█████╗ ██████╗ ██████╗ ██████╗ ██████╗ █████╗ ██████╗██╗ ██╗
██╔══██╗██╔══██╗██╔══██╗██╔══██╗██╔═══██╗██╔══██╗██╔════╝██║ ██║
███████║██████╔╝██████╔╝██████╔╝██║ ██║███████║██║ ███████║
██╔══██║██╔═══╝ ██╔═══╝ ██╔══██╗██║ ██║██╔══██║██║ ██╔══██║
██║ ██║██║ ██║ ██║ ██║╚██████╔╝██║ ██║╚██████╗██║ ██║
╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝
Elite Recon Framework — v3.0
Built for bug bounty hunters who think in layers.
- Overview
- Philosophy
- What's New in v3.0
- Architecture
- Prerequisites
- Tool Dependencies
- Installation
- Configuration
- Usage
- Functions Reference
- Output Structure
- Edge Cases Covered
- AI Integration
- Discord Notifications
- Workflow Guide
- Additional Resources
- Legal Disclaimer
Approach is an elite, modular recon automation framework built for bug bounty hunters and security researchers. It is written in Bash and Python, designed around a layered intelligence model that goes far beyond standard subdomain enumeration.
v3.0 is a complete rewrite. It adds 15 new functions, covers critical edge cases that most automation frameworks miss entirely, integrates AI-assisted triage via the Claude API, and produces a structured markdown report at the end of every run.
The core design principle is from the original script's own comment:
"Don't use this script as other automation tools. Make sure you add some extra unique features."
That is exactly what v3.0 does.
Most recon tools answer the question: "What subdomains exist?"
Approach answers a harder question: "Where does this organization's attack surface exist that they themselves don't fully see?"
Companies know their main application. They often don't know their:
- Forgotten staging and dev subdomains generated by permutation (
api-v2,dev,us-prod) - Infrastructure in IP ranges owned by the org but never resolved via DNS
- Acquired company domains with the same codebase but far less scrutiny
- Historical JavaScript files on Wayback Machine that still contain valid secrets
- Co-hosted applications on the same IP as their main domain
- Open cloud storage buckets named after brand variations
- Internal domain names leaked through SSL certificate SAN fields on Shodan
Approach covers all of these. Every function targets a real gap that passive enumeration misses.
The workflow is built around four recon layers:
Layer 1 — SCOPE INTELLIGENCE Who are you actually dealing with?
Layer 2 — ASSET DISCOVERY What exists?
Layer 3 — SURFACE MAPPING What's running and what's interesting?
Layer 4 — VULNERABILITY SIGNALS Where do you actually hunt?
| Feature | v1.0 | v3.0 |
|---|---|---|
| Subdomain sources | 3 (amass, subfinder, crt.sh) | 8 (+ assetfinder, findomain, chaos, rapiddns, otx) |
| Subdomain resolution | httpx direct probe | puredns (wildcard-aware) → httpx |
| Permutation discovery | basic | alterx + goaltdns, net-new diff |
| Port scanning | nmap on main target only | naabu (60+ ports) → nmap on ALL owned IPs |
| JS analysis | wget + nuclei | katana + LinkFinder + SecretFinder + trufflehog + Wayback |
| Directory bruteforce | dirsearch | ffuf + feroxbuster + API wordlist + parallel subs |
| Functions | 6 | 22 |
| Edge cases covered | 0 explicit | 15+ (AXFR, CORS, 403 bypass, favicon hash, ASN ranges, etc.) |
| AI integration | None | Claude API (scope parsing + recon triage) |
| Alerting | None | Discord webhook on every critical find |
| Output | Terminal only | Structured directory tree + markdown report |
| Authorization gate | None | yes confirmation on full auto mode |
approach.sh
│
├── Intelligence Layer
│ ├── asn_enum() — ASN ranges + reverse IP lookup
│ ├── reverse_whois() — Sibling domain discovery
│ └── dns_analysis() — AXFR, SPF, DMARC, DKIM, CNAME analysis
│
├── Asset Discovery Layer
│ ├── subdomain_enum() — 8-source parallel enumeration
│ └── permutation_enum() — alterx + goaltdns, net-new diff
│
├── Surface Mapping Layer
│ ├── waf_detect() — WAF, headers, favicon hash
│ ├── port_scan() — naabu → nmap on all owned IPs
│ ├── url_harvest() — gau + waybackurls + katana + uro
│ ├── javascript() — Deep JS + historical Wayback analysis
│ ├── dir_bruteforce() — ffuf + feroxbuster + API wordlist
│ └── param_discover() — paramspider + x8 + JS param extraction
│
├── Vulnerability Signal Layer
│ ├── gf_patterns() — 13 gf patterns on full URL list
│ ├── cors_check() — reflect + null + subdomain origin
│ ├── bypass_403() — header tricks + path normalization
