The information in this document applies to version 7.2.0.24 of Syhunt Dynamic.

Introduction

Since version 7.2, Syhunt Dynamic supports a range of authentication methods, including Standard, Recorder, Selenium-Auto, Selenium-JS, Smart, Basic, Bearer, Digest, NTLM, and Manual Authentication.

Most authentication methods are automated. In these cases, Syhunt Dynamic authenticates using the credentials and settings configured in the Target Preferences screen. Depending on the selected method, authentication may be performed through automatic login form detection, replaying a recorded browser-based login sequence, executing a Selenium script, or using HTTP authentication mechanisms. Syhunt Dynamic can monitor authenticated sessions and automatically re-authenticate when supported by the selected authentication method.

Manual Authentication allows a scan to be started from an authenticated browser session established through Edge or Chrome using the Syhunt Sandcat browser extension. In this mode, Syhunt Dynamic monitors the authenticated session throughout the scan and reports if the session is lost before the scan completes.

The available authentication methods are described below.

Available authentication methods

What's New in Version 7.2

Version 7.2 introduces Syhunt Authenticator 2.0, a major redesign of Syhunt Dynamic's authentication framework.

In previous versions, the authenticator was primarily responsible for Selenium-based authentication. Starting with version 7.2, all authentication methods are managed through a single unified authentication module, providing a more consistent configuration experience and simplifying authentication management.

Authentication settings that were previously split between web form authentication and server-side authentication methods (such as Basic, Digest, and NTLM) have been consolidated into a single configuration interface within the Target Preferences screen.

Version 7.2 also introduces several new authentication methods:

• Recorder – Records and replays browser-based login sequences.
• Smart – Automatically combines Selenium-Auto and Standard authentication for improved compatibility.
• Selenium-Auto – Automatically generates and executes Selenium authentication scripts without requiring user-written code.
• Selenium-JS – Executes custom authentication scripts written in Node.js.

The legacy Selenium-Python and AI-Powered authentication methods have been removed. This change eliminates the need to install and maintain a separate Python environment and third-party dependencies while reducing exposure to risks associated with external components and software supply chain attacks. The newly added method Selenium-Auto replaces the AI-Powered authentication method and works in a very similar manner, just not requiring Python or AI integration.

As a result, authentication setup is now simpler, more secure, and better integrated with the Syhunt Dynamic scanning workflow.

How to configure and test authentication

1. Go the Syhunt web UI's Targets screen.
   
2. Add the URL to the list of targets, if you have not done so yet.
   
3. Open it and go to the Authentication tab.
   
4. Select the desired authentication method.
5. Fill in the credentials.
6. Finally, click the Run Test button to make sure it is working.
   
   1. If it worked, you will see a Success message and a screenshot of the page after logging in.
      
   2. If it failed, you will see a Failed message with a debug log.

Additional help:

• If you selected Recorder, please read the Recorder section.
• If you selected Selenium-JS, please read the Selenium section.
• If you wish to perform manual login, please read the Manual Login section.

How to configure and test a recorded login sequence

The Recorder authentication method allows Syhunt Dynamic to authenticate by replaying a browser login sequence that you previously recorded using Edge, Chrome, or another Chromium-based browser. Instead of manually creating an authentication script, you simply record the login process, export the generated JSON recording, and paste it into the Target Preferences screen. Syhunt Dynamic can then automatically replay the recorded steps whenever authentication is required during a scan.

Linux users only: When recording a login sequence, avoid using the Backspace key to correct typing mistakes. If you enter incorrect text, it is recommended to restart the recording instead. Due to a compatibility limitation observed during testing, recordings that rely on Backspace keystrokes may not replay correctly on Linux systems.

1. First, make the recording:
   1. Using Edge, Chrome or any Chromium-based browser, navigate to the website you want to scan - enter the target URL using the browser's address bar and press Enter.
   2. Right-click the page and click the Inspect option at the end of the menu.
      
