Run your first assessment¶
A mission is one scoped assessment. This guide walks through launching one, following it while it runs, and reading what it finds.
Test only what you're authorised to test
Revelion performs real attacks against the targets you give it. Testing systems you don't own, or haven't been given permission to test, can be unlawful. Before a mission can start, you confirm that you're authorised.
Before you begin, connect an execution host and check that it shows as Online on the Daemons page.
Open the wizard¶
Select Launch Mission in the sidebar. The mission wizard takes you through a series of steps, each with its own defaults. For a first mission, the steps to look at are Target, Depth, Guardrails and Launch.
Target¶
Choose what to test:
- Web Application: a URL, for example
https://app.example.invalid - IP Address: for example
192.0.2.10
Then choose the type of assessment: Web Application for web apps and their APIs, or Network Pentest for hosts and the services they run.
Depth¶
The mode sets how far the agents go:
| Mode | Use it for |
|---|---|
| Quick | A fast check of a surface you already know |
| Normal | Most assessments. This is the default. |
| Deep | Thorough testing, when coverage matters more than time |
Deeper modes give the agents more room to work, so they take longer and can use more credits. Deep isn't included in every plan; the wizard tells you if yours doesn't include it.
Guardrails¶
List anything the agents must not test, one item per line, and choose whether actions need your approval. Requiring approval is worth considering on production systems, where an unexpected test could trigger alerts or affect users.
Launch¶
The last step summarises the mission and asks you to confirm that you're authorised to test the target.
Confirming your authorisation is required
You can't launch without it: the wizard stops with You must confirm authorization to proceed. Your confirmation is recorded with the mission.
If no execution host is connected, the wizard stops with No daemon connected. Install and start the Revelion daemon first. See troubleshooting.
Watch it run¶
The mission page updates while the mission runs. Its tabs show the mission from different angles:
| Tab | What you'll find |
|---|---|
| Activity | An overview of what the mission is doing |
| Intel Feed | What the agents report as they work |
| Terminal | Output from the tools, as it's produced |
| Findings | Vulnerabilities as they're recorded |
| Agent Tree | The agents working on the mission, and their status |
You don't need to keep the page open: the mission carries on, and its history is there when you come back. Keep the daemon running on your execution host until the mission finishes, because that's where its tools run.
Read the results¶
Each finding has a title and a severity. Depending on what the agents established, it can also include a CVSS score, CWE or CVE references, a proof of concept with its evidence, the affected endpoints, and remediation guidance.
Findings are also collected under Assets & Findings, where you can follow them across missions against the same asset. After fixing something, run a new mission against the same target and review the finding there.