Application hosts and account access

Recent Hunt Web updates make application setup and assessment continuation more consistent across the Dashboard and CLI. Blackbox can check public connectivity before a scan, Greybox Environment can discover account-access evidence automatically, and all three testing modes can use related application hosts discovered during an eligible Run. Page summaries also load with less repeated work, while account setup provides clearer next steps.

1. Faster Assessment Lists

Dashboard, Targets, Runs, and Findings now share compact Run summaries instead of repeatedly loading full assessment details for each list entry. Stable summaries can be reused; changes in the underlying assessment records trigger updates. Detailed evidence and report downloads still use the full saved data.

This reduces repeated work during navigation without requiring a separate Redis installation. Account permissions remain checked independently of the summary cache. The first request after an update or restart can take longer than a repeated visit; response time still depends on data volume, scan activity, and the server connection.

Use the page's refresh control to request the latest available summary. Opening or refreshing a list does not start a scan.

Enlarge

2. Check Blackbox Connectivity Before Scanning

Open Targets → the Blackbox Target → Connection and application hosts, then select Test Connection & Detect Application Hosts.

1. 1Open the Blackbox TargetFrom Targets.
2. 2Connection and application hostsFind the connection section of the Target.
3. 3Test Connection & Detect Application HostsPublic pages are opened without account credentials.
4. 4Review the resultCheck the updated Application URLs to test.

The check opens public application pages without supplied account credentials. Headless Chromium observes JavaScript requests when the page requires browser execution. Related application links on another subdomain or port are also checked within a limited exploration budget. For example, a portal at http://lab.example.com:8088/ can link to application services on ports 4000 and 5000. An application response must be confirmed before a linked origin is added; the presence of a link alone is insufficient.

Review the result and the updated Application URLs to test. The interface distinguishes confirmed connectivity, anonymous-access restrictions, security challenges, HTTP errors, timeouts, and unavailable JavaScript observation.

When preparation adds eligible hosts, Hunt Web saves updated configuration for Prepare Run. This button does not create a Run, invoke a model, or start vulnerability testing. It is optional: newly configured Blackbox Targets can use runtime host discovery even when this check is skipped.

3. Detect Greybox Environment Account Access Automatically

For a new Environment setup, select Automatic · detect account access, upload the supported Cookie Editor JSON for each account, and provide an Authentication check URL. A normal page reached after sign-in or a known account endpoint is more useful than a public homepage that exposes no account information. Select Test Authentication to check the saved setup.

1. 1Select AutomaticAutomatic · detect account access.
2. 2Upload the cookiesCookie Editor JSON for each account.
3. 3Add the check URLA normal page after sign-in, or a known account endpoint.
4. 4Test AuthenticationHTTP first. Chromium observes account requests when needed.

Automatic first attempts HTTP verification. When that response does not establish login, Chromium observes the application's account requests. The result is compared with anonymous behavior; an HTTP 200 response alone does not establish authenticated access. Related application hosts that meet the saved policy can populate Application URLs to test during this process.

Successful proof is saved privately for subsequent checks. Replacing cookies requires fresh proof. Two-account assessments also need evidence that the accounts represent distinct identities; one account imported twice does not provide a valid two-account comparison.

Server installations use headless Chromium for this preparation. Interactive Greybox Browser still requires a Desktop graphical session. Dashboard account MFA and authentication to a scanned application are separate checks.

4. Use Related Hosts Discovered During a Run

A modern application may load its interface from https://app.example.com and send application requests to https://api.example.com. A Run with the saved automatic host policy can admit that related API without requiring another Run solely for the newly discovered host.

This applies to Blackbox, Greybox Environment, and Greybox Browser. The source can be observed application traffic, an eligible redirect, or an API reference in application HTML or JavaScript. Constant configuration URLs are supported, including strings assembled through variables, concatenation, and constant templates.

Detection and activation are different stages:

1. 1Candidate referenceAn application source mentions an address.
2. 2Admitted application hostThe address meets the saved policy.
3. 3Recorded requestA request has an observed outcome.
4. 4Verified findingPassed the separate evidence-verification workflow.

Automatic admission remains within the application's registered-domain boundary and respects explicit path, support-origin, scheme, and account rules. A different port is a different origin. External social links, recognized analytics, and unrelated third-party services do not automatically become testing targets. Static support traffic also does not make every asset host an active scan target. Cookies retain their domain/path restrictions and the identity of the account that supplied them.

This is application-host discovery, not enumeration of every subdomain. Endpoints hidden behind unexplored workflows or unresolved dynamic code can remain undiscovered.

5. Review Coverage Without Losing the Run's History

Open Runs → the Run → Overview → Detected application hosts to inspect recorded hosts and their coverage. Review hosts opens the fuller Target view. Scrollable lists keep long host inventories contained within the page. Check the selected Run's coverage when the Target has a newer configuration.

1. 1RunsOpen the list of saved scans.
2. 2The RunChoose the assessment.
3. 3OverviewThe Run's context and status.
4. 4Detected application hostsReview hosts opens the fuller Target view.

The original Scope snapshot remains unchanged. Hosts admitted by its saved policy are retained separately as effective runtime coverage and are available to subsequent requests, verification, Resume, and Hermes continuation.

6. Continue Through Hermes and Read the Actual Outcome

An eligible Run can continue with its saved host coverage and account context. Resume and Hermes continuation can also recover previously missed references from that Run's saved HTML and JavaScript evidence. Recovering references does not itself replay requests or create another assessment.

The shared runtime also handles malformed links in responses without losing an otherwise valid response and its evidence. Terminal startup checks now report more useful diagnostics; a startup retry occurs before a command is released, rather than repeating a command that already executed.

7. Account Setup and Restart Behavior

An Admin using a domain completes required authenticator enrollment through Profile → Security / Sessions. Accounts needing an initial password change are also directed to security setup. Once setup is complete, Go to Dashboard returns to the workspace. Role permissions continue to apply; details are in Dashboard Accounts and Roles.

Autostart depends on the machine's installed service configuration. Server deployments can use an enabled user service with lingering; a manually started Desktop process is not automatically a persistent boot service. A Desktop service also does not supply the graphical session required by interactive Greybox Browser. Follow the relevant Desktop or Server installation guide.

For an existing installation, follow the update and recovery procedure, then review the selected Scope, account-check result, effective Run coverage, and saved outcomes. Restarting the Dashboard does not automatically resume scanning or resend Hermes instructions.