Quickstart

​

Prerequisites

• A connected repository or an uploaded archive to assess
• The branch or commit you want Hacktron to use
• For dynamic testing, the domains or URLs of the applications to test and instructions for accessing each one, even if no sign-in is required
• Enough Whitebox Scan credits, or an organization owner who can add a payment method and buy credits

​

Create the pentest

1

Open Whitebox Scans

In the Hacktron dashboard, open the Whitebox Scans area and create a new scan.

2

Choose the primary repository

Select the main repository and branch for the assessment. Add related repositories if the application spans multiple services.For an on-premises GHES repository, connect and enable the repository before opening the wizard, then select it from Connected sources. To scan an archive instead, open Upload archive and add the source file.

3

Configure dynamic testing

Dynamic testing is optional. Choose Skip dynamic testing to continue with a source-code assessment without testing a deployed application.

In Define target, add each application you want Hacktron to test:

1. Enter its Domain, such as https://staging.example.com.
2. Fill in Auth instructions with login steps, dedicated test credentials, and how to confirm successful access. For a public site, state that no login is required and describe the page that should load.
3. Click Verify access. Hacktron follows your instructions in a browser; a live access preview lets you watch the attempt. Wait for the target to show Verified before continuing.

Use Add target for another application. Each target needs its own domain and instructions. With multiple targets, Verify all checks the targets that still need verification.If verification fails, check the domain, credentials, and instructions, then retry. Verification lasts for one hour. If you edit a verified target’s domain or instructions, verify it again or choose Revert to last success.

4

Add context and review scope

In Context documents, add architecture notes, threat models, API specs, or other material that helps explain the application. Then review the repositories, targets, and access instructions in Review details.

5

Estimate the cost

Run the cost estimate and wait for it to complete. Hacktron estimates the credit cost from the selected repositories and scope before the scan can start.

6

Review and start

Review the scope and estimated credit cost. When the run starts, Hacktron deducts the estimated credits from the organization’s Whitebox Scan credit balance. If the balance is too low, an owner can buy credits during checkout.

7

Track progress

Watch the run status in the dashboard. When the scan completes, review findings and export the output needed for remediation or audit evidence.

​

Writing auth instructions

• The starting URL and the steps to reach the application
• Test-account credentials and the role or permissions of each account
• How to obtain an MFA or OTP code, if required, and any SSO, CAPTCHA, or network access requirements
• What successful access looks like, such as a dashboard or account page
• Areas to focus on and actions to avoid, such as payments or deleting data

1. Open https://staging.example.com/login.
2. Sign in with qa-user@example.com and [dedicated test password].
3. Confirm the dashboard loads and the account has the Member role.
4. Focus on project access and file uploads.
5. Do not make payments, delete projects, or modify other users' data.

1. Open https://help.example.com.
2. No login is required.
3. Confirm the help center and search page load.

​

Scope checklist

​

API option

​

Next steps