Scanning workflow: from Target to Report

A Hunt Web assessment follows Target → Scope → Run → Findings → Report. Preparation includes selecting the application and testing method, saving its boundaries and account access, and starting a Run. During execution, the Dashboard supports activity inspection, Pause/Resume, and further investigation through Hermes Chat using the same saved context. This guide describes that process in the Dashboard. The agents that carry out a Run are described in Agent AI Scanning.

1. 1TargetAdd the application and choose the testing mode.
2. 2ScopeSave the URLs and account access to test.
3. 3RunPick a profile and follow the scan.
4. 4FindingsReview verified issues and evidence.
5. 5ReportRead the saved snapshot or export a PDF.

1. Add a Target and Choose a Testing Method

Start in Targets → Add Target. Give the application a recognizable name, enter its URL, and choose the testing method. Testing requires ownership of the application or authorization to assess it.

Linux Desktop supports all three modes. Linux Server/VPS supports Blackbox and Greybox Environment, with headless Chromium available for tools that need it. Interactive Greybox Browser needs a graphical Desktop session on the machine running Hunt Web.

Enlarge

2. Save the Scope and Application URLs

The Target identifies the application. Its Scope records the URLs and boundaries to test, together with the account configuration where required.

For Greybox, use Application URLs to test for application addresses, including related APIs that belong in the assessment. For example, if an application at https://app.example.com/ uses https://api.example.com/, include the API address if it belongs in the intended assessment. In Browser setup, Login/support URLs support sign-in; they do not add testing targets.

Detected application hosts provide a list of addresses observed in traffic for review. They can appear during Target/Scope preparation and in a Run's Overview. Review those candidates before adding them. The Blackbox subdomain target list is a separate setup option; observing a request alone does not add its host to a Run's testing boundaries.

Each Run keeps its saved Scope snapshot. A Run created with the automatic host policy can also admit related application hosts discovered during that Run when they meet the policy, without requiring another Run for those hosts; see Application hosts and account access. For a Run without that policy, including older Runs, or for hosts outside the policy, prepare a new Scope revision and a new Run to test the expanded coverage. The earlier Run and its results remain available.

3. Prepare One or Two Accounts for Greybox

Choose One account to examine the application through one signed-in identity. Choose Two accounts when the assessment needs comparisons between users, owners, or roles. Two users with the same privileges can still be useful for checking whether one user can access another user's resources.

For Greybox Environment, upload each account's Cookie Editor JSON export and configure an authentication check URL with the requested proof of signed-in access. For two accounts, provide distinct account identifiers so Hunt Web can distinguish their sessions. Use Test Authentication to check the configured access. A new Environment setup can also use Automatic · detect account access, described in Application hosts and account access.

For Greybox Browser, open the account browser from Target setup, complete login and any required MFA, then check access on an allowed application page. Two-account setup uses separate browser sessions; complete both access checks. The scanner can then use those sessions to navigate and inspect application behavior.

4. Prepare a Run and Select Its Profile

Choose Prepare Run from the Target. On New Run, review the selected Target and Scope, choose a scan profile, and set the time limit.

The time controls offer the profile default, a custom number of minutes, or No time limit. At the time limit, Hunt Web stops the current scan work and preserves progress for a later resume. Finishing and saving results may take additional time.

Enlarge

Select Start scan, then open the Run to follow its progress.

5. Monitor, Pause, and Resume

Use the Run's Overview and Activity to inspect its status and work. Check recorded activity and request results alongside the status indicator to understand what the scanner has actually done.

Select Pause scan to suspend the assessment. Wait for the Run to save its work and display Paused, then use Resume scan to continue with the same Scope, accounts, and saved results. Where available, Change to Standard or Change to Deep increases the profile before resuming. Changing profile applies that profile's default time limit.

1. 1Pause scanSuspends the assessment.
2. 2Wait for PausedThe Run saves its work first.
3. 3Resume scanContinues with the same Scope, accounts, and saved results.
4. 4Finalize RunCloses the Run to further scanning. Findings and reports remain.

Use Finalize Run to close the Run for further scanning. Its findings and reports remain available. Keep the Run open when further investigation is planned.

If a control request loses its connection, use Check previous request when offered to recover the saved outcome. In Hermes, refresh or reconnect and use the available retry control before sending another copy of an instruction.

6. Continue the Investigation with Hermes Chat

Choose Open in Hermes Chat from a Run, or use Continue a scan in Hermes Chat to select previous work. The conversation stays associated with that Run's Scope and accounts across all three testing modes.

Hermes can read earlier results and request history through an instruction such as:

Read this Run's previous scan results and request history. Summarize what has been tested and which checks remain unfinished.

For a two-account Greybox Run, give it a concrete follow-up task:

Continue checking access control on the endpoints already discovered in this Run. Use the configured accounts to compare access and investigate checks that remain inconclusive.

A context question can be answered from saved work. A request to continue testing can activate further scanner work. For Greybox Browser, a current login check can also be requested without continuing the scan. Chat Templates provide additional starting points for investigation instructions.

Enlarge

7. Review Findings and Export the Report

Potential issues become Findings after verification. Review their evidence and use the Target, Run, and severity filters to focus the review. An inconclusive check needs further investigation; it establishes neither a confirmed vulnerability nor the absence of one.

Within the Run, Results provides saved assessment results, while Report presents a report snapshot and PDF download. During an active scan, that snapshot may lag behind newly verified findings. Review the saved report version when preparing a copy to share.

The PDF contains the assessment summary, Scope and limits, verified findings, report reference, and AI-assisted assessment and human review guidance. Automated verification supports the investigation; human review is still needed when interpreting the evidence and deciding what to fix.

To begin, prepare one Target and Scope, check account access if using Greybox, and start the profile that fits the assessment objectives. Return to the saved Run to review results, resume work, or direct the next investigation through Hermes.

For the product overview, read What Is Hunt Web?.