must stay valid until the pentest
+finishes, so don't sign out of the browser you copied it from. End the session
+after the assessment.
+
 <Warning>
   Auth instructions are shared with AI agents for testing. Use a test
   environment and dedicated test accounts. Keep personal credentials and
@@ -192,27 +208,27 @@
 | Repository          | Primary repository URL, branch, and any related repositories.                      |
 | Source paths        | Folders or path patterns to include or exclude in each repository.                 |
 | Application targets | Staging, production, API, admin, or tenant-specific URLs in scope.                 |
-| Authentication      | Test credentials, SSO notes, MFA bypass instructions, or invite steps.             |
+| Authentication      | Test credentials or session cookies, SSO notes, MFA bypass steps, or invite steps. |
 | Sensitive areas     | Auth, billing, permissions, file upload, webhooks, AI agents, or admin paths.      |
 | Exclusions          | Systems, data, tenants, destructive actions, or rate limits that are out of scope. |
 | Context documents   | Architecture notes, threat models, API specs, or prior pentest reports.            |
 
 ## Other ways to start a pentest
 
 You can also prepare a pentest in Slack, through an AI assistant connected to
 Hacktron's MCP server, or through the REST API. Set the scope and review the
 credit estimate before starting. These options require an organization admin
 to start the pentest.
 
 <Columns cols={2}>
   <Card title="Hacktron in Slack" icon="slack" href="/platform/slack-assistant">
     Mention @Hacktron AI with a repository or an attached archive.
   </Card>
   <Card title="MCP" icon="plug" href="/mcp/get-started">
     Set up pentests from Claude, Cursor, and other AI assistants.
   </Card>
   <Card
     title="Create pentest draft"
     icon="code"
     href="/api-reference/pentests/create-pentest"
   >