Authentication

HunterX supports four authentication modes for scanning authenticated targets.

Basic Auth

hunterx scan http://example.com --auth basic --username admin --password s3cret

YAML:

auth:
  method: basic
  basic:
    username: admin
    password: s3cret

Bearer Token

hunterx scan http://example.com --auth bearer --token eyJhbGciOi...

YAML:

auth:
  method: bearer
  bearer:
    token: eyJhbGciOi...

Load cookies from a JSON file:

hunterx scan http://example.com --cookie-file cookies.json

YAML:

auth:
  method: cookie
  cookie:
    file: cookies.json

Cookie JSON format:

{
  "cookies": [
    {"name": "session", "value": "abc123", "domain": "example.com"}
  ]
}

Form Login

Programmatic form-based login:

auth:
  method: form
  form:
    url: "http://example.com/login"
    username_field: "username"
    password_field: "password"
    username: "user"
    password: "pass"
    extra_fields:
      csrf_token: "..."   # optional

Environment Variables

export HX_AUTH_METHOD=basic
export HX_AUTH_USER=admin
export HX_AUTH_PASS=s3cret

Auth Header Applied

All subsequent requests after authentication carry the credential, ensuring the scanner operates within the authenticated session.