## https://sploitus.com/exploit?id=000126D0-3A24-5F4B-BFFA-A85D8F4CB583
# ๐ก๏ธ BreachScope Hermes
**BreachScope Hermes** is an agentic AI platform designed for safe, automated security assessments and vulnerability discovery.
It acts as an autonomous auditor that analyzes source files, maps out vulnerabilities, runs controlled local exploit simulations, and automatically generates detailed LaTeX/PDF evidence reports.
## What It Contains
- Main platform: `http://localhost:3000/`
- Banking target: `http://localhost:3000/target.html`
- Agent workflow: Hermes analyzes source files, maps vulnerabilities, runs a controlled exploit simulation, and generates reports.
- Target app: BlueVault Bank, a full demo banking website with intentional vulnerabilities.
- Reports: generated into `reports/` as LaTeX `.tex` plus a PDF. If MiKTeX is unavailable, the app uses a Node PDF fallback.
## Run
```bash
npm start
```
## Case 1: Banking Target Attack
1. Open `http://localhost:3000/`.
2. Click `Analyze target codebase`.
3. Review the vulnerability map.
4. Open `http://localhost:3000/target.html` in another tab.
5. Click `Simulate live attack`.
6. Watch BlueVault Bank change live:
- unauthorized customer session
- cross-account data leak
- OTP bypass
- unsafe transfer/balance change
- admin unlock
- debug record leak
- card limit tampering
- support preview injection
- loan preapproval abuse
7. Click `Generate LaTeX PDF`.
## Case 2: BreachScope Hermes Bridge Repo Scan
Use the repo panel on the main platform:
- Paste a `https://github.com/user/repo` link into the GitHub repository audit box.
- BreachScope forwards the link and strict defensive-audit instructions to the local Hermes Bridge.
- Hermes is constrained to defensive repository review only: clone/read source, find bugs, describe impact, write fixes, and produce LaTeX/PDF evidence.
Terminal 1, start Hermes Gateway in WSL:
```bash
export GATEWAY_ALLOW_ALL_USERS=true
/home/vrepo/.local/bin/hermes --yolo gateway run --replace
```
Terminal 2, start the website:
```powershell
npm start
```
The bridge calls Hermes in WSL with:
```bash
POST http://127.0.0.1:8644/webhooks/breachscope
```
The Hermes webhook route is `breachscope`; it receives the GitHub link and an output path, then writes structured JSON for the website to convert into the LaTeX/PDF report.
If WSL or the gateway is unavailable, BreachScope falls back to the constrained local/static scanner so the hackathon demo still produces a LaTeX/PDF report.
## Safety
All live attacks are local, controlled, and intentionally designed into the demo target. This does not attack real external systems.