BREACH.MMO v1.0.0 — Full CEH Coverage, Cloud Hacking, and Campaign Mode

v1.0.0 is the milestone we've been building toward since the first commit. Every CEH v12 module now has at least one BREACH.MMO challenge mapped to it. If you're studying for your Certified Ethical Hacker exam, you can play through the entire methodology in-game and watch your readiness score update in real time.

Wireless hacking (CEH M16)

The WirelessEngine simulates a WiFi environment: three access points on the same channel, one of them running WPA2-PSK with a weak corporate passphrase. Your job is to deauthenticate a connected client, capture the 4-way EAPOL handshake, and crack it offline against a wordlist. A second challenge covers the evil twin attack — clone the target SSID with higher signal strength, wait for a victim to connect to your rogue AP, and harvest their credentials through a captive portal.

Both challenges include inline educational overlays explaining the cryptographic mechanics: why WPA2 passphrases are offline-crackable, what PMKID attacks change about that, and why WPA3's SAE handshake closes the gap. The CEH exam weights wireless heavily; these two challenges hit the testable concepts directly.

IoT and OT hacking (CEH M18)

The IoTDeviceEngine exposes a fictional Shodan-style registry: eight internet-exposed devices across four categories (IP cameras, industrial controllers, smart meters, a SCADA HMI). The first challenge is pure Mirai — scan for devices, identify vendor defaults, log in as admin. The second challenge is the one that actually scares ICS security teams: access the SCADA HMI and manipulate process setpoints until the over-speed alarm triggers. You're not just reading data; you're sending commands to a simulated centrifuge controller.

The SCADA overlay covers Stuxnet, IT/OT network convergence, and NERC CIP compliance requirements. The gap between "IT security" and "operational technology security" is one of the most important career differentiators in industrial cybersecurity right now, and the exam reflects that.

Cloud security (CEH M19) — AetherCloud

The CloudEngine models a fictional cloud provider called AetherCloud, structurally similar to AWS but with no trademark concerns. Four challenge chains:

• IAM privilege escalation — a leaked access key with iam:PassRole permission lets you assume a more privileged role through the STS chain. Real technique; used in the 2020 SolarWinds-era campaigns.
• Open S3 bucket — enumerate buckets, identify one with a public-read ACL, exfiltrate the contents without authentication. The educational overlay covers the Capital One 2019 breach: SSRF to IMDS to misconfigured S3, 106 million records.
• Lambda SSTI injection — a serverless function passes event payload directly into a template engine. Jinja2/Twig/Freemarker patterns in the payload trigger a code execution path that leaks the function's IAM credentials via environment variable access.
• Container escape — a container running with --privileged has all Linux capabilities enabled. The challenge walks you through mounting the host filesystem from inside the container. The overlay covers CAP_SYS_ADMIN, Docker socket mounts, and why Falco and seccomp profiles exist.

Certification Readiness Tracker (C key)

Press C at any point during a match to open the Cert Tracker. Three tabs: CEH v12 (20 modules, grey/yellow/green by challenge coverage), OSCP PEN-200 (14 topic grid with an Active Directory gap banner — that gap will close in v1.5.0), and Security+ SY0-701 (5-domain weighted readiness score, with Domain 4 at 28% of the exam). The tracker updates live as you complete challenges — every certDomain tag on a completed challenge feeds directly into the grid. If you're using BREACH as a study tool, the tracker shows you exactly where your coverage is weak.

Campaign Mode (G key)

Press G to open a 23-challenge linear path arranged in CEH exam sequence order: footprinting, scanning, enumeration, system hacking, network attacks, web application attacks, wireless, IoT, and cloud. Each challenge unlocks when the previous one is complete. Progress persists in localStorage between sessions. Complete all 23 and you get the Campaign Graduate badge. This mode turns BREACH from a sandbox into a structured prep curriculum with a defined finish line.

Play at play.multiversestudios.xyz/breach/ — no account required. All 20 CEH modules are now live.