Home / Help centre / Authentication & logins
Authentication & logins
How do I set up two user roles so the scanner can test access between accounts?
In the scan profile's Authentication section, click + Add role twice, name the roles, set a Privilege level on each, and give each its own test account and method. Click Save, then scan. The docs recommend a second user for IDOR and privilege testing.
Steps
- Inside the profile's Authentication section, click + Add role and name the first role, for example
user-a. - Click + Add role again for the second role,
user-b. Each role gets its own card. - Choose a Privilege level on each card: Unauthenticated, User, Elevated or Admin.
- Give each role its own test account and method, such as form login or a header key.
- Press Save, then start the scan from the profile.
Good to know
The in-app documentation says to add a second user for IDOR and privilege testing. With two roles in place, the scan can check what one signed-in account can reach that it should not, such as one account reading another's data. See IDOR for the idea.
| Role | Suggested setup |
|---|---|
| First | A normal user with its own test account |
| Second | A different normal user, or a higher level such as Admin |
Use separate test accounts with their own data, so the result is easy to read. The sitemap shows a role chip on each endpoint, which tells you which role reached it.
Start with the smallest setup that answers your question. Two accounts with the same privilege level can show whether one reaches the other's data, and a User plus an Admin can show whether the lower account reaches admin functions. Add a third only when you need it.
Give the roles names that make sense when you read a report later. user-a and user-b beat role1 and role2. Only test apps you have permission to test.
Related questions
- How do I add a login role to a scan profile?
- How do I set a role's privilege level?
- What is an authentication role?
- What privilege levels can a role have?
- What do the note and role chip on each sitemap endpoint mean?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.