Authenticated Scanning

Test the app fully authenticated.

Everything worth attacking requires a login, and that is where most DAST quietly fails. NightVision verifies a real session before a single test runs.

A verified authenticated session flows through real browser states into expanded security test coverage
The Coverage Gap

An unauthenticated scan tests the lobby, not the building

Account settings, payment flows, admin panels: most of what is worth attacking requires a login. An unauthenticated scan exercises only the public shell around it.

The failure mode: a clean result on the wrong surface

When a session is never established or expires early, everything that requires a login falls out of the test, and the dashboard stays green.

NightVision: authentication as a verified first step

A login-check gate asserts a real session before any test runs. If it fails, the scan fails, loudly.

How It Works

Authenticated DAST scanning in four steps

1

Record

Sign in once in a real browser. NightVision captures the flow as a Playwright script: clicks, fields, redirects, and all.

2

Vault

Credentials are extracted from the recording into a secrets vault automatically; the stored script keeps only placeholders, never plaintext.

3

Verify

Before any test runs, the login-check gate replays the flow and asserts the session actually reached an authenticated state.

4

Scan signed in

The crawler tests the application as a real logged-in user, generating TOTP codes for MFA at scan time when the flow requires them.

The result: the fully authenticated surface is tested alongside your public pages, with HTTP evidence retained on request-level findings and Code Traceback on supported source-discovered API scans.

Capabilities

Built for real logins, not demo logins

Playwright Recorded Logins

Record once, replay every scan

Whatever a human does to sign in, redirects and multi-step forms included, the scanner replays. Credentials are auto-extracted to a vault, so secrets never sit in the script and rotating a password does not mean re-recording.

TOTP / MFA at Scan Time

MFA stays on, scanning continues

Time-based one-time passcodes are generated from a stored seed the moment the flow needs them. No bypass accounts, no MFA disabled on staging.

The Login-Check Gate

Fail the pipeline, not the coverage

Preflight assertions confirm the login produced an authenticated session, for example that a signed-in-only element is present. If they fail, the scan fails and the CI/CD pipeline goes red.

Session Reuse and Refresh

One IdP login, many targets

Reuse recorded flows across targets behind the same identity provider; expired sessions re-authenticate and testing continues. See how the crawler works →

FAQ

Authenticated scanning questions, answered.

What is authenticated DAST scanning?

Dynamic application security testing performed as a signed-in user, so the scanner can reach dashboards, account settings, admin panels, and multi-step workflows. NightVision authenticates with a Playwright-recorded login script, verifies the session before testing, and keeps the scan signed in.

How does NightVision handle MFA and TOTP during a scan?

NightVision generates time-based one-time passcodes (TOTP) at scan time from a stored seed, so applications protected by authenticator-app MFA can be scanned without disabling MFA or maintaining a bypass account.

What happens if the login fails before a scan?

A login-check preflight runs validation assertions to confirm the session actually reached an authenticated state. If it fails, the scan fails and your pipeline fails with it, instead of the scan silently running logged out and reporting a misleading clean result.

Can one login recording be reused across multiple applications?

Yes. A credential and its recorded flow can be assigned to many targets behind the same identity provider, so ten apps sharing one SSO login do not need ten recordings.

Does authenticated scanning work for APIs?

Yes. NightVision supports header-based auth (bearer and API tokens) and cookie-based auth, so REST APIs behind token or session authentication get the same authenticated coverage as browser flows.

Scan the surface your last scan never reached.

Record a login, and test the application your users actually see. Part of NightVision web app DAST, built to run in your CI/CD pipeline.