Hermes Chat and templates
Continue an existing Run with Hermes Chat, and use Chat Templates for focused instructions.
Hermes Chat connects follow-up instructions to an existing Hunt Web Run. It can read earlier scan results and request history, check current account access, and continue investigating application features. The same workflow supports Blackbox, Greybox Environment, and Greybox Browser. Chat Templates provides ready-to-copy instructions for specific investigation goals, while the message composer also accepts instructions written directly. How the Hermes conversation agent and the scan agents work together is explained in Hermes Chat agents.
The practical distinction is the requested action: read saved evidence, check access now, or continue testing. Each produces a different outcome, even when all three appear in the same conversation.
Read saved evidence
Reads earlier results and request history without starting or resuming a scan.
Check access now
Performs a fresh login check for each account, without resuming the scan.
Continue testing
Activates further scanner work using the Run's saved Scope and accounts.
1. Open a Conversation for an Existing Run
Start with a Run created through a Quick, Standard, or Deep profile. Open its detail page and select Open in Hermes Chat, or open Hermes Chat → Continue a scan and select the corresponding Run. An existing conversation can also be opened from Recent conversations.
- 1Start with a RunCreated through a Quick, Standard, or Deep profile.
- 2Open in Hermes ChatFrom the Run, or Hermes Chat, then Continue a scan.
- 3Check the saved contextTarget, profile, testing mode, Run status, and Saved scan context.
- 4Send an instructionOpening the conversation alone does not start scanning.
Check the Target name, profile, testing mode, Run status, and Saved scan context before sending an instruction. Open Run, Results, and Report provide direct access to that assessment's stored work.
Opening the conversation does not start scanning. If the conversation is disconnected, use Connect conversation or Reconnect conversation as shown. A configured conversation model is required; its initial selection comes from Hermes Settings. Changing this model changes the conversation model—the scan researcher retains its own model.
The conversation uses that Run's saved Scope and accounts. Editing a Target later does not expand the Scope of the existing Run. The Dashboard picker supports profile-scan continuation; a separate CLI chat session should not be assumed to appear as an equivalent Dashboard conversation automatically.
2. Read Previous Results and Request History
Begin with a context question when returning to an assessment. This helps identify completed work, candidates that still need evidence, and features worth examining next.
Read the assessment state:
Read the previous scan results for this Run without starting or resuming scanning. Summarize verified findings, tests with no confirmed impact, inconclusive candidates, and unfinished work. Include the latest saved status and update time. Identify the most useful next investigation based on the available evidence.
Inspect the recorded requests:
Read this Run's request history without replaying requests or resuming scanning. Group the recorded requests by application feature or workflow. Summarize methods, routes, parameter names, response statuses, account roles, and evidence references. Explain which records contain completed security tests and which only show observed traffic. State any gaps in the available history and omit credential values.
These instructions work across all three modes. A recorded request shows that traffic was observed or performed; it does not by itself establish that the related feature received a complete security assessment. When only part of the history is available, the summary should identify that limit rather than claim complete coverage.
3. Check Current Account Access Without Resuming a Scan
An earlier successful login check is historical evidence. A Browser window remaining open, or a session remaining saved, does not establish that the account still has access now. Request a fresh check when the current login state matters.
Greybox Browser:
Read the previous profile scan results and request history for this Run. Check whether the saved account Browser is still logged in now, without resuming scanning. Perform a fresh access check and report each account's result and check time. Distinguish an open Browser, a saved session, and confirmed access. If the check cannot complete, explain the reason and next step.
Greybox Environment:
Check whether the saved account sessions for this Greybox Environment Run still have access now, without resuming scanning. Perform a fresh access check for each configured account. Report the result, check time, and reason for any unconfirmed access. Compare with the previous check when available.
Unlike reading history, these checks can contact the application. They test account access without requesting a scan continuation. For two-account Runs, review the result for each account individually.
If access cannot be confirmed, read the reported reason. An unavailable check—for example, while the Browser is in use—is different from confirmed login rejection. Review the account setup or repeat the check when the required Browser/session is available. Saved results remain useful even when a new access check cannot complete.
Blackbox Runs do not use supplied authenticated accounts. Interactive Greybox Browser requires a Desktop installation with a graphical session; Chromium headless on a Server does not provide that interactive mode.
4. Send a Focused Instruction to Continue Testing
A useful continuation prompt names the feature or weakness to investigate, the comparisons required, and the evidence needed to establish impact. Previous findings and request history provide the starting point.
The examples below are ready to copy for a matching Run. Feature names can be added for a narrower investigation.
Blackbox: Explore Untested Application Features
Continue scanning this Blackbox Run for new vulnerabilities. Read the previous results and request history, then prioritize reachable features and parameters that have not received meaningful tests. Establish normal behavior, test relevant input and workflow variations, and compare the outcomes. Reproduce candidates with observable impact, collect fresh evidence, and submit them for verification. Summarize new findings and unresolved leads without duplicating existing findings.
Greybox Environment: Test Boundaries with One Account
Continue this Greybox Environment Run using the saved account. Read earlier requests and results, then test unexamined function, field, and workflow permissions. Compare normal authenticated behavior with unauthenticated access or invalid object/state controls where relevant. Confirm any unexpected data access or completed action from the response and resulting state. Collect fresh evidence and submit supported candidates for verification. Identify comparisons that require a second account.
Greybox with Two Accounts: Investigate Cross-Account Access
Continue this two-account Greybox Run for IDOR and related authorization flaws. Read previous results and identify objects owned by each saved account. Establish an own-account baseline for both accounts, then compare equivalent requests against the other account's objects. Use each account's own session or Browser. Confirm unauthorized data access or state changes, collect fresh evidence, and submit supported candidates for verification. Report tested boundaries, new findings, and inconclusive cases.