│ ├── takeover_check() — subzy + nuclei takeover templates
│ └── vuln_scan() — nuclei sweep + CVEs + DAST fuzzing
│
├── Intel & Leaks Layer
│ ├── check() — login/admin/CI/monitoring panel detector
│ ├── cloud_enum() — S3/GCP/Azure + GitHub org secrets
│ ├── shodan_intel() — org + SSL + SAN + favicon hash search
│ └── ai_assist() — Claude API scope parsing + recon triage
│
└── Meta
├── generate_report() — Full markdown report
├── full_auto() — Complete pipeline with auth gate
└── fresh_up() — Update all tools
- OS: Any Linux distribution (Kali recommended)
- Languages: Bash 4+, Python 3.8+
- Go: 1.21+ (for ProjectDiscovery tools)
- Root or sudo: For nmap and some system-level operations
- API keys (optional but recommended):
ANTHROPIC_API_KEY— for AI scope parsing and triageSHODAN_API_KEY— for Shodan intelligenceGITHUB_TOKEN— for GitHub code search dorksNOTIFY_DISCORD_WEBHOOK— for real-time critical alerts
| Tool | Purpose | Install |
|---|---|---|
| subfinder | Passive subdomain enum | go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest |
| httpx | HTTP probing + fingerprint | go install github.com/projectdiscovery/httpx/cmd/httpx@latest |
| nuclei | Vulnerability scanning | go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest |
| naabu | Fast port scanning | go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest |
| katana | JS-aware web crawler | go install github.com/projectdiscovery/katana/cmd/katana@latest |
| dnsx | DNS resolution + analysis | go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest |
| puredns | Wildcard-aware DNS resolution | go install github.com/d3mondev/puredns/v2@latest |
| amass | Passive subdomain enum | go install github.com/owasp-amass/amass/v4/...@latest |
| nmap | Service/version detection | apt install nmap |
| ffuf | Fast content discovery | go install github.com/ffuf/ffuf/v2@latest |
| feroxbuster | Recursive dir busting | apt install feroxbuster |
| dirsearch | Directory brute-force | git clone https://github.com/maurosoria/dirsearch.git |
| gau | Historical URL collection | go install github.com/lc/gau/v2/cmd/gau@latest |
| waybackurls | Wayback Machine URLs | go install github.com/tomnomnom/waybackurls@latest |
| uro | URL deduplication | go install github.com/ameenmaali/uro@latest |
| gf | Pattern matching on URLs | go install github.com/tomnomnom/gf@latest |
| subzy | Subdomain takeover check | go install github.com/LukaSikic/subzy@latest |
| assetfinder | Passive subdomain enum | go install github.com/tomnomnom/assetfinder@latest |
| findomain | Passive subdomain enum | See GitHub releases |
| chaos | Chaos dataset query | go install github.com/projectdiscovery/chaos-client/cmd/chaos@latest |
| alterx | Subdomain permutation | go install github.com/projectdiscovery/alterx/cmd/alterx@latest |
| Tool | Purpose | Install |
|---|---|---|
| trufflehog | Verified secret scanning | go install github.com/trufflesecurity/trufflehog/v3@latest |
| LinkFinder | JS endpoint extraction | git clone https://github.com/GerbenJavado/LinkFinder.git |
| SecretFinder | JS secret/key detection | git clone https://github.com/m4ll0k/SecretFinder.git |
| paramspider | Parameter discovery | git clone https://github.com/devanshbatham/ParamSpider.git |
| x8 | Hidden parameter bruteforce | See GitHub releases |
| wafw00f | WAF detection | pip install wafw00f |
| corsy | CORS misconfiguration scanner | git clone https://github.com/s0md3v/Corsy.git |
| cloud_enum | Cloud bucket enumeration | git clone https://github.com/initstring/cloud_enum.git |
| shodan | Shodan CLI | pip install shodan |
| goaltdns | Subdomain permutation alt | go install github.com/subfinder/goaltdns@latest |
| whatweb | Tech fingerprinting | apt install whatweb |
| bypass-403 | 403 bypass automation | git clone https://github.com/iamj0ker/bypass-403.git |
| mmh3 | Favicon hash (Python) | pip install mmh3 |
| gh | GitHub CLI (code search) | apt install gh |
Use a fresh, high-quality resolver list for puredns:
https://github.com/trickest/resolvers
# Clone the repository
git clone https://github.com/prakhar0x01/approach.git
cd approach
# Make executable
chmod +x approach.sh
# Option A: Run from current directory
./approach.sh -h
# Option B: Install globally
cp approach.sh /usr/local/bin/approach
approach -hInstall all Go-based tools at once:
./approach.sh -freshThis runs go install for all core tools and updates nuclei templates.
