External/websec-audit
1
0
Fork 0
mirror of https://github.com/davidalvarezp/websec-audit.git synced 2026-06-23 11:48:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
9c72c58a88c8deceed9799e42781a9b8e6fa0f50
websec-audit/websec-audit.sh
T

2534 lines
115 KiB
Bash
Raw Normal View History

v1.0.1
2026-03-23 11:10:48 +01:00
#!/usr/bin/env bash
# =============================================================================
#
# websec-audit.sh — Professional Web Security Audit Framework
#
# Author : davidalvarezp (https://davidalvarezp.com)
# Version : 1.0.1
# License : MIT
# GitHub : https://github.com/davidalvarezp/websec-audit
#
# LEGAL NOTICE:
# This tool is intended for authorized security assessments only.
# Unauthorized use against systems you do not own or have explicit
# written permission to test is illegal and unethical.
# The author assumes no liability for misuse of this software.
#
# =============================================================================
set -euo pipefail
IFS=$'\n\t'
# ─────────────────────────────────────────────────────────────────────────────
# CONSTANTS & METADATA
# ─────────────────────────────────────────────────────────────────────────────
readonly TOOL_NAME="websec-audit"
readonly TOOL_VERSION="1.0.1"
readonly TOOL_AUTHOR="davidalvarezp"
readonly TOOL_URL="https://github.com/davidalvarezp/websec-audit"
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
readonly DATE_HUMAN="$(date '+%Y-%m-%d %H:%M:%S')"
readonly AUDIT_PID=$$
# ─────────────────────────────────────────────────────────────────────────────
# ANSI COLOR PALETTE
# ─────────────────────────────────────────────────────────────────────────────
readonly C_RED='\033[0;31m'
readonly C_GREEN='\033[0;32m'
readonly C_YELLOW='\033[1;33m'
readonly C_BLUE='\033[0;34m'
readonly C_CYAN='\033[0;36m'
readonly C_MAGENTA='\033[0;35m'
readonly C_BOLD='\033[1m'
readonly C_DIM='\033[2m'
readonly C_RESET='\033[0m'
# ─────────────────────────────────────────────────────────────────────────────
# RUNTIME VARIABLES (set via parse_args, never hardcode below)
# ─────────────────────────────────────────────────────────────────────────────
TARGET=""
TARGET_DOMAIN=""
TARGET_IP=""
TARGET_SCHEME=""
OUTPUT_DIR=""
LOG_FILE=""
REPORT_HTML=""
REPORT_JSON=""
REPORT_TXT=""
FINDINGS_JSONL=""
# Module toggles (1 = enabled)
MOD_RECON=1
MOD_PORTSCAN=1
MOD_FINGERPRINT=1
MOD_SSL=1
MOD_HEADERS=1
MOD_DIRBRUTE=1
MOD_NIKTO=1
MOD_SQLI=1
MOD_XSS=1
MOD_CMS=1
MOD_CORS=1
MOD_REDIRECT=1
MOD_SSRF=1
MOD_SUBTAKEOVER=1
MOD_NUCLEI=1
# Scan options
OPT_THREADS=10
OPT_TIMEOUT=10
OPT_DEPTH=3
OPT_PORTS="top-1000" # top-100 | top-1000 | full
OPT_AGGRESSIVE=0
OPT_STEALTH=0
OPT_PROXY=""
OPT_VERBOSE=0
OPT_NO_COLOR=0
OPT_NO_BANNER=0
OPT_OUTPUT_ONLY="" # json | html | txt (empty = all)
# Wordlists (can be overridden via --wl-* flags)
WL_DIRS_SMALL="/usr/share/wordlists/dirb/common.txt"
WL_DIRS_BIG="/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
WL_DNS="/usr/share/wordlists/dnsmap.txt"