This comparison requires two accounts already configured in the Run. With one account, object ownership and cross-account impact may remain unproven; other permission and workflow tests can still proceed.
Greybox Browser: Explore Signed-In Features and Their Requests
Continue this Greybox Browser Run through the saved account Browser. Read previous results and traffic, then navigate menus, open untested features, and exercise relevant forms and workflows. Correlate UI actions with their requests and responses. Investigate access-control or business-logic weaknesses using comparable normal and altered actions. Reproduce observable impact, collect fresh evidence, and submit supported candidates for verification. Summarize explored features, new findings, and remaining gaps.
Watch the Run's execution state and saved outcomes after sending an active instruction. An eligible paused Run can resume its saved session; an active scan can queue additional research. Asking for deeper investigation directs the work but does not automatically change the saved scan profile.
5. Use Chat Templates for Specific Investigation Goals
Chat Templates organizes ready-to-copy messages by purpose. The main categories help select the intended action:
Continue
Find additional vulnerabilities using previous results and request history.
Audit
Revisit unresolved candidates or investigate gaps in test coverage. These choices request further testing.
Focus
Investigate a particular area, such as authorization, injection, business logic, DOM-XSS, or application attack surface.
Results
Read saved results, report status, unfinished work, or request history; separate choices perform fresh account-access checks without resuming scanning.
To use a template:
- 1Open Chat TemplatesSelect a category or search for the focus.
- 2Choose a language and templateEnglish or Indonesia, then a group and a choice.
- 3Copy the templateAdjust the focus if needed, then Copy complete template.
- 4Send it in Hermes ChatPaste into the intended Run and select Send message.
- Open Chat Templates and select a category or search for the intended focus.
- Choose English or Indonesia, then select a template group and a choice within it.
- Read the message and adjust the testing focus if needed. Select Copy complete template.
- Return to the intended Run in Hermes Chat, paste the message, and select Send message.
Templates do not require manually entering a Run ID, file path, or CLI command. The selected conversation supplies the assessment context. Editor changes are temporary; refreshing the template page restores the source text and default English selection. Copy any edited message before leaving it to a later session.
Templates are optional. A direct message such as “Continue testing the document-sharing workflow for cross-account access using both saved accounts” can communicate a specific next task without a template.
6. Distinguish Delivery, Execution, and Verified Results
A chat reply and a completed scanner operation are different events. Use the displayed execution status together with Open Run, Results, and Report to inspect what actually happened.
The conversation interface distinguishes sending a message, waiting for Hermes to reply, and a delayed connection, with an animated indicator and the elapsed waiting time. The indicator describes waiting; it is not a measure of scanning completion. For ordinary questions about a Run, Hermes can begin with a compact summary of its saved state. See What's new.
| Status shown in Hermes | Meaning |
|---|---|
| Message received by Hermes | The message was received. This alone does not confirm that scanning started. |
| Starting scan continuation / Instruction queued for the scanner | Activation or queued work is pending. |
| Scanner is working on the instruction | The scanner has claimed the instruction for execution. |
| Verifying evidence and saving the report | Evidence verification and result saving are in progress. |
| Instruction completed with a saved outcome | A saved outcome exists; inspect its contents for findings, inconclusive tests, or other results. |
| Scan continuation could not start / Scan needs account access | Review the reported failure or account-access reason before expecting further scan activity. |
A completed instruction is not a finding
A completed instruction need not produce a new finding. Candidates enter the verified findings workflow only when supporting evidence meets the verification requirements. An inconclusive result means the available evidence did not settle the candidate; it does not establish that the application is free of vulnerabilities.
Report and its PDF reflect a saved snapshot, which can lag behind a Run that is still progressing. Check the report state before downloading an updated assessment. Automated verification also remains distinct from a human review of the findings.
7. Recover a Disconnected Conversation or Unconfirmed Message
A connection interruption does not establish whether an instruction reached the scanner. The message draft is retained for recovery when browser session storage is available.
- 1Refresh the conversationRead the saved state.
- 2Reconnect if disconnectedReview the loaded messages and execution status.
- 3Follow the existing operationIf delivery is confirmed or work is active. Otherwise retry the unchanged draft.
- Use the circular Refresh conversation control to read the saved state.
- If disconnected, select Reconnect conversation and review the loaded messages and execution status.
- If delivery is confirmed or work is active, follow that existing operation. If the interface permits retry, resend the unchanged retained draft through Send message so the pending request identity can be reused.
While delivery remains unconfirmed, the composer may stay unavailable. Refresh again and inspect Open Run instead of creating a second conversation or rewriting the same task as a new message. A confirmed rejection or failure is different from uncertain delivery: read its reason and address that condition before sending again.
8. Stop Work or Manage the Conversation
Use Stop during active work, or Conversation options → Stop scan, to interrupt the scan and current reply. Wait for the stopping state to settle while results are saved. Disconnect conversation only disconnects the conversation; it is not a substitute for stopping a scan.
- 1Work is activeA scan or a reply is running.
- 2Select StopOr use Conversation options, then Stop scan.
- 3Wait for it to settleThe stopping state ends while results are saved.
- 4Scan and reply interruptedDisconnect conversation alone does not stop a scan.
Delete conversation, available from its menu, removes conversation history while retaining the Run and its saved results. Finish active work before deletion. An eligible Run can subsequently be opened in a new conversation using its retained assessment context.
For the assessment setup and profile workflow, continue with Scanning Features and Workflow. For the location of Results, Report, account setup, and other controls, see the Dashboard Menu Guide.