Open approach.sh and update the config block at the top:
# ─── CONFIG ──────────────────────────────────────────────────
WORDLIST="/path/to/your/wordlist.txt"
API_WORDLIST="/path/to/api_wordlist.txt"
NUCLEI_TEMPLATES="/path/to/nuclei-templates"
RESOLVERS="/path/to/resolvers.txt"
THREADS=50
RATE_LIMIT=100
# Optional — leave blank to skip that feature
SHODAN_API_KEY=""
ANTHROPIC_API_KEY=""
NOTIFY_DISCORD_WEBHOOK=""
GITHUB_TOKEN=""Recommended wordlists:
- Content discovery: SecLists/Discovery/Web-Content/raft-large-words.txt
- API discovery: SecLists/Discovery/Web-Content/api/
- Parameters: SecLists/Discovery/Web-Content/burp-parameter-names.txt
- Resolvers: trickest/resolvers
- Permutations:
permutations.txt(included in this repo)
Usage: ./approach.sh [options] <target>
─── Reconnaissance ───
-asn ASN & IP ranges + reverse IP lookup
-whois Reverse WHOIS — find sibling/acquired domains
-sb Subdomain enum (8 sources, parallel, resolve, probe)
-perm Permutation discovery (alterx — finds dev/staging/api-v2)
-dns DNS deep analysis (AXFR, SPF, DMARC, DKIM, wildcards)
-waf WAF detect + security headers + favicon Shodan hash
─── Surface Mapping ───
-ps Port scan (naabu → nmap, all owned IPs, 60+ ports)
-url URL harvest (gau + wayback + katana + uro)
-js JS analysis (katana + LinkFinder + trufflehog + wayback)
-D Dir bruteforce (ffuf + feroxbuster + API wordlist)
-param Param discovery (paramspider + x8 + JS param extraction)
─── Vulnerability Signals ───
-gf GF patterns (xss, sqli, ssrf, lfi, rce, idor, ssti...)
-cors CORS (reflect + null origin + subdomain origin bypass)
-403 403 bypass (header tricks + path normalization)
-tko Subdomain takeover (subzy + nuclei)
-vuln Nuclei (sweep + CVEs + DAST fuzzing)
─── Intel & Leaks ───
-check Detect login/admin/CI/monitoring/db/git panels
-cloud Cloud buckets + GitHub org secrets + wayback secrets
-shodan Shodan (org + SSL + SAN + favicon hash + history)
-ai AI scope parsing (needs program_brief.txt)
-triage AI triage of all recon output
─── Meta ───
-report Generate full markdown recon report
-full Full auto pipeline (everything, with authorization check)
-fresh Update all tools via go install
# Subdomain enumeration only
./approach.sh -sb target.com
# Full surface mapping pipeline
./approach.sh -sb -url -js -param target.com
# Vulnerability signals after recon
./approach.sh -gf -cors -403 -tko -vuln target.com
# Parse program brief with AI before touching target
echo "Program brief text..." > program_brief.txt
./approach.sh -ai target.com
# Run everything
./approach.sh -full target.com
# Chain multiple specific functions
./approach.sh -asn -sb -perm -dns -waf -ps target.comQueries BGPView for all ASNs owned by the organization, then fetches every IP prefix in those ASNs. Performs a reverse IP lookup on the main target to find co-hosted domains on the same server.
Why it matters: Companies own IP ranges that never appear in DNS. Staging servers, internal tools, and forgotten applications live inside ASN-owned IP space and are invisible to passive subdomain enumeration.
