Secrets

The Secrets feature allows you to store your secret value encrypted in the Invicti scanner and used as a global variable that can be dynamically referred to during the scan. Using the secret improves the security of your sensitive data.

This document explains how to create and use a secret.

Create a secret

Create a secret in Invicti Enterprise

1. Select Scans > New Scan from the left-side menu.
2. In the Scan Settings section click Secrets.
3. Click + New Secret to add a new secret.

4. Type a secret’s Name and Value in the text fields.

5. You can now refer to the Secret in a Pre-Request Script, Post-Request Script, or Header Authentication.
6. Click Save Profile to save the settings of the scan for future use or Launch to run the scan.

Create a secret in Invicti Standard

1. Click New in the Home tab.
2. In the Scan Settings section click Secrets.
3. Type a secret’s Name and Value in the text fields.

4. You can now refer to the Secret in a Pre-Request Script, Post-Request Script, or Header Authentication.
5. Click Start Scan to run a scan.

How to use a secret

Refer to the Secret using Pre-Request or Post-Request Script or Header Authentication.

Use a secret with a script

To dynamically refer to the secret, use the following example code in your script:

Use a secret with header authentication

To refer to the secret in Header authentication use the name of your secret in curly braces as a Value, for example: {MySecret}.

The encrypted secret will be visible in the HTTP Request/Response > Raw tab in the Scan summary.