# Finding counters
TOTAL_FINDINGS=0
COUNT_CRITICAL=0
COUNT_HIGH=0
COUNT_MEDIUM=0
COUNT_LOW=0
COUNT_INFO=0
# Timer
AUDIT_START_TIME=0
# ─────────────────────────────────────────────────────────────────────────────
# BANNER
# ─────────────────────────────────────────────────────────────────────────────
print_banner() {
[[ $OPT_NO_BANNER -eq 1 ]] && return
echo -e "${C_CYAN}${C_BOLD}"
cat << 'BANNER'
╦ ╦┌─┐┌┐ ╔═╗┌─┐┌─┐ ╔═╗┬ ┬┌┬┐┬┌┬┐
║║║├┤ ├┴┐╚═╗├┤ │ ╠═╣│ │ │││ │
╚╩╝└─┘└─┘╚═╝└─┘└─┘ ╩ ╩└─┘─┴┘┴ ┴
BANNER
echo -e "${C_RESET}"
printf " %s Professional Web Security Audit Framework\n" "${C_BOLD}"
printf " Version %-8s Author: %s%s\n" "${TOOL_VERSION}" "${TOOL_AUTHOR}" "${C_RESET}"
printf " %s%s%s\n\n" "${C_DIM}" "${TOOL_URL}" "${C_RESET}"
echo -e " ${C_DIM}─────────────────────────────────────────────────${C_RESET}"
echo ""
}
# ─────────────────────────────────────────────────────────────────────────────
# HELP
# ─────────────────────────────────────────────────────────────────────────────
print_usage() {
cat << USAGE
${C_BOLD}USAGE${C_RESET}
$(basename "$0") -t <target> [options]
${C_BOLD}REQUIRED${C_RESET}
-t, --target <url|ip> Target URL or IP address
Examples: https://target.com | 192.168.1.1
${C_BOLD}OUTPUT${C_RESET}
-o, --output <dir> Output directory (default: ./results_<domain>_<ts>)
--format <fmt> Report format: json | html | txt | all (default: all)
${C_BOLD}SCAN OPTIONS${C_RESET}
-T, --threads <n> Concurrent threads (default: 10)
-p, --ports <profile> Port profile: top-100 | top-1000 | full (default: top-1000)
--timeout <s> Connection timeout in seconds (default: 10)
--depth <n> Crawl depth (default: 3)
--proxy <url> HTTP/HTTPS proxy (e.g. http://127.0.0.1:8080)
--aggressive Aggressive mode — deeper scans, more noise
--stealth Stealth mode — slower, lower detection footprint
${C_BOLD}MODULE CONTROL${C_RESET}
--skip-recon Skip reconnaissance (WHOIS, DNS, subdomains)
--skip-portscan Skip port scanning (nmap)
--skip-fingerprint Skip web fingerprinting
--skip-ssl Skip SSL/TLS analysis
--skip-headers Skip HTTP security headers check
--skip-dirbrute Skip directory/file brute-forcing
--skip-nikto Skip Nikto web scanner
--skip-sqli Skip SQL injection tests (sqlmap)
--skip-xss Skip XSS tests (dalfox)
--skip-cms Skip CMS detection and scanning
--skip-cors Skip CORS misconfiguration tests
--skip-redirect Skip open redirect tests
--skip-ssrf Skip SSRF tests
--skip-subtakeover Skip subdomain takeover checks
--skip-nuclei Skip Nuclei template scanning
${C_BOLD}WORDLISTS${C_RESET}
--wl-dirs-small <file> Small wordlist for directory brute-force
--wl-dirs-big <file> Large wordlist for directory brute-force
--wl-dns <file> Wordlist for DNS subdomain enumeration
${C_BOLD}MISC${C_RESET}
-v, --verbose Verbose output
--no-color Disable ANSI color output
--no-banner Suppress banner
-h, --help Show this help message
-V, --version Show version information
${C_BOLD}EXAMPLES${C_RESET}
$(basename "$0") -t https://target.com
$(basename "$0") -t https://target.com --aggressive -T 20 -o /tmp/audit
