Breach by Reform Labs (@reformlabs/breach)

breach is a high-performance, extension-based CLI tool designed to autonomously detect security vulnerabilities in modern API systems. Built with TypeScript and validated with Zod for strict runtime safety.

[!WARNING] DISCLAIMER & LEGAL NOTICE

This tool is strictly intended for authorized security testing and educational purposes only.

• Do NOT use this tool against any system without explicit written permission from the owner.
• The developers and contributors of @reformlabs/breach are NOT responsible for any damages, data loss, or service interruptions caused by the use or misuse of this software.
• You assume all risk and liability for your actions. Be responsible and ethical.

SECTION 1: CLI Commands (Usage Guide)

1. Configuration

• breach init : Creates breach.config.json in the current directory.
• breach config set <key> <value> : Saves target API address or Auth token.
• breach config view : Displays current configuration in the terminal.

2. Extension Management

• breach extension search [keyword] : Search downloadable extensions.
• breach extension list : List installed and active extensions.
• breach extension install <nick1> <nick2> : Downloads specified extensions (e.g., install sqli bola).
• breach extension remove <nick> : Removes the extension.
• breach extension update : Updates dictionary/payload lists of installed extensions.

3. Scanning

• breach scan : Executes full scan with all active extensions on target.
• breach scan --include <nicks> : Runs only selected extensions.
• breach scan --exclude <nicks> : Excludes specific extension.
• breach scan --path <endpoint> : Scans singular defined path.
• breach scan --dry-run : Prints execution plan without making headers/triggers.

4. Reporting

• breach report list : Lists historical scan IDs and summaries.
• breach report <scan-id> : Displays specified report results in tabular layout.

SECTION 2: Supported Extensions (Vulnerabilities List)

Category 1: Access & Auth

• bola : Broken Object Level Authorization (ID manipulation / IDOR).
• bfla : Broken Function Level Authorization (Admin endpoint access).
• mass-assign : Injecting hidden parameters (e.g., role: admin).
• id-enum : Harvesting valid User IDs back from error message codes.
• unauth-access : Hitting paths bypasses headers requirements.

Category 2: Injection

• sqli : SQL Injection - Database manipulation.
• nosqli : NoSQL Injection operator triggers ($gt, $ne).
• cmdi : Command Injection executed shellcodes on local OS execution.
• ssti : Server-Side Template Injection triggers on template engines.
• xxe : XML External Entity reading system files.
• ldap-inj : Directory listing manipulation.
• crlf-inj : Header injection and response splitting.

Category 3: Tokens & Crypto

• jwt-none : Bypass verification via alg: none.
• jwt-alg-swap : Algorithmic swapping (RS256 keys signatures).
• jwt-brute : Dictionary cracking on weak keys.
• session-fix : Session Fixation structure forcing.
• oauth-redirect : Stealing tokens via redirect tampering.

Category 4: Business Logic

• race-cond : Race Conditions executing millisecond concurrent loads.
• step-skip : Bypassing linear sequential checkout workflows.
• ssrf : Request forgery on internal loopbacks gateways.
• http-smuggle : Interpretation discrepancies trigger loads.

Category 5: DoS & Availability

• rate-limit : Testing threshold caps setup limits.
• payload-limit : Oversized JSON loads exceeding memory caches.
• regex-dos : Catastrophic backtracking with recursive sets.
• param-pollution : WAF bypasses compounding duplicate variables.

Category 6: Info Leak & Config

• info-leak : Server IPs/Stack traces leakage diagnostics.
• verb-tamper : Bypassing limits with alternative verbs (HEAD, OPTIONS).
• cors-misconfig : Dangerous wildcarding access permissions.
• graphql-introspect : Leaking schema maps forcibly layout.
• sensitive-files : Checking exposed .env or configuration triggers.

Project Structure

• src/cli/: Terminal interface & Command handlers.
• src/core/: Attack Engine, Discovery, Requester & Analyzer.
• src/sdk/: Extension Development Kit (Kit interfaces).

For detailed architecture, see Documentation.