SQUIRM v2 — Scope-Aware Endpoint Triage

Streamlined Bash endpoint-collection pipeline: subdomains → responsive hosts → endpoints → JSON → entropy-assisted triage.

Usage boundaries

SQUIRM is intended for systems you own or are explicitly authorized to assess.

• Keep targets within the approved scope.
• Respect program rules, robots policies where applicable, and target rate limits.
• Use conservative concurrency and stop when a target shows instability.
• Do not use proxies to conceal origin, bypass controls, evade blocking, or distribute unauthorized traffic.
• Validate suspected findings manually before reporting severity or impact.

🚀 Quick Start

Install Dependencies

Ubuntu/Debian (apt):

sudo apt update && sudo apt install -y curl jq python3 python3-pip golang-go

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
pip3 install httpie

Arch Linux (pacman):

sudo pacman -Syu
sudo pacman -S curl jq python3 go httpie

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest

Then add Go binaries to PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Quick Setup

git clone https://github.com/whathehack81/squirm
cd squirm
chmod +x squirm.sh brain.sh
./squirm.sh -t example.com

📋 Usage

./squirm.sh -t target.com [OPTIONS]

Options:
  --target, -t DOMAIN        Authorized target domain
  --scope FILE               Authorized scope file, one domain per line
  --proxy URL                Inspection proxy, for example http://127.0.0.1:8080
  --out-dir DIR              Output directory (default: intel/)
  --fast                     Skip endpoint collection
  --entropy                  Enable entropy scanning for secret candidates
  --help, -h                 Show help

Examples

# Single authorized target, full collection
./squirm.sh -t example.com

# Fast mode without endpoint collection
./squirm.sh -t example.com --fast

# Include entropy-assisted candidate detection
./squirm.sh -t example.com --entropy

# Route through a local inspection proxy
./squirm.sh -t example.com --proxy http://127.0.0.1:8080

# Batch process an approved scope file
./squirm.sh --scope targets.txt

📊 Output Structure

intel/target.com/
├── raw/
│   ├── subdomains.txt
│   ├── alive.txt
│   ├── endpoints.txt
│   └── cleaned-endpoints.txt
├── classified/
│   ├── auth.txt
│   ├── platform.txt
│   ├── features.txt
│   └── frontend.txt
├── flags/
│   ├── entropy-input.txt
│   └── entropy-candidates.txt
└── report.json

🧠 SQUIRM Brain v2 — Endpoint Prioritization

The Brain system scores and prioritizes endpoints for analyst review:

./brain.sh target.com

Scoring system:

• 90+: critical-review candidate, such as SSRF or configuration exposure
• 80–89: high-review candidate, such as financial, admin, authentication, or IDOR-related surfaces
• 60–79: medium-review candidate, such as debug, staging, or non-production surfaces
• 25–59: low-priority generic endpoints
• 5–24: static assets
• 0–5: likely noise

Scores are prioritization signals, not confirmed vulnerability severity.

Output:

intel/target.com/brain-output.txt
intel/target.com/high-value.txt

🔧 Dependencies

Tool	Purpose	Source
subfinder	Subdomain enumeration	ProjectDiscovery
httpx	HTTP probing	ProjectDiscovery
katana	Endpoint crawling	ProjectDiscovery
gau	Historical URL collection	Tomnomnom
jq	JSON processing	jqlang
curl	HTTP requests	curl project
httpie	HTTP CLI	HTTPie
python3	Python runtime	Python
pip	Python package installation	PyPA

🎯 Processing stages

1. Enumeration: discover subdomains.
2. Probing: identify responsive hosts.
3. Collection: gather current and historical endpoints.
4. Cleaning: filter noise and deduplicate results.
5. Classification: categorize and prioritize endpoints.
6. Analysis: identify entropy-based secret candidates.
7. Reporting: generate structured output for analyst review.

⚡ Operational guidance

• Use --fast for lower-impact initial collection.
• Run entropy analysis separately for very large datasets.
• Batch only domains listed in the approved scope.
• Use a local proxy for inspection, logging, and debugging—not to bypass controls.
• Add delays or reduce concurrency when the target requires stricter rate limits.

🐍 Python Version (In Development)

A Python rewrite is in progress with:

• Contract-based module architecture
• Enhanced classification algorithms
• Improved performance and concurrency controls
• Type-hinted code

Maintainer and intent

SQUIRM is created and maintained by Rob (whathehack81) as a practical way to turn broad authorized collection into a smaller, structured analyst queue.

It does not claim that an endpoint is vulnerable. It helps organize what deserves human attention next. That distinction—discovery is not validation—is central to both SQUIRM and Casper.

🤝 Contributing

Found a bug or have a suggestion? Open an issue or submit a pull request.

Current focus:

• Python module refactoring
• Performance and rate-control improvements
• Classification improvements
• Safer defaults and reproducible validation

📄 License

MIT License. See LICENSE.

---

Last updated: 2026-07-13 · Status: Active development