Apex CLI — C++ Edition

Features

Maturity Levels

Level 0: None → No scanning
Level 1: Basic → Core vulnerability detection (SQLi, XSS)
Level 2: Standard → + CMS detection, OSINT basics
Level 3: Advanced → + Deep scanning, compliance mapping
Level 4: Expert → + Continuous monitoring, auto-remediation
Level 5: Excellent → + Full traceability, zero tolerance

Build

# macOS
brew install curl
# Ubuntu/Debian
sudo apt-get install libcurl4-openssl-dev
# Build
make build

Usage

# Basic scan with maturity score
./build/apex-cli example.com
# Bug bounty pipeline (recommended)
./build/apex-cli example.com --pipeline
# Pipeline with HackerOne program check
./build/apex-cli example.com --pipeline --program shopify
# Smart mode (14x faster, only relevant scanners)
./build/apex-cli example.com --smart
# Only confirmed findings (no noise)
./build/apex-cli example.com --smart --confidence 3
# Continuous monitoring (diff against previous scan)
./build/apex-cli example.com --watch --watch-interval 21600
# Compare against baseline
./build/apex-cli example.com --smart --baseline scans/previous/report.json
# Deep scan with CMS detection
./build/apex-cli example.com --deep --threads 200
# Authenticated scanning
./build/apex-cli example.com --pipeline --cookie "session=abc123"
./build/apex-cli example.com --pipeline --auth-header "Bearer tok"
# OSINT reconnaissance
./build/apex-cli example.com --osint
# SSH-based kernel/OS audit
./build/apex-cli example.com --ssh user@example.com --ssh-key ~/.ssh/id_ed25519
# Skip specific scanners
./build/apex-cli example.com --skip "DNS Brute-Force,Param Brute-Force"
# Dry run (no packets sent)
./build/apex-cli example.com --dry-run

Bug Bounty Workflow

# Step 1: Pre-hunt intelligence
./scripts/bounty-recon.sh shopify
# Step 2: Daily security briefing
./scripts/security-digest.sh
# Step 3: Scan with duplicate detection
./build/apex-cli https://target.com --pipeline --program shopify
# Step 4: Audit open source repos
git clone https://github.com/Shopify/hydrogen.git
cd hydrogen && cpm
# Step 5: Continuous monitoring
./build/apex-cli https://target.com --watch --watch-interval 21600

Pipeline Output

🟢 SUBMIT THESE (3):
 [critical] SSRF → Cloud Metadata
 URL: https://app.target.com/proxy?url=
 OWASP: A10:2021 SSRF
 Impact: Internal network access, cloud credential theft
 Chain: SSRF → AWS metadata → IAM creds → full account takeover
 Ref: PortSwigger SSRF Labs, WAHH Ch.10
🟡 VERIFY FIRST (2) — check hacktivity before submitting
🔴 SKIP (5) — likely duplicates

Scripts

Configure maturity target

Edit apex.toml: target_level = 3

## Configuration
```toml
# apex.toml
[maturity]
target_level = 3 # Aim for "Advanced"
[enforcement]
mode = "guide" # learn | guide | guard | enforce
[thresholds]
max_critical = 0
max_high = 5
max_medium = 20
[scanners]
skip = []
required = ["SQLi", "XSS", "CMS Detection"]
[compliance]
frameworks = ["OWASP", "CWE"]

Flags

Scanners

Vulnerability Detection

CMS Detection (50+ platforms)

OSINT Intelligence

Architecture

src/
 main.cpp — CLI entry point and orchestration
 config.hpp — Configuration types
 http.hpp/cpp — HTTP client (libcurl, TLS, UA rotation)
 scanner.hpp/cpp — Scanner framework and implementations
 cms_detector.hpp/cpp — CMS fingerprinting and versioning
 osint.hpp/cpp — OSINT reconnaissance
 recon.hpp/cpp — Subdomain enumeration and probing
 reporter.hpp/cpp — JSON and terminal reporting
tests/
 test_main.cpp — Unit tests

Output Files

Reports

JSONL History (append-only)

# View all findings
./scripts/query_recon.sh ./output
# Find outdated CMS
jq 'select(.outdated == true)' output/cms_recon.jsonl
# Critical leaks
jq 'select(.severity == "critical")' output/osint_recon.jsonl
# Timeline
jq -r '"\(.timestamp) | \(.type)"' output/vuln_recon.jsonl | tail -50

Development

make check # format + lint + build + test
make format # clang-format
make lint # cppcheck
make test # run tests
make clean # remove build artifacts

License