Skip to content
HuntSecAI
Hunt Web Documentation

Frequently asked questions

Answers to common Hunt Web questions about modes, accounts, MFA, deployment, and reports.

Does Server mode support the same scanning modes as Desktop?

Both support Blackbox and Greybox Environment. Desktop with a graphical session also supports interactive Greybox Browser. Server installs Chromium headless for tools that need it; opening the Dashboard from a laptop does not give the VPS an interactive Browser session. See the Desktop and Server/VPS installation guides.

Why does a Desktop Browser fail to open despite a Health check?

Health checks command availability. A visible launch also depends on the graphical session, host libraries, permissions, and sandbox support. Read the specific launch or installer error and correct that condition. An open window and saved session still require a fresh access check before treating the target account as logged in.

Are model keys and scanner tool keys interchangeable?

No. Hermes provider/model configuration is separate from optional ProjectDiscovery (PDCP_API_KEY) and Shodan (SHODAN_API_KEY) tool credentials. Run ./configure.sh to configure the installation's Hermes profile and supported tool keys. In Settings, distinguish scanner/Hermes configuration from Assistant configuration. A saved configuration does not prove valid credentials, available quota, or connectivity; unrelated functions can still work when a particular provider is unavailable. Enter keys in configuration controls, not conversation messages or templates.

Where does the six-digit login code come from?

The enrolled authenticator app generates the TOTP code; Hunt Web does not email it. Select the correct account entry and keep device clocks accurate. Use a recovery code accepts a saved, single-use alternative when the authenticator is unavailable.

An Admin accessing through a domain must complete authenticator enrollment under Profile → Security / Sessions, then select Go to Dashboard. Operator and Viewer access follows assigned permissions; that domain-Admin enrollment rule does not automatically apply to them. Accounts with MFA already enabled still require it at subsequent logins.

  1. 1Sign in as an AdminAccess the Dashboard through the domain.
  2. 2Profile → Security / SessionsOpen the authenticator setup.
  3. 3Enroll the authenticatorAdd the setup secret to an authenticator app, enter its six-digit code, and save the recovery codes.
  4. 4Go to DashboardScan pages open once enrollment is complete.
Conceptual overview of the workflow.

How is a forgotten Admin password recovered?

The installation owner can run ./configure.sh --recover-admin from its private shell and follow the interactive prompts. It sets a temporary password and revokes old sessions. Change the temporary password after login. Password recovery does not remove MFA or replace encryption keys. For an unfinished first setup with an expired code, ./configure.sh --setup-code issues a new setup code; it does not reopen completed setup.

Does a VPS installation require Cloudflare or publish itself automatically?

Neither. The Dashboard listens on loopback by default; remote access requires SSH forwarding or a separately configured domain, HTTPS, and reverse proxy or Tunnel. Cloudflare is optional. Any Cloudflare Access email/login policy belongs to that deployment, separate from Hunt Web account authentication.

Does “502 Bad gateway” mean Cloudflare blocked scanning?

That message alone does not establish a scan or WAF block. Check Dashboard status, service logs, the proxy destination, and whether the local origin responds. On the VPS, for the default port:

curl -I http://127.0.0.1:3053/sign-in

Substitute the installed port when different. For a Server service, use the unit name reported by ./dashboard.sh status:

journalctl --user -u UNIT_NAME -n 100 --no-pager

Replace UNIT_NAME with that name. A non-systemd background launcher writes DATA_DIR/logs/dashboard.log; a foreground launcher writes to its terminal.

What happens after a restart or an uncertain Hermes message?

Read the saved Run and conversation state before continuing. Refresh the conversation, reconnect if needed, and inspect the instruction's outcome before retrying. Restarting the Dashboard does not resend work. Follow the Hermes Chat guide for delivery, continuation, and recovery controls.

Why can a Report appear older than Results, or a PDF download fail?

Report exports reflect a saved snapshot and can lag behind active assessment work. Check the snapshot time and status. A renderer failure is a separate issue: inspect its log and the installer's dashboard-pdf dependency stage. PDF generation uses its own Python environment with ReportLab, Pillow, fonts, and logo assets. See Findings, Results, and Reports.

Does installing Hunt Web automatically import legacy CLI Runs?

No automatic import into the Dashboard registry is provided. Retain the legacy CLI executable, Hermes profile, work data, tools, and Browser separately. Reuse requires a tested migration procedure; copying old directories into the Dashboard installation's data root is not equivalent to registering their Runs.

For interface locations and account controls, see the Dashboard Menu Guide. When reporting an operational failure, include the release identity, failed step, timestamp, and relevant error code. Redact credentials and session material from log excerpts; keep complete backups and private configuration out of public reports.