   3. Go the the Recorder tab.
      
   4. Click the button Create recording.
      
   5. Enter a reference name for the recording e click the Start recording red circle button.
      
   6. Perform your login as usual.
   7. When you have finished, click End recording.
      
   8. Log out and click the Replay button at the top to make sure the recording is working perfectly when re-executed.
      
   9. Finally, click the Show code button at the right side of the screen.
      
   10. Manually select the JSON code, then right-click and select Copy in the menu. Note: do not use Select all followed by Copy, since a small Chrome UI bug prevents the full selection of the JSON contents.
2. Finally, integrate it with Syhunt:
   1. Go the Syhunt web UI's Targets screen.
      
   2. Add the login URL to the list of targets, if you have not done so yet.
      
   3. Open it and go to the Authentication tab.
      
   4. Select the Recorder option.
   5. Paste the JSON you copied where it says Recorded Login Sequence.
      
   6. Click the Run Test button to confirm that the recorded login sequence is working with Syhunt.
      

How to perform manual authenticated scan

If the Syhunt Sandcat browser extension is installed in your web browser (Edge, Chrome, Brave, or any other Chromium-based browser), you can start a scan directly from the browser using an authenticated session established after signing in to the target website.

1. First, make sure you have the Syhunt Sandcat browser extension installed and available.
2. Navigate to the website you want to scan - enter the target URL using the browser's address bar and press Enter.
3. Log in to the website using your credentials.
4. Click the Sandcat extension icon in the browser toolbar and click the Scan This Site option.
   
   
5. A new screen will open and a green colored message saying "Session Ready" will indicate if the session has been captured.
6. Click the Start Scan button to initiate the scan.

Syhunt will indicate in the session details area of the report if the session started manually was maintained from the beginning till the end of the scan with a Authenticated Session Maintained: Yes.

How to configure and test Selenium-based authentication

1. Enter the form credentials
   1. Go to the Targets area using the top menu.
      
   2. Add the URL to the list of targets, if you have not done so yet.
      
   3. Click the URL you just added and the Target Preferences screen will open.
   4. In the Authentication tab, select the Selenium-Auto or Selenium-JS option - Selenium-Auto automatically generates the script while the JS option will require you to manually enter a JS script.
   5. Enter the username and password.
   6. Click the Save button to save the preferences. The Target Preferences window will close.
   7. If you selected the Selenium-JS option, you need to use the CLI to enter the Selenium script. Example:
      scancore -tg:http://yourtargetapp.com -prefset:dynamic.formauth.script.seleniumjs.encrypted -fromfile:caminho/myseleniumscript.js
      1. Start your JS script at the part that manipulates and submits the form.
      2. Do not call driver.get() at its beginning, do not call driver.quit() at its end. Syhunt will automatically take care of that.
      3. Enter @user@ and @pass@ within a script variable to use the username filled in the Authentication tab. Examples: username_field.send_keys('@user@') and password_field.send_keys('@pass@')
2. Test the Selenium script authentication:
   1. Click again in the URL you just configured and click Run Test button.
      
   2. If you see the Successful login message with the screenshot of the logged in page at the top of the screen, then it is ready to be automatically used in future scans.
   3. If you see the a failure message after multiple retries, fine tune your Selenium script and try again.

Now when a scan report is generated you will see the screenshot of the scanned URL after logging in and an indication if the authentication session was maintained from the start to end of the scan at the top of the report.

How to enable scheduled scan with authentication

1. Go to the Scans screen and then click the Scheduled Scans button.
2. Click on a scheduled dynamic scan and click on the Preferences button next to the target input.
3. Go to the Authentication tab and enter the credentials and desired authenticated method.

