Define authentication for testing

If your target requires authentication, you need to create a test account for XBOW and configure how XBOW should authenticate during testing.

Publicly accessible targets

If your target is publicly accessible without authentication, leave the “Credential set” area blank on the “Target configuration” page.

Then see Configure your server to allow XBOW requests.

Define authentication details

On the “Target configuration” page, use the “Credential set” area to tell XBOW how to authenticate with your target using a test account. For guidance on creating a test account, see Using a dedicated test account.

Supported authentication methods:

Note: If your target uses account lockout mechanisms, repeated authentication attempts can interrupt your assessment by triggering lockouts. If possible, we recommend turning off lockout mechanisms for the duration of your assessment. Alternatively, you can enable sequential mode to limit session validation for a credential set to once every 3 minutes. See Sequential mode.

For other ways authentication problems can pause an assessment, see Authentication problems.

Username and password

  1. Define the Username and Password of the account to use for testing.
  2. If the account uses multi-factor authentication (MFA) with Time-based One-Time Password (TOTP), configure MFA access:
    • Allow XBOW to receive email (for email-based MFA): Click to create a temporary email address for MFA during testing.
    • Upload OTP QR code (for authenticator apps): Upload an image file with the QR code used to add the account to an authenticator.
    • Paste an OTP URL (for authenticator apps): If you have the OTP URL (starting with otpauth://), copy it to your clipboard and use the paste button to upload it.
  3. If the account supports single sign-on (SSO) with a link sent to users by email, click Allow XBOW to receive email to create a temporary email address. Supported for Okta and similar identity and access management systems (IAM).

Tip: XBOW does not support TOTP sent using SMS or other forms of MFA. If your target uses an unsupported form of MFA, we recommend temporarily disabling MFA for the duration of the test.

If authentication requires users to receive email and click a link in the message, click Allow XBOW to receive email to create a temporary email address for validating accounts.

Social login

If your target supports authentication using a social account, enter the username and password for that account in the Username and Password fields.

  • Supported: GitHub and Microsoft accounts
  • Not supported: Google accounts. Google blocks XBOW test requests even after successful authentication.

Basic HTTP authentication and static bearer token

  1. Scroll down the page to the Authorization header section and click to expand it.

  2. From the dropdown menu, select an authentication option (default is None):

    • Basic auth: Use to authenticate with a username and password.
    • Bearer token: Use to authenticate with a static bearer token or API key.
    • Custom: Use to authenticate with a custom value.

  3. By default, XBOW will only include your authorization header in requests to attackable hosts. If you need to authenticate to other accessible hosts, select Include in requests to all hosts in assessment scope.

Note: Tokens and API keys need to be valid during the whole assessment process.

Provide authentication instructions

If you have a complex or unusual method of authenticating, you can give XBOW instructions on how to authenticate with the details you provide in the “Credential set” area. Do not include usernames, passwords, or tokens in instructions. Instead, enter them in the credential fields.

  • Write step-by-step instructions that a human security tester could follow. Include signals XBOW can use to distinguish successful authentication from a failed attempt (for example, a redirect, a visible element on the page, or a specific status code). Clear, detailed instructions reduce the risk of assessment pauses. See Authentication problems.
  • Enter steps that apply to one account in that credential set’s Authentication instructions field.
  • If you are testing with multiple credentials, enter steps that apply to every account in Shared authentication instructions, below the credential sets.

Edit credentials on a running assessment

If a test account’s name or password changes, expires, or was entered incorrectly, you can update its credentials without discarding the assessment and starting over. Any progress already made is kept.

You need the Manage asset credentials permission to do this, which is available to users with the Existing Asset Admin or Administrator role. See User roles. If you do not have this permission, ask an organization administrator to update the credentials.

  1. Pause the assessment, or open the dashboard of an assessment that is already paused.
  2. On the assessment dashboard, click Edit credentials.
  3. Update the Username, Password, or Role description (if shown) as needed. Leave Password blank to keep the current password.
  4. Save your changes.
  5. Click Resume. XBOW authenticates with the updated credentials when it resumes.

Note: Credentials are stored at the asset level, not as part of individual assessments. Updating credentials here corrects them for any other running or future assessments that use the same test account. All running assessments pick up the change the next time they pause and resume.

If you use this credential set for IDOR analysis, avoid changing the Username while the assessment is running. XBOW correlates IDOR findings to account identity, and changing the username can invalidate IDOR results already gathered in this assessment. Changing the Password does not have this effect. For more information, see Add extra credentials for IDOR analysis.

Add extra credentials for IDOR analysis

Insecure Direct Object Reference (IDOR) testing uses up to four additional accounts to build a richer understanding of the authorization model for the asset. By comparing what different users can access, XBOW detects cross-user data leaks, privilege escalation, and authorization flaws that are invisible when you test with a single account.

Note: IDOR analysis is available as a public preview release.

To add credential sets for IDOR testing, see Add a credential set.

Next steps

  1. Work with multiple credential sets (optional)
  2. Provide XBOW with context to guide testing (optional)
  3. Configure your server to allow XBOW requests

Was this helpful?