AUTONOMOUS
AGENTIC VAPT
ORCHESTRATED.
HORCRUX breaks free from dumb scanners and unconstrained LLM chatbots. Built on an authoritative deterministic state engine with an advisory reasoning AI tier, it constructs deep behavioral application models, coordinates 11 specialist analysts, tracks 15 property-based security coverage domains, and correlates multi-step attack paths directly to verified exploit handoffs.
/api/v2/tenants/{id}/export
BOLA Confirmed via Dual-Identity Swap
The Orchestration Cockpit In Action
Experience how HORCRUX separates deterministic execution from advisory AI reasoning. Select any quadrant below to inspect the live engine mechanisms.
Beyond Flat Endpoint Lists: The Application Model
HORCRUX does not just collect URLs. It builds a live behavioral model of the target representing states, mutations, object lifecycles, and cryptographic session traces.
Endpoints & API Operations
Deduplicated METHOD /path/{id} view correlating browser DOM, JS bundles, HTTP crawler, and OpenAPI schemas.
- Mutation & state-changing flags
- Parameter classes:
object_id,url_fetch,auth_credential - Provenance tracking (browser vs http vs js)
Multi-Identity Sessions
Tracks multiple researcher-configured accounts with zero secret leakage. Raw secrets are NEVER persisted in workspace state.
- One-way token & cookie hashing only
compare_identities()primitive for BOLA- Automated privilege differential analysis
Object Lifecycles & Workflows
Maps create/read/update/delete lifecycles, workflow transitions, preconditions, and postconditions across multi-step flows.
- Workflow state-skipping detection
- Cart-to-checkout logic validation
- Identity ownership boundary checks
GraphQL & Trust Boundaries
Introspection analysis, query depth auditing, field-level mutation permissions, and microservice trust boundary demarcation.
- Mutation authorization checks
- ServiceFact protocol normalization
- Scope gate per redirect chain
11 Specialist Analysts. No Generic AI Prompts.
One generic "security assistant" cannot handle complex penetration testing. HORCRUX dynamically activates dedicated roles with scoped inputs, typed output schemas, and strict safety boundaries.
ReconAnalyst
Maps network services, open ports, and software inventories into initial perimeter graphs.
WebAnalyst
Discovers routes, forms, DOM structures, and suppresses soft-404 / SPA catch-all baselines.
APIAnalyst
Dissects REST and GraphQL endpoints, mutations, JSON schemas, and authorization borders.
AuthenticationAnalyst
Maps login, registration, password reset, JWT signature, and session lifecycle transitions.
AuthorizationAnalyst
Orchestrates cross-identity comparisons to prove BOLA (IDOR) and function privilege escalation.
BusinessLogicAnalyst
Identifies workflow sequence skipping, coupon reuse, and state-machine manipulation flaws.
ClientSideAnalyst
Decompiles JavaScript webpack chunks, uncovers hidden API paths, and client trust assumptions.
EvidenceAnalyst
Normalizes observations, computes statistical confidence, and sanitizes sensitive credentials.
ValidationAnalyst
Executes non-destructive proofs for SSRF, injection, and file-upload candidate hypotheses.
AttackPathAnalyst
Connects verified findings into end-to-end attack paths from unauthenticated access to domain compromise.
ExploitIntelligenceAnalyst
Correlates verified software versions with public exploit intelligence and prepares ExploitHandoff packages.
15 Security Property Coverage Domains
Traditional tools boast about raw finding counts (mostly noise). HORCRUX tracks mathematical coverage of application security properties, giving operators provable audit certainty.
20 Synthetic Benchmarks & Deterministic Replay
Offensive AI systems must be rigorously benchmarked without touching external networks.
HORCRUX includes 20 synthetic fixtures and records recon evidence to evidence-script.json for 100% reproducible offline replay.
# Synthetic Workspace Fixture: Endpoints: /rest/user/login, /rest/users/{id}, /rest/basket/{id} Parameters: id (path), basketId (path), email (body) Credentials: user-a (test-identity) # Golden Metric Expectations (horcrux.bench.golden): ✓ min_endpoints >= 2: PASSED ✓ hypothesis:idor_bola: PASSED ✓ investigation:authorization-bound: PASSED ✓ min_attack_paths >= 1: PASSED ✓ coverage:authorization: PASSED (Evidenced) # Zero-Network Replay Command: $ horcrux replay bench-bola --script evidence-script.json [+] Rebuilt workspace without network socket allocation [+] Reassessed hypotheses, coverage, and attack paths deterministically.
Terminal First. Designed for Real Engagements.
From Kali Linux and macOS to containerized CI/CD operators. Install in under 60 seconds.
Autonomous Offensive Security.
Grounded in Evidence.
Stop sifting through hundreds of duplicate scanner alerts. Deploy HORCRUX to synthesize attack surfaces, uncover behavioral flaws, and execute verified penetration testing loops with complete operator control.