> Methodology
How BREACH.LAB works end to end — the OWASP threat model, the attack phases, and the honest limits of an automated scan.
The scan pipeline
Discovering the attack surface — subdomains, tech stack, fingerprints.
Mapping pages, forms, JS files, and API endpoints of the target.
Firing OWASP Top-10 payloads at the discovered attack surface.
AI judges each finding — severity, impact, and exploitability.
Compiling the breach report with proofs and plain-language fixes.
OWASP Top-10 coverage
| Module | Check | Category | Severity |
|---|---|---|---|
| secrets | Exposed Secrets & API Keys | Data Exposure | Critical |
| env | Exposed .env / Config Files | Misconfig | Critical |
| sql | SQL Injection | Injection | High |
| headers | Missing Security Headers | Misconfig | Medium |
| cors | Open CORS Policy | Misconfig | High |
| dir | Directory Listing | Information Leak | Medium |
| backup | Exposed Backup / Source Files | Information Leak | High |
| xss | Stored Cross-Site Scripting | Injection | High |
| auth | Broken Access Control | Access Control | Critical |
| cookie | Session Cookie Missing Flags | Misconfig | Medium |
| tls | Downgraded TLS / Cert Issues | Cryptographic Failures | Low |
| info | Verbose Error Pages | Information Leak | Low |
Honest limits
BREACH.LAB automates the OWASP Top-10 checklist with real HTTP, TLS, and header probes against the live site. It checks security headers, TLS strength, exposed config files, CORS and cookie policies, and scans for error/source disclosure — but it cannot match the depth of a manual penetration test, which explores application logic, chained attacks, and business logic beyond repeatable payloads.
Perform scans only against sites you own or have permission to test. The engine runs non-destructive HTTP probes and blocks private / internal targets (SSRF guard), rate-limits requests, and never sends destructive payloads. This is an advisory tool — not a substitute for a real, authorized penetration test.