$(basename "$0") -t https://target.com --stealth --proxy http://127.0.0.1:8080
$(basename "$0") -t https://target.com --skip-nikto --skip-sqli --format json
$(basename "$0") -t https://target.com --ports full --depth 5 -v
USAGE
}
# ─────────────────────────────────────────────────────────────────────────────
# LOGGING ENGINE
# ─────────────────────────────────────────────────────────────────────────────
_ts() { date '+%H:%M:%S'; }
log_info() {
local msg="[$(_ts)] [INFO] $1"
[[ $OPT_NO_COLOR -eq 0 ]] && echo -e "${C_BLUE}${msg}${C_RESET}" || echo "$msg"
echo "$msg" >> "$LOG_FILE"
}
log_ok() {
local msg="[$(_ts)] [OK] $1"
[[ $OPT_NO_COLOR -eq 0 ]] && echo -e "${C_GREEN}${msg}${C_RESET}" || echo "$msg"
echo "$msg" >> "$LOG_FILE"
}
log_warn() {
local msg="[$(_ts)] [WARN] $1"
[[ $OPT_NO_COLOR -eq 0 ]] && echo -e "${C_YELLOW}${msg}${C_RESET}" || echo "$msg"
echo "$msg" >> "$LOG_FILE"
}
log_error() {
local msg="[$(_ts)] [ERROR] $1"
[[ $OPT_NO_COLOR -eq 0 ]] && echo -e "${C_RED}${msg}${C_RESET}" || echo "$msg"
echo "$msg" >> "$LOG_FILE"
}
log_verbose() {
[[ $OPT_VERBOSE -eq 0 ]] && return
local msg="[$(_ts)] [VERBOSE] $1"
echo -e "${C_DIM}${msg}${C_RESET}"
echo "$msg" >> "$LOG_FILE"
}
log_finding() {
local severity="$1"; shift
local msg="[$(_ts)] [${severity}]"
# pad severity label
case "${#severity}" in
4) msg="[$(_ts)] [${severity}] $1" ;;
3) msg="[$(_ts)] [${severity}] $1" ;;
6) msg="[$(_ts)] [${severity}] $1" ;;
8) msg="[$(_ts)] [${severity}] $1" ;;
*) msg="[$(_ts)] [${severity}] $1" ;;
esac
local color="$C_RESET"
case "$severity" in
CRITICAL) color="${C_RED}${C_BOLD}" ;;
HIGH) color="${C_MAGENTA}${C_BOLD}" ;;
MEDIUM) color="$C_YELLOW" ;;
LOW) color="$C_CYAN" ;;
INFO) color="$C_DIM" ;;
esac
[[ $OPT_NO_COLOR -eq 0 ]] && echo -e "${color}${msg}${C_RESET}" || echo "$msg"
echo "$msg" >> "$LOG_FILE"
}
log_section() {
local title="$1"
local line="══════════════════════════════════════════════════════════════"
local inner=" ▸ ${title}"
echo "" | tee -a "$LOG_FILE"
if [[ $OPT_NO_COLOR -eq 0 ]]; then
echo -e "${C_CYAN}${C_BOLD}${line}${C_RESET}" | tee -a "$LOG_FILE"
echo -e "${C_CYAN}${C_BOLD}${inner}${C_RESET}" | tee -a "$LOG_FILE"
echo -e "${C_CYAN}${C_BOLD}${line}${C_RESET}" | tee -a "$LOG_FILE"
else
echo "$line" | tee -a "$LOG_FILE"
echo "$inner" | tee -a "$LOG_FILE"
echo "$line" | tee -a "$LOG_FILE"
fi
echo "" | tee -a "$LOG_FILE"
}
log_subsection() {
local title="$1"
local line=" ────────────────────────────────────────"
echo "" | tee -a "$LOG_FILE"
if [[ $OPT_NO_COLOR -eq 0 ]]; then
echo -e "${C_BLUE}${C_BOLD}${line}${C_RESET}" | tee -a "$LOG_FILE"
echo -e "${C_BLUE}${C_BOLD} ● ${title}${C_RESET}" | tee -a "$LOG_FILE"
echo -e "${C_BLUE}${C_BOLD}${line}${C_RESET}" | tee -a "$LOG_FILE"
else
echo "$line" | tee -a "$LOG_FILE"
echo " [+] $title" | tee -a "$LOG_FILE"
echo "$line" | tee -a "$LOG_FILE"
fi
echo "" | tee -a "$LOG_FILE"
}
