Run a session

A session is one conversation with Nebula about one piece of work, such as “assess the staging API”. Nebula plans, runs tools, records evidence and reports findings as it goes.

Start a session

1. Open the project and start a new session.
2. Describe the goal, the target and the boundaries. Be explicit: “Test staging.example.com and its API only. Do not test production. No denial-of-service.”
3. Review the engagement scope Nebula proposes and confirm it. Nebula acts only on confirmed scope and asks before anything outside it.
4. Follow progress in the timeline: plans, tool runs, evidence and findings appear as they happen.

Security

Only test systems you own or are explicitly authorized to test. The engagement scope is the boundary Nebula works within, and changes to it are recorded.

Work alongside Nebula

• Send follow-up instructions at any time to steer the work.
• Long-running work continues in the background; you can leave and come back.
• Findings raised during the session appear in Findings, linked to their evidence.
• The out-of-band collaborator gives Nebula a callback channel for blind vulnerabilities such as blind SSRF.

Replay requests with Repeater

Repeater is an HTTP request workspace inside the session. Build or edit a request, send it, and read the raw status, headers, body and timing. Request options include following redirects and ignoring TLS errors. Intruder mode sends a request repeatedly with different payloads so you can compare status codes, response size and timing across the results.

Open Repeater from the session’s Engagement drawer, or directly at /session/<id>/repeater. Use it to confirm a finding by hand or to check a fix. Drafts and history survive a page reload in that browser tab; response bodies are kept in memory only.

Test mobile apps

Mobile testing runs inside a session (/session/<id>/mobile). Connect your own iOS device, or use a server-side Android sandbox, then let Nebula drive the app while it tests the app and its API. The CLI command breachline mobile sets up the device side.

Projects and sessions

Projects and sessions lists every session in the project with its status. Archived sessions are kept under Settings, Archived sessions.