Turn On the Web Console

Turn On the Web Console

If you already run the XHack Agent on your machine, this is the fastest way to get the browser interface. No terminal, no config file, about thirty seconds.

Switch it on

1. Open the XHack Agent.
2. Go to Settings, then Web Access.
3. Select Start.
4. Create a user. Pick a username and a strong password. The password is shown once, so save it to your password manager now.
5. Select Open in browser and sign in with what you just created.

That is it. The browser is now driving the same Agent, with the same sessions, the same findings and the same history you see in the desktop window.

Have it there every time

In the same panel, turn on Start the web console automatically when XHack launches. From then on the console is up whenever the Agent is, so opening a browser tab is all it takes.

Stopping it

Stop Web shuts the console down. It also stops a console you started yourself from a terminal on the same machine, so there is one honest off switch rather than a stray server you forgot about.

Stopping the console does not close the desktop app, and it does not touch your sessions or findings.

Reaching it from another device on your network

By default the console listens on your own machine only, at http://127.0.0.1:8765. That is deliberate: nothing is reachable from anywhere else until you say so.

To open it to your network, use the bind mode control in Web Access. It walks you through a short confirmation first, because it changes who can reach an agent that runs commands on your computer. Only do it on a network you trust, and prefer a tunnel over an open port.

If you want the console reachable from outside your home or office, run it on a server instead. See Run the Web Console on a Server.

The rest of the Web Access panel

Everything you need to look after access lives on this one screen:

• Rotate the credential whenever you want a fresh username and password.
• Active sessions, so you can see what is currently signed in.
• Sign out everywhere, which invalidates every session instantly on every device. Reach for this if a phone goes missing.
• Audit log, a record of login attempts, including the failed ones.

Related

• The Web Console, what it is and what is in it.
• Install it on your phone or desktop.
• Run it on a server.