# BreachMap

A Windows tool that inventories Active Directory computers, fans out via WinRM/SSH to test TCP reachability between them on a port list, and produces an interactive HTML report measuring lateral-movement exposure and breach-propagation risk.

## What's in this zip

- `BreachMap.exe` — self-contained single-file Windows x64 executable. No installer, no external DLLs, no .NET runtime install required.
- `README.md` — this file.

## Requirements

**Host running BreachMap**
- Windows x64.
- Domain-joined (or reachable to a domain controller) so the tool can enumerate AD computers. If you supply your own host list via `--computerList`, AD is not required.
- Outbound WinRM (TCP 5985 / 5986) to Windows targets and/or SSH (TCP 22) to Linux targets.

**Credentials**
- A domain account that can query AD and authenticate to probe sources over WinRM (typically a member of Remote Management Users, or local admin on those hosts).
- For Linux targets: an SSH user with a key or password.

**Target hosts**
- Windows sources: WinRM enabled (PowerShell 5.1 or later).
- Linux sources: OpenSSH server.
- Targets themselves do **not** need an agent — only the hosts used as probe sources are connected to.

**Network**
- Source-to-target reachability on the ports being tested. Default port set: `22, 23, 445, 1433, 2701, 3389, 5900, 5985, 5986, 7900`.

## Quick start

Open an elevated PowerShell, `cd` to the extracted folder, then run a scan:

```powershell
.\BreachMap.exe --inactiveDays 90 --winrm-username DOMAIN\svc-breachmap --winrm-password-stdin
```

(You'll be prompted for the password on stdin.)

When the scan finishes, build the HTML report:

```powershell
.\BreachMap.exe report
# open .\report\index.html
```

## Common usage examples

| Goal | Command |
| --- | --- |
| Scan AD with defaults | `BreachMap.exe` |
| Use a custom host list (CSV) | `BreachMap.exe --computerList hosts.csv` |
| Custom port set | `BreachMap.exe --ports 445,3389,5985` |
| SSH (Linux) targets | `BreachMap.exe --ssh-user root --ssh-key .\id_rsa` |
| Include network discovery | `BreachMap.exe --networkdiscoveryscan` |
| Custom output directory | `BreachMap.exe --out C:\scans\run1` |

CSV format for `--computerList`: `hostname,fqdn,osType,openports,inactive,type`

## Output files

By default, scan results are written to `scanresult\`:

- `inventory.csv` — every discovered host with OS type, inactive flag, domain-controller flag, and `ZeroNetworksSegmentServer` flag.
- `results.csv` / `results.json` — TCP probe results: `SourceHost, DestHost, Port, Succeeded, LatencyMs, Error, Timestamp`.
- `nic-inventory.csv` — NIC details per reachable host.
- `discovered-inventory.csv` — IPs discovered when `--networkdiscoveryscan` is enabled.
- `run-metadata.json` — scan parameters, version, timing.
- `BreachMap.log` — detailed execution log.

## HTML report

Generate the report bundle from a scan output folder:

```powershell
.\BreachMap.exe report --in scanresult --out report
# open .\report\index.html
```

The report is an interactive dashboard showing blast radius, reachable assets, crown jewels, risky ports, and a host-to-host graph.

## Zero Networks segment-server handling

BreachMap auto-detects Zero Networks segment servers and excludes them from skewing exposure metrics:

- On WinRM-reachable Windows hosts BreachMap checks for `C:\Program Files\Zero Networks\RemoteManager`.
- Detected hosts are flagged in `inventory.csv` (`ZeroNetworksSegmentServer=true`) and **excluded from being used as probe sources and as scan destinations**.
- The HTML report likewise **excludes ZN segment servers and any edges to/from them from all KPI calculations** (blast radius, attack surface, crown-jewel risk). Rationale: ZN segment servers have broad management connectivity by design and would distort exposure metrics if treated as ordinary hosts.
- The report UI includes a red/green toggle to view ZN-related edges separately.

## Full flag reference

Run `BreachMap.exe --help` for every flag, including parallelism (`--source-parallelism`, `--dest-parallelism`, `--port-parallelism`), timeouts, LDAP filtering, and WinRM legacy tuning for Windows 7 / Server 2008 R2 sources.

## Troubleshooting

- **Access denied on WinRM** — confirm `--winrm-username` is in `DOMAIN\user` form and the account is in Remote Management Users (or local admin) on the probe sources.
- **No hosts found** — `--inactiveDays` defaults to 90, which filters stale AD objects. Lower the value or pass `--computerList`.
- **Scan slow or appears stuck** — reduce `--source-parallelism` (default 25) and `--dest-parallelism` (default 100), and re-run with `--verbose` to watch `BreachMap.log`.
- **SSH connect failures** — verify the key/user works from the BreachMap host using `ssh` manually. If first-handshake is slow, raise `--ssh-connect-timeout-ms` (default 30000).