How to configure and perform authenticated scan through CLI

In this case, there are two methods: a) passing the credentials through the ScanURL command, or b) leaving the credentials pre-configured through the scancore command. The second method is considered more secure as the password is not exposed while executing the ScanURL command. Examples:

-- Method A - Indicating form authentication when firing a scan
-- In this case, credentials are not permanently stored in Dynamic settings.
 scanurl http://127.0.0.1 -atype:Form -auser:yourusername -apass:yourpassword

-- Method B - Configuring Basic authentication for a specific website
-- In this case, the credentials are stored in the Dynamic settings and are reused in all scans against the indicated target.
-- The available form auth types are: 
-- None, Smart, Standard, Basic, Bearer, Digest and Selenium-Auto. 
-- None disables the form authentication.
 scancore -tg:http://127.0.0.1 -prefset:dynamic.formauth.type -v:Standard
 scancore -tg:http://127.0.0.1 -prefset:dynamic.formauth.username -v:myuser 
 scancore -tg:http://127.0.0.1 -prefset:dynamic.formauth.password -vsecret -vstring
-- If you are performing Bearer authentication, use:
 scancore -tg:http://127.0.0.1 -prefset:dynamic.formauth.token -vsecret -vstring
 scanurl http://127.0.0.1

Tweaking Syhunt Dynamic's Form AutoComplete

Note: This procedure currently works with the following authentication methods: Standard, Smart, Selenium-Auto, and is now primarily intended for advanced customization scenarios.

Syhunt Dynamic automatically handles form field detection and auto-completion in most applications. Manual configuration is only required when a form uses non-standard field names, custom controls, or additional fields that cannot be identified automatically. When needed, you can instruct Syhunt Dynamic how to populate these fields as shown in the example below.

Example form with additional fields

<input name="ClientUTBox" id="ClientUTBox" type="hidden" value="1234">
<input name="ClientUNBox" id="ClientUNBox" type="text" class="InputBox"/>User Name
<input name="ClientPWBox" id="ClientPWBox" type="password" class="InputBox" >Password

The following CLI procedure will reprogram Syhunt to fill in the additional fields:

1. Enter the custom form fields
   1. Go to the Targets area using the top menu.
      
   2. Click the specific URL (must have been added previously) and the Target Preferences screen will open.
   3. In the Authentication tab, click Optional to expand additional options.
   4. Click the Custom Fields button and add the example lines below.
   5. Click the Save button to save the custom fields.
   6. Finally, click Save at the bottom.

ClientUTBox=1234
ClientUNBox=@syhunt_web_form_username
ClientPWBox=@syhunt_web_form_password

CLI Example

Alternatively, you can configure the custom fields manually.

scancore -tg:"[targeturl]" -prefset:dynamic.formauth.fields.encrypted -v:[ClientUTBox=1234],[ClientUNBox=@syhunt_web_form_username],[ClientPWBox=@syhunt_web_form_password]

Values above after the equal sign starting with an @ are internal variables, they ensure that the web form login information you entered in the Target Preferences screen is used in the two form inputs you provided. Once the above configuration is performed, click the Run Test button to confirm a successful authetication using the configured credentials and custom fields.

Preventing Accidental Logout

Syhunt Dynamic automatically detects most logout pages and avoids them during crawling. If a logout page is encountered unexpectedly, the scanner can usually recover by automatically re-authenticating and continuing the scan.

For applications that use custom logout URLs or non-standard logout mechanisms, you can optionally define logout pages in your Target Preferences to help the crawler avoid them altogether.

1. Go to the Targets screen.
   
2. Open a specific URL target.
3. Go to the Crawling tab.
4. Within Exclusions, click the Logout URLs button and add the custom logout URL, for example: /getmeout.php
5. Click Save to confirm the preferences. The input dialog will close.

Using Client SSL Certificates

If you need to use specific client SSL certificates, the Target Preferences screen allows you to configure the client certificates.

1. Go to the menu Admin -> Connectors
2. Click the Add button.
3. Select Web Certificate as Type and enter a reference name for your certificate, and click the Create button.
4. Click the certificate you just added in the list. The Web Certificate screen will open.
5. Select the certificate files and click the Save button.
6. Finally, go to the Targets screen.
7. Click a website you want to enter certificates. The target preferences screen will open.
8. Go to the Advanced tab and, under Certificate, select the desired certificate from the list.