# ─────────────────────────────────────────────────────────────────────────────
# FINDING REGISTRY
# ─────────────────────────────────────────────────────────────────────────────
# add_finding <SEVERITY> <MODULE> <TITLE> <DESCRIPTION> [EVIDENCE] [RECOMMENDATION]
add_finding() {
local severity="${1:-INFO}"
local module="${2:-UNKNOWN}"
local title="${3:-Untitled finding}"
local description="${4:-}"
local evidence="${5:-}"
local recommendation="${6:-}"
# Increment counters
TOTAL_FINDINGS=$((TOTAL_FINDINGS + 1))
case "$severity" in
CRITICAL) COUNT_CRITICAL=$((COUNT_CRITICAL + 1)) ;;
HIGH) COUNT_HIGH=$((COUNT_HIGH + 1)) ;;
MEDIUM) COUNT_MEDIUM=$((COUNT_MEDIUM + 1)) ;;
LOW) COUNT_LOW=$((COUNT_LOW + 1)) ;;
INFO) COUNT_INFO=$((COUNT_INFO + 1)) ;;
esac
# Console output
log_finding "$severity" "[${module}] ${title}"
[[ -n "$description" ]] && printf " ↳ %s\n" "$description" | tee -a "$LOG_FILE"
[[ -n "$evidence" ]] && printf " ↳ Evidence: %s\n" "$evidence" | tee -a "$LOG_FILE"
[[ -n "$recommendation" ]] && printf " ↳ Fix: %s\n" "$recommendation" | tee -a "$LOG_FILE"
# Escape for JSON
local j_title j_desc j_evid j_rec
j_title=$(printf '%s' "$title" | sed 's/\\/\\\\/g; s/"/\\"/g; s/ / /g')
j_desc=$(printf '%s' "$description" | sed 's/\\/\\\\/g; s/"/\\"/g; s/ / /g')
j_evid=$(printf '%s' "$evidence" | sed 's/\\/\\\\/g; s/"/\\"/g; s/ / /g')
j_rec=$(printf '%s' "$recommendation" | sed 's/\\/\\\\/g; s/"/\\"/g; s/ / /g')
printf '{"id":%d,"severity":"%s","module":"%s","title":"%s","description":"%s","evidence":"%s","recommendation":"%s","timestamp":"%s"}\n' \
"$TOTAL_FINDINGS" "$severity" "$module" \
"$j_title" "$j_desc" "$j_evid" "$j_rec" \
"$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
>> "$FINDINGS_JSONL"
}
# ─────────────────────────────────────────────────────────────────────────────
# UTILITY FUNCTIONS
# ─────────────────────────────────────────────────────────────────────────────
has_tool() { command -v "$1" &>/dev/null; }
require_tool(){ has_tool "$1" && return 0; log_warn "Tool '$1' not found — skipping related checks."; return 1; }
strip_scheme() { echo "$1" | sed -E 's|^https?://||' | cut -d'/' -f1; }
get_scheme() { echo "$1" | grep -oP '^https?'; }
elapsed_secs() { echo $(( $(date +%s) - AUDIT_START_TIME )); }
is_https() { [[ "$TARGET_SCHEME" == "https" ]]; }
url_encode() {
python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$1" 2>/dev/null || \
printf '%s' "$1" | od -An -tx1 | tr ' ' '%' | tr -d '\n'
}
resolve_ip() {
host "$1" 2>/dev/null | grep "has address" | head -1 | awk '{print $NF}' || \
dig +short A "$1" 2>/dev/null | head -1 || echo ""
}
# curl wrapper with audit-wide settings
_curl() {
local args=(
-sk
--max-time "$OPT_TIMEOUT"
-A "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
--retry 2
--retry-delay 1
)
[[ -n "$OPT_PROXY" ]] && args+=(-x "$OPT_PROXY")
curl "${args[@]}" "$@"
}
# Run a command with timeout, capture output to file, return exit code
run_tool() {
local label="$1" outfile="$2"; shift 2
log_verbose "Running: $*"
timeout "${OPT_TIMEOUT}s" "$@" > "$outfile" 2>&1
local rc=$?
