🪜 Cascade

Bug Bounty Recon Pipeline — nine tools, one click, one ranked list of what to check first.

Point it at a domain and Cascade runs subfinder, amass, httpx, gau, katana, ffuf, nuclei, wafw00f, and gowitness as one managed pipeline — then a Priority Engine ranks every finding by severity, with the reasoning spelled out in plain language. No API keys. No sign-ups. One Windows app, click and run.

⬇️ Install · ✨ Features · 📖 How to Use · 🎛️ Menu guide · ⚠️ Disclaimer

---

Important

Educational & Defensive Security Research Disclaimer
This project is developed strictly for educational purposes, defensive security research, and authorized bug bounty scope testing. The developer (@n0xnull) does not condone or support unauthorized scanning or malicious activities. Users are solely responsible for complying with target program policies and applicable laws. See DISCLAIMER.md for full terms.

🇮🇩 Baca dalam Bahasa Indonesia

Cascade — Pipeline Rekon Bug Bounty

Cascade adalah aplikasi Windows desktop yang mengorkestrasi sembilan tool rekon bug bounty (subfinder, amass, httpx, gau, katana, ffuf, nuclei, wafw00f, gowitness) dalam satu pipeline terpadu — satu klik, satu daftar temuan terurut.

Setiap tahap melaporkan status eksplisit (ok/partial/skipped/failed — tidak pernah gagal diam-diam). Priority Engine menggabungkan semua sinyal menjadi satu daftar berperingkat dengan alasan plaintext di tiap item.

Laporan: HTML mandiri, Excel multi-sheet (dengan thumbnail screenshot), JSON, dan CSV per tahap. Scan bisa dilanjutkan dari tahap yang gagal tanpa mengulang dari awal.

⚠️ Hanya untuk target dalam scope program bug bounty atau sistem milik sendiri. Lihat DISCLAIMER.md.

🧩 The Problem

Real bug bounty recon means chaining eight-plus command-line tools by hand: remembering flags, babysitting timeouts, re-running the ones that silently failed, and manually cross-referencing subdomains against live hosts, WAF status, origin IPs, and fuzzing hits before you even know what's worth looking at. A single missed flag or a tool that "succeeds" with zero output means you quietly miss a finding — this happened for real during a live recon run this project was built to fix (see CONCEPT.md and CHANGELOG.md for the actual bugs found and fixed).

Cascade wraps the whole chain in one desktop app: every stage reports an explicit status (ok/partial/skipped/failed — never silently missing), and a Priority Engine merges every signal into one ranked list with a human-readable reason attached to each item.

✨ Key Features

• 🧬 8 managed stages — subdomain enumeration, live host discovery, passive URL archiving + JS secret-scanning, WAF detection & screenshots, CDN-aware origin-IP check, JS endpoint extraction, directory fuzzing, nuclei vulnerability scan.
• 🥇 Priority Engine — merges every stage's signals into one severity-ranked list, every item with a plain-language reason.
• 📋 Findings Tracker — track each finding's workflow status (New → Verifying → Reported → Accepted/Rejected/Paid) right inside the app.
• 🛰️ CDN-aware origin-IP detection — cross-checks multiple signals instead of assuming Cloudflare; a provider with no verified IP range data is flagged "can't be concluded" instead of silently guessing.
• 🪟 Built for Windows properly — Win32 Job Objects guarantee child processes (e.g. the Chrome instance gowitness spawns) actually die on cancel, and a concurrency governor prevents socket exhaustion on large domains.
• ♻️ Resume failed scans — re-run only the stages that failed or were skipped, without starting over.
• 📊 Full reporting — reopenable JSON, multi-sheet Excel (with embedded screenshot thumbnails), self-contained HTML, and per-stage CSV.
• 💽 Installer or portable — pick a proper Start Menu install, or run from a folder with nothing written elsewhere.
• 🌍 Bilingual — Indonesian / English UI.
• 🔒 No telemetry — nothing is ever sent anywhere.

🖼️ Screenshots

Main window — target, scan profile, consent gate, live tool status, and progress/log, all in one view.

💻 System Requirements

	Minimum
OS	Windows 10 or 11, 64-bit (Qt 6 dropped Windows 7/8)
RAM	2 GB
Disk	~200 MB free (app only — recon tools installed separately)
Network	Internet connection for the recon tools themselves

Cross-platform note: the code also runs on Linux/macOS from source (python main.py), but official binaries are Windows-only for now.

⬇️ Installation

For users (recommended)

Two options — pick whichever suits you:

1. Go to Releases.
2. Installer — download CascadeSetup-<version>.exe, run it, get a Start Menu shortcut and a proper uninstaller. (Recommended for most people.)
3. Portable — download Cascade-Portable-<version>.zip, extract, run Cascade.exe directly. No install, no admin rights needed.

First launch may show Windows SmartScreen because the build isn't code-signed. Click More info → Run anyway. Verify integrity with the published .sha256.txt checksum next to each download.

4. Install the recon tools — see TOOLS_INSTALL_GUIDE.md. Cascade opens fine with zero tools installed; any stage whose tool is missing is skipped with an explicit status, not a silent failure.

