Know where
you're exposed.
zAiBreach provides application penetration testing and security validation designed to identify, validate, prioritize, and document exploitable security weaknesses. Findings are mapped to OWASP, PCI DSS, NIST, ISO 27001 and SOC 2 control references.
You verify ownership of a domain before zAiBreach tests it.
What zAiBreach tests
Every module runs against the target you authorised, in one assessment, and reports into the same finding model.
SSL/TLS
Certificate validation and expiry, cipher strength, protocol versions and known transport weaknesses.
Security headers
CSP, HSTS, X-Frame-Options, Referrer-Policy and Permissions-Policy, checked for presence and for weak values.
Ports and services
Open ports and the services behind them, so the attack surface reaching the internet is the one you meant to expose.
Injection and traversal
SQL injection, cross-site scripting and path traversal across crawled pages and parameters, with reproduction steps.
Technology fingerprinting
Frameworks, content management systems, libraries and server software, including versions where they are disclosed.
Authentication and access
Session and cookie handling, forced browsing, insecure direct object references and privilege boundaries.
API security
CORS configuration, authentication bypass, rate limiting and HTTP method handling on REST endpoints.
GraphQL
Introspection exposure, query depth and complexity limits, and authorisation on individual resolvers.
JavaScript assets
Endpoints extracted from bundles, source maps left in production, and credentials embedded in client-side code.
JWT and OAuth
Token signing and validation, algorithm confusion, and redirect handling in the OAuth flow.
Source code analysis
A connected GitHub repository is checked for committed secrets, vulnerable dependencies and known CVEs in the stack.
Subdomain discovery
Certificate-transparency enumeration and DNS resolution, including hosts pointing at a service that no longer claims them.
Exposed secrets
Environment files, backup archives, open version-control directories and API keys reachable without authentication.
File upload
Content-type and extension enforcement, SVG-borne scripting, and whether an uploaded file becomes reachable.
Redirects and SSRF
Open redirect chains and server-side request forgery probes, including analysis of multi-hop chains.
Email security
SPF, DKIM and DMARC policy, MX configuration and opportunistic transport encryption on the domain's mail path.
Cloud exposure
Publicly readable object storage, exposed managed databases and search clusters, and reachable metadata endpoints.
Signature templates
Community-maintained Nuclei templates for known CVEs and misconfigurations. These are known-signature checks, and the module runs when the Nuclei engine is installed on the host.
A report you can hand to someone
The same assessment produces the document an executive reads, the detail an engineer works from, and the data your own systems consume.
📥 Executive PDF
Severity breakdown, exposure score and rating, prioritised remediation, and the control references for every finding. Each download carries a stable report id.
📄 Technical HTML
Every finding in full: location, evidence, reproduction where the module captured it, and remediation guidance.
📋 JSON
The same findings as structured data, for a pipeline that gates a deploy or a dashboard of your own.
🏛️ Control-mapping reports
One report per framework, as PDF or JSON, listing the findings against the controls they touch. The mapping is automated and labelled as such — it is evidence for a conversation with your assessor, not an audit opinion.
| Framework referenced | Version | Control-mapping report |
|---|---|---|
| OWASP Top 10 | 2021 | PDF · JSON |
| PCI DSS | v4.0 | PDF · JSON |
| NIST SP 800-53 | Rev. 5 | PDF · JSON |
| ISO/IEC 27001 | 2022 Annex A | PDF · JSON |
| SOC 2 | Trust Services Criteria | PDF · JSON |
How an assessment runs
One pass over the target, one set of findings, one report. Nothing is queued behind a consultant's calendar.
Find it
Eighteen modules test the target in a single assessment: transport, headers, exposed services, injection, identity, client-side code, and cloud and email exposure.
Prove it
Findings are deduplicated across modules and carry the module that raised them and a confidence level. Where a module confirms the behaviour, the captured evidence and the reproduction steps travel with the finding.
Fix it
Every finding carries a severity, a CVSS v3.1 baseline derived from that severity, the affected location, and remediation guidance an engineer can act on.
Verify it
Schedule the assessment to re-run and compare the exposure score for a target across runs, so a fix is visible rather than asserted.
Talk to us first
A question about coverage, a target that needs a scoping conversation, or an invoice that needs a purchase order — send it here and a person answers.
For anything already running, the fastest path is the account you signed up with: open zAiBreach and use the history for the assessment in question.
Find out what an
attacker would find.
Create an account, verify a domain, and run your first assessment. Results in minutes, not a scheduling call.