[[ $rc -eq 0 ]] && log_verbose "Completed: $label" || log_verbose "Timeout/error ($rc): $label"
return $rc
}
init_output_dir() {
local safe_domain
safe_domain=$(echo "$TARGET_DOMAIN" | tr '/:.' '_' | tr -cd '[:alnum:]_-')
if [[ -z "$OUTPUT_DIR" ]]; then
OUTPUT_DIR="${SCRIPT_DIR}/results_${safe_domain}_${TIMESTAMP}"
fi
mkdir -p "${OUTPUT_DIR}"/{logs,recon,portscan,ssl,headers,dirs,vulns,cms,misc,reports}
LOG_FILE="${OUTPUT_DIR}/logs/audit_${TIMESTAMP}.log"
REPORT_HTML="${OUTPUT_DIR}/reports/report_${TIMESTAMP}.html"
REPORT_JSON="${OUTPUT_DIR}/reports/report_${TIMESTAMP}.json"
REPORT_TXT="${OUTPUT_DIR}/reports/report_${TIMESTAMP}.txt"
FINDINGS_JSONL="${OUTPUT_DIR}/logs/findings.jsonl"
: > "$LOG_FILE"
: > "$FINDINGS_JSONL"
}
# ─────────────────────────────────────────────────────────────────────────────
# ARGUMENT PARSER
# ─────────────────────────────────────────────────────────────────────────────
parse_args() {
[[ $# -eq 0 ]] && { print_banner; print_usage; exit 1; }
while [[ $# -gt 0 ]]; do
case "$1" in
-t|--target) TARGET="$2"; shift 2 ;;
-o|--output) OUTPUT_DIR="$2"; shift 2 ;;
-T|--threads) OPT_THREADS="$2"; shift 2 ;;
-p|--ports) OPT_PORTS="$2"; shift 2 ;;
--format) OPT_OUTPUT_ONLY="$2"; shift 2 ;;
--timeout) OPT_TIMEOUT="$2"; shift 2 ;;
--depth) OPT_DEPTH="$2"; shift 2 ;;
--proxy) OPT_PROXY="$2"; shift 2 ;;
--aggressive) OPT_AGGRESSIVE=1; shift ;;
--stealth) OPT_STEALTH=1; shift ;;
--wl-dirs-small) WL_DIRS_SMALL="$2"; shift 2 ;;
--wl-dirs-big) WL_DIRS_BIG="$2"; shift 2 ;;
--wl-dns) WL_DNS="$2"; shift 2 ;;
--skip-recon) MOD_RECON=0; shift ;;
--skip-portscan) MOD_PORTSCAN=0; shift ;;
--skip-fingerprint) MOD_FINGERPRINT=0; shift ;;
--skip-ssl) MOD_SSL=0; shift ;;
--skip-headers) MOD_HEADERS=0; shift ;;
--skip-dirbrute) MOD_DIRBRUTE=0; shift ;;
--skip-nikto) MOD_NIKTO=0; shift ;;
--skip-sqli) MOD_SQLI=0; shift ;;
--skip-xss) MOD_XSS=0; shift ;;
--skip-cms) MOD_CMS=0; shift ;;
--skip-cors) MOD_CORS=0; shift ;;
--skip-redirect) MOD_REDIRECT=0; shift ;;
--skip-ssrf) MOD_SSRF=0; shift ;;
--skip-subtakeover) MOD_SUBTAKEOVER=0; shift ;;
--skip-nuclei) MOD_NUCLEI=0; shift ;;
-v|--verbose) OPT_VERBOSE=1; shift ;;
--no-color) OPT_NO_COLOR=1; shift ;;
--no-banner) OPT_NO_BANNER=1; shift ;;
-V|--version)
echo "${TOOL_NAME} v${TOOL_VERSION} — ${TOOL_AUTHOR}"
exit 0 ;;
-h|--help)
print_banner; print_usage; exit 0 ;;
*)
echo "Unknown option: $1" >&2; print_usage; exit 1 ;;
esac
done
# Validate target
[[ -z "$TARGET" ]] && { echo -e "${C_RED}[!] Error: --target is required.${C_RESET}"; exit 1; }
# Normalise target
[[ "$TARGET" =~ ^https?:// ]] || TARGET="https://${TARGET}"
TARGET_SCHEME="$(get_scheme "$TARGET")"
TARGET_DOMAIN="$(strip_scheme "$TARGET")"
TARGET_IP="$(resolve_ip "$TARGET_DOMAIN")"
# Validate conflicting modes
if [[ $OPT_AGGRESSIVE -eq 1 && $OPT_STEALTH -eq 1 ]]; then
echo -e "${C_YELLOW}[!] --aggressive and --stealth are mutually exclusive. Using --aggressive.${C_RESET}"
OPT_STEALTH=0
fi
init_output_dir
}
