Configuring Form Authentication with OTP

Acunetix 360 offers various options for authenticating scans, with the most common method being form authentication. Some authentication forms may necessitate the use of a One-Time Password (OTP), whereby a unique code is used for each authentication attempt with the target web application.

Acunetix 360 supports form authentication using OTP. By providing this type of two-factor authentication via a secret key, the OTP can be filled in automatically so that Acunetix 360 can access and scan all sections of the target website.

Two OTP types are supported:

  • Time-based (TOTP): A temporary passcode generated by an algorithm that uses the current time of the day as one of its authentication factors.
  • HMAC-based (HOTP): A password algorithm that uses hash-based message authentication codes (HMAC). 

This document explains how to configure form authentication with an OTP secret key when setting up a scan in Acunetix 360.

How to retrieve and configure an OTP secret key for authenticated scans

There are three main steps to this configuration:

  1. Configure the scan profile in Acunetix 360
  2. Retrieve the OTP settings information
  3. Configure the OTP settings in Acunetix 360

Step 1: Configure the scan profile

  1. In Acunetix 360, select Scans > Scan Profiles from the left-side menu.
  2. Choose the scan profile you want to configure and click Edit. Alternatively, click + New Profile to create a new scan profile.
  3. Confirm the Target URL.
  4. In the Scan Settings options, select Form (under Authentication).
  5. Click the checkbox to enable Form Authentication.
  6. Enter the Login Form URL. This is the URL (including the protocol HTTP or HTTPS) of the login form that the scanner will access.
  7. In the Personas section, click + New Persona.
  8. Enter the Username and Password login details that the scanner will use.
  9. Click the ellipsis (…) in the OTP column to open the OTP configuration.

You have now completed the first step. After retrieving the OTP settings in Step 2, you will return to the OTP configuration window in Acunetix 360 to complete the configuration.

NOTE: Every persona has its own OTP settings, so if you have multiple personas you will need to configure OTP for each one if this is required by the web application.

Step 2: Retrieve the OTP settings

  1. In the web application that you will scan, choose to configure Two-factor Authentication (2FA) or Multi-factor Authentication (MFA) for the user account you configured as the persona in Step 1.
  2. The web application will show a QR code that needs to be scanned.
  3. You will need to use a QR code scanner that shows the data behind the QR code. In our example, we have used Microsoft Lens on Android to scan the QR code.
  4. From Microsoft Lens, change to Actions, and select the QR CODE options.
  5. Scan the QR code that is displayed in the web application.

  1. Microsoft Lens will show the data behind the QR code. The data will be in the form:
    otpauth://totp/<user>?secret=<secret>&issuer=<issuer>
    For example: otpauth://totp/user%40domain.com?secret=DYBF5RPX2GT42G4RBLBWIKAQFIJL7P33&issuer=Invicti+Enterprise
  2. The above example shows that the OTP Type is TOTP, and the secret is DYBF5RPX2GT42G4RBLBWIKAQFIJL7P33.
  3. Copy the QR data so that you can add it to Acunetix 360 in Step 3 below.

Step 3: Configure OTP settings in Acunetix 360

  1. Return to the Acunetix 360 OTP configuration window and set the OTP Type and Secret Key according to the information you obtained in Step 2 above.
  2. The other details can be left with the default settings.
  • Digit: This field allows you to set the number of digits that will be used for the length of the OTP.
  • Period: This field allows you to set the time (in seconds) after which an OTP is regenerated.
  • Algorithm: This is the encryption option.
  1. Click Generate OTP to generate a code. Then, confirm that the OTP settings are working correctly by entering the code in the web application.

  1. The web application may require you to provide two consecutive codes, in which case, click Generate OTP again and provide the new code to the web application.
  2. Once ready, click OK to save the scan profile with the OTP settings.

The scan profile is now configured for form authentication with OTP and can be used to scan your target.


« Back to the Acunetix Support Page