Nebula AI Platform Automates Pen Testing to Find Vulnerabilities

Key Takeaways

• BerylliumSec has released Nebula, an open-source security tool integrating large language models (LLMs) directly into the penetration tester’s terminal.
• Nebula automates vulnerability assessments, generates exploit scripts, and streamlines documentation, supporting both local and cloud-based AI models.
• The tool is designed to work alongside existing command-line interface (CLI) security utilities like Nmap and Metasploit, enhancing current workflows.
• A complementary service, the Deep Application Profiler (DAP), uses neural networks for zero-day malware analysis, moving beyond traditional signature detection.

Revolutionizing Pen Testing with AI-Powered Automation

BerylliumSec has unveiled Nebula, an innovative open-source security platform designed to embed advanced artificial intelligence capabilities directly within the penetration tester’s command-line interface. This new tool empowers ethical hackers and cybersecurity professionals to automate critical tasks such as vulnerability assessments, exploit script generation, and engagement documentation, all without disrupting their workflow.

Nebula offers extensive flexibility by supporting multiple AI backends, allowing users to select models based on their specific infrastructure and privacy requirements. Compatible models include those accessible via OpenAI’s API, Meta’s Llama-3.1-8B-Instruct, Mistral AI’s Mistral-7B-Instruct-v0.2, and DeepSeek-R1-Distill-Llama-8B. For local inference, Nebula leverages Ollama, which supports both CPU and GPU execution, while cloud-based models are accessed through API keys.

A key advantage of Nebula is its seamless integration with any CLI-invokable security utility. This means testers can enhance their existing toolchains, such as Nmap, Metasploit, or custom scripts, rather than being forced to adopt entirely new workflows. Users can fluidly switch between manual terminal operations and AI-assisted queries by prefixing commands with “!” or utilizing a dedicated AI/Terminal mode button.

Core Features of the Nebula Platform

• AI-driven internet search agents that provide real-time cybersecurity context for responses.
• Automated note-taking functionality, categorizing findings during live engagements.
• Real-time exploitation suggestions derived from terminal tool output.
• Import capabilities for external tool data, enabling AI-assisted analysis.
• Built-in screenshot capture and annotation features for comprehensive documentation.
• A dynamic status feed panel that updates every five minutes to display recent testing activity.

Installation and System Requirements

To run Nebula with CPU-based inference via Ollama, a minimum of 16GB RAM and Python versions 3.10 through 3.13.9 are required. Installation is straightforward using pip:

python -m pip install nebula-ai --upgrade

For local models, users must first install Ollama and then pull their desired model (e.g., ollama pull mistral), ensuring the exact model name is referenced in Nebula’s engagement settings. Accessing OpenAI models necessitates setting the API key as an environment variable (OPENAI_API_KEY) before launching the application. A Docker deployment option is also available, featuring X11 forwarding for GUI support and volume mounts for logs and engagement folders.

Complementary Malware Analysis with Deep Application Profiler (DAP)

In conjunction with Nebula, BerylliumSec has also unveiled the Deep Application Profiler (DAP), a sophisticated malware analysis service. Diverging from conventional signature-based detection, DAP employs neural networks to scrutinize an executable’s internal structure and behavioral intent. This innovative approach enables the detection of zero-day malware that typically evades traditional signature-based tools. DAP is offered as both a web service and an API, providing detailed analyses for cybersecurity analysts.

Future Outlook

BerylliumSec has communicated its intention to develop custom AI models specifically tailored for penetration testing tasks, moving beyond the current reliance on general-purpose LLMs adapted for security applications. This strategic direction suggests that future iterations of Nebula will likely deliver more specialized and domain-tuned outputs, enhancing its capabilities for vulnerability discovery and exploitation guidance. Nebula is readily downloaded from GitHub.

The introduction of Nebula underscores a growing trend of integrating AI into offensive security tooling, where LLMs assist with reconnaissance, note-taking, and exploit ideation directly within existing tester workflows. By supporting both local and cloud-based models, Nebula adeptly addresses diverse operational security needs, from air-gapped local inference to convenient API access. Users troubleshooting runtime errors can consult logs stored at ~/.local/share/nebula/logs for self-diagnosis.

What You Should Do

• Explore Nebula: Cybersecurity professionals and penetration testers should evaluate Nebula to understand how AI automation can enhance their current workflows and improve efficiency in vulnerability assessments.
• Review System Requirements: Ensure your systems meet the minimum requirements (16GB RAM, Python 3.10-3.13.9) before attempting installation.
• Consider Operational Security: Decide whether local inference via Ollama or cloud-based API access best suits your operational security needs and privacy policies.
• Investigate DAP: For advanced malware analysis, consider integrating BerylliumSec’s Deep Application Profiler (DAP) to augment zero-day detection capabilities beyond traditional signature-based methods.
• Stay Updated: Monitor BerylliumSec’s future developments, particularly their plans for purpose-built LLMs, which could offer more specialized security insights.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.