SaaSquatch Resurrection

So long are the days when an organisation's internet presence was a mail server and 20 handcrafted PHP/Perl sites. Cloud became the next cult big thing and with it came SaaS. ACME corp was now splat across Workday, M365, Salesforce etc.

As a penetration tester / red teamer; no longer was IP and subdomain brute forcing sufficient - or you'd leave cards on the table and have a cranky stakeholder when they get popped. One must now make cloud go brrr. This was a thought I had in 2021 at an Australian cybersecurity services conglomerate, which turned into an internal tool called SaaSquatch.

She was as a single big-ah .py which had a "database" of SaaS DNS/HTTP endpoints, valid / invalid indicators and candidate positioning. As a basic example, to determine if $target had Atlassian cloud, it would hit this endpoint, and depending on the REGEX match, would confirm if it existed.

https://CANDIDATE.atlassian.net/|Log in or Sign Up|Page Unavailable|Atlassian

On internal release it checked 100+ cloud platforms (I joked in the README that it checked "over 3" - always underpromise overdeliver :P). It was quite handy to get a broader lay of the land. There were even some cheeky endpoints that would not only indicate which proxy provider they used - but would even grab the internal .pac file 👀

I'm long gone from the cyber conglomerate and bid farewell to SaaSquatch knowing I'd never see her again.

Seeing her Again

30 July 2026 I wake up to some old colleagues joshing that my tool had been nicked, dropping a link to: https://github.com/tantosec/saasquatch - same idea and name - spelling and all!

Through the very small Australian cyber grapevine I come to find that it was an independent clean room operation and that someone out there had the same brain I had. Not only in the idea, but combining SaaS and Sasquatch like you're searching for hairy mythical creatures on a client's perimeter.

Great brains think alike!