Output: subdomains/asns.txt, subdomains/ip_ranges.txt, subdomains/reverse_ip_hosts.txt
Queries ViewDNS for all domains registered by the same entity as the target.
Why it matters: Acquired companies, sister brands, and old domains share the same codebase but receive a fraction of the security scrutiny. These are soft targets.
Output: subdomains/reverse_whois.txt
Runs 8 passive sources in parallel — amass, subfinder, assetfinder, findomain, chaos, crt.sh, rapiddns, and AlienVault OTX. Merges results, deduplicates, resolves with puredns (wildcard-aware), and probes with httpx.
Also performs wildcard DNS detection — warns you if passive results may be polluted with false positives.
Output: subdomains/all_subs_raw.txt, subdomains/resolved.txt, subdomains/live_hosts.txt
Uses alterx to generate thousands of permuted subdomain variations (dev, api-v2, staging, us-prod, vault, jenkins, grafana...) against all resolved subdomains. Resolves with puredns. Computes a net-new diff — subdomains found by permutation that passive enumeration missed entirely.
Why it matters: Passive enumeration finds known hosts. Permutation finds hosts that were never indexed anywhere. api-v2.target.com and dev.target.com live here.
Output: subdomains/permuted.txt, subdomains/permuted_resolved.txt, subdomains/permuted_new_only.txt
Performs:
- Full DNS record dump (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA)
- Zone transfer (AXFR) attempts on every nameserver
- SPF record audit — detects
+all(catastrophic) and~all(weak) - DMARC audit — detects absence and
p=none(non-enforcing) - DKIM check across common selectors
- Dangling CNAME detection against 12 known takeover-vulnerable services
- Wildcard DNS detection
Output: dns/dns_records.txt, dns/email_issues.txt, dns/email_security.txt, dns/dangling_cnames.txt
Detects WAF with wafw00f. Audits security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Computes favicon mmh3 hash for Shodan search.
Why the favicon hash matters: http.favicon.hash:<hash> on Shodan finds every instance of the same application globally — including unprotected instances running without a WAF in forgotten corners of the infrastructure.
Output: waf/wafw00f.txt, waf/headers.txt, waf/missing_headers.txt, waf/favicon.txt, waf/whatweb.json
Extracts all unique IPs from resolved subdomains and ASN ranges. Scans 60+ ports with naabu (speed), then runs nmap -sV -sC only on confirmed open ports (accuracy). Probes non-standard ports for HTTP services. Alerts on critical exposures (Elasticsearch :9200, Redis :6379, MongoDB :27017, Docker :2375, etc.).
Output: ports/all_ips.txt, ports/naabu_open.txt, ports/nmap_services.txt, ports/nonstandard_http.txt
Collects historical URLs via gau (Wayback + CommonCrawl + OTX) and waybackurls. Active crawl with katana (JS-rendering aware). Deduplicates with uro. Extracts parameterized URLs, API paths, and URLs with juicy file extensions (.bak, .env, .log, .sql, .key, .pem, etc.).
Output: urls/all_urls.txt, urls/param_urls.txt, urls/api_paths.txt, urls/interesting_extensions.txt
Crawls with katana (filters out vendor/library files). Downloads all custom JS files. Also downloads historical JS from Wayback Machine — secrets that were "deleted" months ago are still in the archive. Runs LinkFinder (endpoint extraction), SecretFinder (API key/token detection), and trufflehog --only-verified (zero false positives on secrets). Runs nuclei exposure templates.
Output: js/js_urls.txt, js/downloads/, js/linkfinder_endpoints.txt, js/secrets.txt, js/trufflehog.json
Runs ffuf (fast, auto-calibration), feroxbuster (recursive depth-3), ffuf with API-specific wordlist, and parallel dirsearch on top 20 live subdomains.
Output: urls/ffuf.json, urls/feroxbuster.txt, urls/ffuf_api.json
Runs paramspider and x8 (hidden parameter bruteforce). Performs parameter frequency analysis across all collected URLs. Extracts potential parameter names from JS files.
Output: params/paramspider.txt, params/x8_params.txt, params/param_frequency.txt, params/js_params.txt
Runs 13 gf patterns across the entire collected URL list: xss, sqli, ssrf, redirect, lfi, rce, idor, ssti, debug_logic, cors, upload-fields, interestingparams, img-traversal. Generates a summary of candidate counts per pattern.
