Skip to content

WebApp Authentication

This reference page offers details about the authentication methods that WebApp pentests support, and on how NodeZero maintains session state during testing.

Supported Authentication Methods

The WebApp pentest authenticates to applications using the following methods:

  • Username or email plus password.
  • Username or email plus password with TOTP-based MFA (Time-based One-Time Passcode, Multi-Factor Authentication), including backup codes.
  • Bearer tokens.
  • Session cookies.
  • API-key headers with a configurable header name.

We support these methods for direct application login forms, and for login flows brokered by SSO providers including Entra, Okta, Auth0, PingID, and Keycloak. We also support custom login flows that use the same underlying methods.

The test validates credentials before using them. When a credential cannot be used, NodeZero reports credential states – such as Created, Pending, or Error – with diagnostic reasons.

NodeZero provides best-effort support for common CAPTCHA mechanisms, helping the test proceed through many CAPTCHA-protected workflows. Coverage depends on the CAPTCHA type, configuration, and how the application responds to automated activity, so some challenges might still prevent portions of the application from being tested. For the most complete coverage, allowlist NodeZero traffic or temporarily adjust CAPTCHA protections for the test. CAPTCHA support is not guaranteed to solve or bypass every challenge.

SSO Support

SSO is supported when the provider brokers a username/password or TOTP-based MFA flow. Supported providers include Entra, Okta, Auth0, PingID, and Keycloak. SSO configurations that require unsupported MFA methods are not supported.

MFA Handling

TOTP-based MFA is supported, including backup codes. The following are not currently supported:

  • Push-notification MFA (approve-on-device prompts).
  • SMS text-code or phone-call MFA.
  • Email OTP (One-Time Password) and magic-link MFA.
  • Passkeys and FIDO2 (Fast Identity Online 2) hardware security keys on third-party accounts.
  • IdP-initiated SAML (Security Assertion Markup Language) flows.

Custom Authentication Flows

NodeZero detects many common authentication patterns, including form login, multi-step login, and session recovery behavior. Highly custom or non-standard authentication flows may not be handled successfully and may require additional product support.

NodeZero maintains the authenticated state required to continue testing as the application is explored. If the session expires, NodeZero attempts to authenticate again and resume testing.