Concepts
Domains & Verification
How to add a Blackbox target and prove you actually own it.
A domain has to be verified before it can be used as a Blackbox target or attached to a Whitebox scope as a combined target — verification is what gates whether a run against it is allowed to start at all.
Adding a domain
From Domains, add the domain you want to test. It starts in an unverified state — nothing can be run against it yet.
Verifying ownership
Add a TXT record with the value Vulnix gives you to your domain's DNS zone, then confirm. Works regardless of who hosts your DNS — the most portable option if you're not on Cloudflare or Vercel.
After verification
- The domain becomes selectable as a Blackbox target in the pentest wizard.
- You can optionally save test-user credentials against it for authenticated testing — see Scoping a Run.
- It becomes eligible to attach to a Whitebox scope as a combined target (the $225 price point — see Blackbox vs. Whitebox).