For developers (run from source)

git clone https://github.com/n0xnull/Cascade.git
cd Cascade
python -m venv .venv && .venv\Scripts\activate     # Windows
pip install -r requirements.txt
python main.py

Build the .exe yourself

:: Windows, one click:
build.bat
:: -> dist\Cascade\Cascade.exe (already a portable folder, --onedir)

Manual equivalent:

pip install -r requirements-dev.txt
pytest tests/ -q
pyinstaller cascade.spec --noconfirm --clean

Build the installer yourself

:: Requires Inno Setup 6 (https://jrsoftware.org/isdl.php) and build.bat done first:
build-installer.bat
:: -> dist\CascadeSetup-<version>.exe

Pushing a version tag (git tag v1.0.0 && git push origin v1.0.0) triggers .github/workflows/build.yml — GitHub Actions builds on a Windows runner, runs all 59 unit tests (a failing test blocks the release), and publishes both artifacts to a GitHub Release automatically.

📖 How to Use

1. Type a target domain (e.g. example.com), or import a .txt list for batch mode.
2. Pick a profile — Quick (fast triage), Standard (equivalent to the original script's -FastOnly), Deep (full 8-stage pipeline), or Custom.
3. Check the consent box — confirms you have lawful authorization to test this target. Cascade refuses to start without it, in both the GUI and CLI.
4. Click Start Scan. Watch live progress/log and the Pipeline Preview (the exact command run for every tool). Stop any time.
5. Browse per-stage result tabs, then open Priorities for the severity-ranked findings list, or Findings Tracker to log workflow status per finding.
6. Reports save automatically (scan_<domain>_<timestamp>.json + .xlsx / .html / CSV) — the exact folder is shown in the status bar. Saved scans can be reopened, and failed stages re-run without starting over.

What Each Menu Does (beginner hints)

Menu	What it does
File ▸ New Scan	Clear results and start a fresh target.
File ▸ Open Saved Scan	Reopen a previously saved scan_*.json.
File ▸ Export	Re-export the current result as JSON/XLSX/HTML/CSV to a folder of your choice.
Settings ▸ Language / Theme	Indonesian / English, dark / light.
Tools ▸ Update Tools/Templates	Refresh the tool-availability check (e.g. after installing subfinder).
Help ▸ Disclaimer / Licenses / About	Terms of use, third-party licenses, credits.

Command line (optional)

Cascade.exe --domain example.com --profile deep --i-am-authorized

--i-am-authorized is mandatory — same consent gate as the GUI checkbox. Run Cascade.exe --help for the full option list (resume, custom stages, etc).

⚙️ How it Works

target domain
  → subdomain enumeration (subfinder + amass + crt.sh, wildcard-DNS aware)
  → live host discovery (httpx: status/title/tech/CDN)
  → passive URL archiving (gau) → sensitive-file tier + JS secret-scan
  → WAF detection (wafw00f, per-host) + screenshots (gowitness)
  → CDN-aware origin-IP check (bypass detection, not Cloudflare-only)
  → JS endpoint extraction (katana)
  → directory fuzzing (ffuf)
  → nuclei vulnerability scan
  → Priority Engine (merges every signal, severity-ranked, reasons attached)
  → reports (JSON / XLSX / HTML / CSV)

Every stage runs as a real subprocess with an argv list (never a shell string — this is what makes Windows paths-with-spaces safe by construction, not by special-casing), reports one of eight explicit statuses no matter what happens, and is wrapped so a single stage crashing never takes down the rest of the pipeline. See CONCEPT.md for the full design rationale and every real bug this fixed compared to the original PowerShell script it replaced.

🗺️ Roadmap

• v1.1 — richer nuclei template management from within the GUI, scan diffing (what changed since the last run on this domain).
• v1.2 — PDF export, custom report branding.
• v2.0 — plugin-style custom stages without touching the orchestrator.

🤝 Contributing

Issues and PRs welcome. Adding a new stage is one new file under engine/stages/ implementing BaseStage plus one line in engine/registry.py — the orchestrator needs no other change.

🛠️ Third-Party Tools

Cascade does not bundle subfinder, amass, httpx, gau, katana, ffuf, nuclei, or gowitness — it detects and calls whatever you've installed yourself (see TOOLS_INSTALL_GUIDE.md), so you always get the latest version straight from each project's own release. wafw00f is the one exception (used as a Python library) and is bundled. See THIRD-PARTY-LICENSES.md for every tool and library's license.

⚠️ Disclaimer

For authorized security testing only. Scan only domains you own or have explicit permission to test — an official bug bounty program's scope or written authorization. See DISCLAIMER.md.

📄 License

MIT © 2026 Abil Khosim. Third-party tools and libraries remain the property of their respective owners.

---

👤 Developed by Abil Khosim

Cybersecurity Specialist

Cascade is an original project by Abil Khosim, an independent security tool by Abil Khosim (NoxNull). Released under the MIT License — © 2026 Abil Khosim. Please keep this attribution when reusing or redistributing.

_{Bugs don't wait for the water to clear. 🪜}