Why it matters: This is the fastest triage step before manual testing. It separates signal from noise in seconds and tells you exactly which URLs to prioritize.
Output: patterns/gf_*.txt, patterns/gf_summary.txt
Tests three distinct CORS bypass scenarios:
- Reflected origin + credentials — sends
Origin: https://evil.com, checks if reflected withAccess-Control-Allow-Credentials: true(high severity) - Null origin bypass — sends
Origin: null, checks if the null origin is accepted - Subdomain origin trust — sends
Origin: https://evil.target.com, checks if any subdomain is trusted. If you have XSS on any subdomain, this becomes a critical chain.
Output: cors/cors_vulns.txt, cors/corsy_raw.txt
Collects all 403 URLs from ffuf output (or uses common admin paths as fallback). Tests 10 header-based bypasses (X-Original-URL, X-Forwarded-For, X-Real-IP, X-Host, etc.) and multiple path normalization variants (/..;/, %20, %09, uppercase path, %2f encoding). Alerts and notifies on any 200 response.
Output: vulns/403_urls.txt, vulns/403_bypasses.txt
Runs subzy and nuclei takeover templates against all resolved subdomains. Alerts and notifies on any vulnerable findings.
Output: vulns/subzy.txt, vulns/nuclei_takeovers.txt
Three-stage nuclei sweep:
- Broad sweep — exposures, misconfigurations, vulnerabilities, default logins
- CVE templates — critical and high severity CVEs
- DAST fuzzing — nuclei DAST templates on parameterized URLs
Output: vulns/nuclei_sweep.txt, vulns/nuclei_cves.txt, vulns/nuclei_dast.txt
Probes all live hosts for 11 panel categories: login/auth, admin panels, dashboards, API explorers (Swagger, GraphQL), dev/staging instances, CI/CD tools (Jenkins, GitLab, CircleCI), monitoring (Grafana, Kibana, Prometheus), database UIs (phpMyAdmin, Adminer), secret management (Vault, Keycloak), file managers, and git interfaces.
Output: urls/interesting_panels.txt
Enumerates S3, GCP, and Azure buckets using 16 keyword variations of the target name. Runs trufflehog against the GitHub organization for verified secrets. Runs GitHub code search dorks for passwords, API keys, tokens, and private keys. Scans downloaded Wayback JS files for verified secrets.
Output: cloud/cloud_interesting.txt, cloud/github_secrets.json, cloud/github_dorks.txt, cloud/wayback_secrets.json
Performs four Shodan queries: org search, SSL certificate CN search (finds internal domain names in certificates), SAN field search (reveals internal infrastructure), historical host data for the main IP, and favicon hash search to find every instance of the same application globally.
Requires SHODAN_API_KEY in config.
Output: ports/shodan_org.txt, ports/shodan_ssl.txt, ports/shodan_san.txt, ports/shodan_host.txt, ports/shodan_favicon.txt
Sends program_brief.txt to the Claude API (claude-sonnet). Extracts: in-scope assets, out-of-scope assets, prohibited test types, disclosure requirements, reward tiers, tech stack hints, red flags to avoid, and recommended first attack surfaces.
How to use:
# Paste your program brief into program_brief.txt
cat program_brief.txt
# Run AI scope parsing
./approach.sh -ai target.com
# Output is saved to scope_sheet.txt
cat scope_sheet.txtRequires ANTHROPIC_API_KEY in config.
Sends your recon output (live hosts, open ports, DNS records, GF pattern summary, nuclei findings) to Claude for intelligent analysis. Returns the top 5 attack surfaces to test first with exact reasoning, specific vulnerability classes and test steps for each, patterns suggesting weak spots, and what you're probably missing.
Run this after completing recon, before manual testing.
Requires ANTHROPIC_API_KEY in config.
Output: report/ai_triage.txt
Generates a structured markdown report summarizing all recon statistics, key findings, live hosts, critical nuclei results, GF pattern candidate counts, interesting panels, and a next steps checklist.
