Product
One agent. Every attack surface.
Attackers do not respect your org chart. BreachAgent tests web, API, cloud and perimeter as a single connected surface, then chains what it finds.
-
Web apps & APIs
Authentication and session handling, access control (IDOR, privilege escalation), injection, SSRF, business-logic abuse, and API object-level authorisation across REST and GraphQL.
-
Cloud
Exposed storage, over-broad IAM, public snapshots and images, metadata-service abuse and misconfigured services across AWS, Azure and GCP.
-
VPN & perimeter
Remote-access gateways, exposed admin interfaces, weak or reused credentials, and known-exploitable edge appliances.
-
External endpoints
Everything reachable from the internet: forgotten hosts, stale DNS, expired certificates, and shadow assets you did not know were live.
Scope controls
It only does what you allowed.
Autonomous does not mean unsupervised. Every engagement runs inside guardrails you set and can change at any time.
- A rules-of-engagement file you approve before anything runs
- In-scope hosts only; everything else is refused
- No denial of service, no destructive writes, no bulk data exfiltration
- Rate limits and test windows you set
- Data-exposure proof by header inspection or redacted sample, never full download
finding Anonymous listing on production storage bucket
- recon $ breachagent scope --target example.co.za --surface external
- recon static-assets.example.co.za → CNAME → s3-eu-west-1 · bucket: example-static-prod
- map $ ListBucket example-static-prod (unauthenticated)
- map 200 · 12 418 keys · /backups/ present
- attack $ HEAD /backups/db-2026-08-30.sql.gz
- attack 200 · 412 MB · Content-Type: application/gzip · publicly readable
- prove header inspection only — no download, per RoE §4.2 · production dump confirmed
- sign-off PoC + fix attached · reproduced by operator · signed 16:21 SAST
Point it at something you own.
Tell us the target and the rules. You get a scoped attack, working proofs, and a report with a name on it.