Skip to content

Foothold Setup Guide

This guide covers the technical requirements for preparing a host machine to deploy the Breach360 Foothold. The foothold establishes outbound communication with the Breach360 platform to support security testing activities. Make sure your environment meets these requirements before proceeding with deployment.

Host Machine Requirements

Your host machine needs to meet these minimum specifications:

  • System Type: Laptop, Desktop, Server, or Virtual Machine
  • CPU: Minimum 2.0 GHz dual core
  • RAM: Minimum 4 GB
  • Storage: Minimum 60 GB available disk space
  • Network: Any (Ethernet, Wi-Fi, or equivalent)
  • Bandwidth: No specific minimum requirement
  • Specialized Hardware: None required

Foothold version requirement for internal web pentesting: Internal Web Application Pentesting engagements require foothold software v1.7.0 or later. Earlier versions support all other engagement types but cannot launch internal web pentests until the foothold is updated.

Supported Operating Systems

  • Supported: Ubuntu 20.04 or later
  • Architecture: amd64 (x64), arm64 (aarch64)
  • Local Admin Rights: Required
  • Dependencies: None

Note: Other Linux distributions may also work, but BreachLock does not offer support in these cases. Breach360 can still perform lateral movement to Windows and Mac hosts during engagements, whichever supported deployment type the foothold runs on.

Virtual Machine

  • Type: Any compatible hypervisor (VirtualBox, VMware)
  • Architecture: amd64 (x64)
  • Local Admin Rights: Not required
  • Dependencies: Compatible virtualization software

Docker Container

  • Supported Platforms: Linux hosts with Docker installed
  • Architecture: amd64 (x64), arm64 (aarch64)
  • Local Admin Rights: Required for Docker installation and container management
  • Dependencies: Docker must be installed and running
  • Container Images: Pre-built container images are available for both x64 and arm64 architectures

Docker-based deployments provide a containerized approach to running the Breach360 Foothold. This method isolates the foothold in a container environment and can simplify deployment and management across different host systems.

Note: We recommend Docker-based deployments only for fully containerized application architectures (e.g. Kubernetes). For other use cases, OVA or dropper-based deployments are more appropriate.

Network & Security Requirements

Inbound Connection

  • No inbound firewall exceptions required
  • Internet access required (no proxy configuration necessary)
  • Allowed Protocols: HTTP/HTTPS (outbound only)

Required Outbound Whitelisting

Tip: You can download the full allowlist as a plain text file (one hostname per line, with comments) for easy import into firewall or proxy tooling.

The following domains must be accessible for outbound connections:

  • aev.breachlocklabs.com
  • example.com (connectivity verification)
  • archive.ubuntu.com / security.ubuntu.com (Ubuntu package mirrors, amd64/x64 hosts)
  • azure.archive.ubuntu.com / azure.security.ubuntu.com (Azure environments)
  • ports.ubuntu.com (Ubuntu package mirror, arm64/aarch64 hosts)
  • http.kali.org / kali.download / archive.kali.org (Kali Linux package mirrors)
  • download.docker.com (Docker installation)

For POV customers, the following domains must also be accessible:

  • aev-demo.breachlocklabs.com

Additional requirements for Docker container deployments

If you deploy the foothold as a Docker container (rather than via the dropper installer or the OVA), the host also pulls the pre-built agent image from BreachLock's authenticated container registry. Allow outbound HTTPS access to:

  • sapiens-container-server-prod.whitebay-4c953f1f.northeurope.azurecontainerapps.io (container registry)

For POV customers, allow the demo registry instead:

  • sapiens-container-server-demo.ambitiousflower-d7e42399.northeurope.azurecontainerapps.io (container registry)

Note: Docker container deployments do not require the OS package mirrors (archive.ubuntu.com, security.ubuntu.com, azure.archive.ubuntu.com, azure.security.ubuntu.com) or download.docker.com listed above. Those apply only to dropper-based installs, which install tooling onto the host OS; the container image already ships with all required tooling, and Docker itself is a prerequisite you install separately. You do still need outbound access to the Breach360 platform (aev.breachlocklabs.com, or aev-demo.breachlocklabs.com for POV customers) so the running agent can connect back.

Note: You may need to configure additional firewall rules for reverse shells if required.

The outbound domain list above applies to the foothold host. For source IP allowlisting when you run external engagements (scanner traffic from the internet toward your public attack surface), see Allowlist source IPs for external engagements.

Summary

This guide covers the system specifications, OS compatibility, network requirements, and whitelisting rules needed to prepare a host for the Breach360 Foothold. Once you've met these prerequisites, you can deploy the foothold and start running engagements.

For instructions on creating a deployment in the Breach360 platform, see the Deployment section.

Need help with deployment setup? If you run into any issues while setting up a deployment, start with Host Connectivity and Installation in the Troubleshooting section. If that does not resolve it, the BreachLock team is here to help. Reach out to your BreachLock representative for assistance or email us at support@breachlock.com.