Output: report/recon_report.md
Every run creates a timestamped output directory:
recon-target.com-20250413-142300/
│
├── subdomains/
│ ├── all_subs_raw.txt — All subdomains from all sources
│ ├── resolved.txt — DNS-verified live subdomains
│ ├── live_hosts.txt — HTTP-probed live hosts with metadata
│ ├── permuted_new_only.txt — Net-new subdomains from permutation
│ ├── asns.txt — ASNs owned by org
│ ├── ip_ranges.txt — IP prefixes owned by org
│ └── reverse_whois.txt — Sibling domains via reverse WHOIS
│
├── dns/
│ ├── dns_records.txt — Full DNS dump
│ ├── email_security.txt — SPF, DMARC, DKIM records
│ ├── email_issues.txt — Missing or misconfigured email security
│ └── dangling_cnames.txt — Potential takeover candidates
│
├── waf/
│ ├── wafw00f.txt — WAF detection results
│ ├── headers.txt — HTTP response headers
│ ├── missing_headers.txt — Absent security headers
│ ├── favicon.txt — Favicon mmh3 hash for Shodan
│ └── whatweb.json — Tech stack fingerprint
│
├── ports/
│ ├── all_ips.txt — All unique IPs across subdomains
│ ├── naabu_open.txt — Open ports (ip:port format)
│ ├── nmap_services.txt — Service/version detection
│ ├── nonstandard_http.txt — HTTP on non-standard ports
│ └── shodan_*.txt — Shodan intelligence files
│
├── urls/
│ ├── all_urls.txt — All collected URLs (deduplicated)
│ ├── param_urls.txt — URLs with parameters
│ ├── api_paths.txt — API endpoint paths
│ ├── interesting_extensions.txt — Backup/config/secret files
│ └── interesting_panels.txt — Login/admin/monitoring panels
│
├── js/
│ ├── js_urls.txt — All JS file URLs
│ ├── downloads/ — Downloaded JS files (current + wayback)
│ ├── linkfinder_endpoints.txt — Extracted endpoints from JS
│ ├── secrets.txt — Potential secrets/keys
│ └── trufflehog.json — Verified secrets (trufflehog)
│
├── params/
│ ├── paramspider.txt — Discovered parameters
│ ├── x8_params.txt — Hidden parameters
│ ├── param_frequency.txt — Most common params across all URLs
│ └── js_params.txt — Parameters extracted from JS
│
├── patterns/
│ ├── gf_xss.txt — XSS candidate URLs
│ ├── gf_sqli.txt — SQLi candidate URLs
│ ├── gf_ssrf.txt — SSRF candidate URLs
│ ├── gf_*.txt — (13 patterns total)
│ └── gf_summary.txt — Count per pattern
│
├── cors/
│ ├── cors_vulns.txt — CORS vulnerabilities found
│ └── corsy_raw.txt — Raw corsy output
│
├── vulns/
│ ├── nuclei_sweep.txt — Broad nuclei findings
│ ├── nuclei_cves.txt — CVE findings
│ ├── nuclei_dast.txt — DAST fuzzing findings
│ ├── subzy.txt — Takeover results
│ ├── 403_urls.txt — 403 target URLs
│ └── 403_bypasses.txt — Successful 403 bypasses
│
├── cloud/
│ ├── cloud_interesting.txt — Open/interesting cloud storage
│ ├── github_secrets.json — Verified GitHub secrets
│ ├── github_dorks.txt — GitHub dork results
│ └── wayback_secrets.json — Historical secrets from Wayback JS
│
└── report/
├── summary.md — Run metadata
├── recon_report.md — Full generated report
└── ai_triage.txt — AI recon triage output
These are scenarios that standard automation frameworks miss. Approach covers all of them.
| Edge Case | Function | Why It Matters |
|---|---|---|
| IP ranges owned by org (not in DNS) | -asn |
Internal apps live here |
| Acquired company domains | -whois |
Same codebase, less scrutiny |
| Wildcard DNS false positives | -sb |
Silently poisons passive results |
| DNS zone transfer (AXFR) | -dns |
Critical info disclosure if it works |
SPF +all misconfiguration |
-dns |
Anyone can send email as the domain |
DMARC p=none (not enforcing) |
-dns |
Phishing attacks go unreported |
| Favicon hash → Shodan | -waf |
Finds other unprotected instances |
| Non-standard HTTP ports | -ps |
Admin panels hidden behind port 8888 etc. |
| Elasticsearch/Redis/MongoDB exposed | -ps |
Unauthenticated access, common P1 |
| Historical Wayback JS secrets | -js |
Deleted secrets live in archive forever |
| Permutation-discovered subdomains | -perm |
dev, api-v2, staging never indexed |
| URL file extensions (.bak/.env/.sql) | -url |
Configuration and backup file exposure |
| GF pattern pre-triage | -gf |
Instant signal from thousands of URLs |
| Null origin CORS bypass | -cors |
Commonly missed in manual testing |
| Subdomain origin CORS trust | -cors |
XSS anywhere + this = critical chain |
| Header-based 403 bypass | -403 |
Admin panels hiding behind 403 |
| Path normalization bypass | -403 |
/..;/ and %2f often bypass WAF rules |
| SSL SAN field → internal domains | -shodan |
Internal hostname disclosure |
| GitHub org secrets (verified) | -cloud |
Real credentials, zero false positives |
| Cloud bucket variations | -cloud |
target-dev, target-backup, target-infra |
Approach integrates with the Anthropic Claude API for two distinct purposes:
Before touching anything, feed the program brief to Claude:
# Save the program brief
cat > program_brief.txt << 'EOF'
[Paste your HackerOne/Bugcrowd program brief here]
EOF
# Parse with Claude
./approach.sh -ai target.comClaude extracts a structured one-page scope sheet covering: in-scope assets, out-of-scope, prohibited tests, disclosure requirements, reward tiers, tech hints, and recommended first attack surfaces.
After completing recon, run AI triage before starting manual testing:
./approach.sh -triage target.comClaude receives your live hosts, open ports, DNS records, GF summary, and nuclei findings, then returns prioritized attack surfaces with exact test steps, patterns suggesting weak spots, and what you're probably missing.
Both features require:
export ANTHROPIC_API_KEY="your_key_here"
# or set it in the config block inside approach.shSet your webhook URL in the config block to receive real-time alerts on critical findings:
NOTIFY_DISCORD_WEBHOOK="https://discord.com/api/webhooks/YOUR/WEBHOOK"Notifications fire automatically for: zone transfer success, no SPF/DMARC, takeover-vulnerable subdomains, CORS with credentials, null origin CORS bypass, 403 bypasses, exposed critical services (Elasticsearch, Redis, MongoDB, Docker), open cloud buckets, verified GitHub secrets, and permutation net-new discoveries.
Recommended order for a new target:
# 1. Parse scope first — before touching anything
./approach.sh -ai target.com
# 2. Intelligence gathering (who are you dealing with?)
./approach.sh -asn -whois -dns target.com
# 3. Asset discovery
./approach.sh -sb -perm target.com
# 4. Tech fingerprint + port scan
./approach.sh -waf -ps target.com
# 5. Surface mapping
./approach.sh -url -js -D -param target.com
# 6. Vulnerability signals
./approach.sh -gf -cors -403 -tko -vuln target.com
# 7. Intel and leaks
./approach.sh -check -cloud -shodan target.com
# 8. AI triage before manual testing
./approach.sh -triage target.com
# 9. Generate report
./approach.sh -report target.comOr run everything at once (requires authorization confirmation):
./approach.sh -full target.combasic_approach.md— Tips and one-liners for manual testing after reconpermutations.txt— Wordlist for permutation bruteforcing
GF Patterns:
- Install gf patterns:
git clone https://github.com/1ndianl33t/Gf-Patterns ~/.gf
Nuclei Templates:
- Official:
nuclei -update-templates - Community: https://github.com/projectdiscovery/nuclei-templates
Resolvers:
- trickest/resolvers — Updated daily, use
resolvers.txt
Notable Notes:
⚠️ Do not run-permblindly with a massive permutations wordlist against a large resolver list. It will take days. Start withpermutations.txtfrom this repo and expand deliberately.
⚠️ The-fullflag requires you to typeyesto confirm you have authorization. This is intentional and will not be removed.
⚠️ Configure all paths in the config block at the top ofapproach.shbefore running any function. The script will not work correctly with placeholder paths.
This tool is for authorized security testing only.
Only use Approach against targets for which you have explicit written authorization — either through a bug bounty program (HackerOne, Bugcrowd, Intigriti, etc.) or a signed penetration testing agreement.
Unauthorized use of this tool against systems you do not have permission to test is illegal in most jurisdictions and may result in criminal prosecution.
The author assumes no liability for any misuse of this tool. You are solely responsible for ensuring your testing is authorized, in scope, and compliant with the applicable program's rules of engagement.
Read the program brief. Stay in scope. Disclose responsibly.
Built with 💀 by Prakhar0x01
If this saved you time, star the repo.