# ─────────────────────────────────────────────────────────────────────────────
# DEPENDENCY CHECK
# ─────────────────────────────────────────────────────────────────────────────
module_check_deps() {
log_section "DEPENDENCY CHECK"
local required=(curl nmap)
local optional=(
nikto sqlmap whatweb wafw00f gobuster ffuf dirb
wpscan droopescan sslscan "testssl.sh"
dalfox subjack nuclei
subfinder amass dnsrecon
host whois dig jq python3
)
local missing_req=()
for t in "${required[@]}"; do
if has_tool "$t"; then
log_ok " [required] $t"
else
missing_req+=("$t")
log_error " [required] $t — NOT FOUND"
fi
done
for t in "${optional[@]}"; do
if has_tool "$t"; then
log_ok " [optional] $t"
else
log_warn " [optional] $t — not found (reduced coverage)"
fi
done
if [[ ${#missing_req[@]} -gt 0 ]]; then
echo ""
log_error "Missing required tools: ${missing_req[*]}"
echo -e " Install with: ${C_CYAN}sudo apt-get install -y ${missing_req[*]}${C_RESET}"
exit 1
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 00 — TARGET INFORMATION
# ─────────────────────────────────────────────────────────────────────────────
module_target_info() {
log_section "MODULE 00 — TARGET INFORMATION"
log_info "Target URL : $TARGET"
log_info "Target Domain : $TARGET_DOMAIN"
log_info "Resolved IP : ${TARGET_IP:-<unresolved>}"
log_info "Scheme : $TARGET_SCHEME"
log_info "Output Dir : $OUTPUT_DIR"
log_info "Timestamp : $TIMESTAMP"
log_info "Mode : $( [[ $OPT_AGGRESSIVE -eq 1 ]] && echo AGGRESSIVE; \
[[ $OPT_STEALTH -eq 1 ]] && echo STEALTH; \
[[ $OPT_AGGRESSIVE -eq 0 && $OPT_STEALTH -eq 0 ]] && echo NORMAL )"
[[ -n "$OPT_PROXY" ]] && log_info "Proxy : $OPT_PROXY"
add_finding "INFO" "INIT" "Audit started against ${TARGET}" \
"Resolved IP: ${TARGET_IP:-<unresolved>} | Mode: $(
[[ $OPT_AGGRESSIVE -eq 1 ]] && echo AGGRESSIVE || \
[[ $OPT_STEALTH -eq 1 ]] && echo STEALTH || echo NORMAL)" "" ""
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 01 — RECONNAISSANCE
# ─────────────────────────────────────────────────────────────────────────────
module_recon() {
[[ $MOD_RECON -eq 0 ]] && return
log_section "MODULE 01 — RECONNAISSANCE"
local recon_dir="${OUTPUT_DIR}/recon"
# ── WHOIS ──────────────────────────────────────────────────────────────────
log_subsection "WHOIS Lookup"
if has_tool whois; then
whois "$TARGET_DOMAIN" > "${recon_dir}/whois.txt" 2>&1 || true
log_ok "WHOIS saved → ${recon_dir}/whois.txt"
# Extract key registrant info
local registrar expiry
registrar=$(grep -iE "^registrar:" "${recon_dir}/whois.txt" | head -1 | sed 's/^[^:]*: *//' || true)
expiry=$(grep -iE "expir" "${recon_dir}/whois.txt" | grep -oP '\d{4}-\d{2}-\d{2}' | head -1 || true)
[[ -n "$registrar" ]] && log_info "Registrar : $registrar"
[[ -n "$expiry" ]] && log_info "Expiry : $expiry"
add_finding "INFO" "RECON" "WHOIS data collected for ${TARGET_DOMAIN}" \
"Registrar: ${registrar:-N/A} | Expiry: ${expiry:-N/A}" "" ""
else
log_warn "whois not available"
fi
# ── DNS RECORDS ────────────────────────────────────────────────────────────
log_subsection "DNS Record Enumeration"
if has_tool dig; then
local dns_file="${recon_dir}/dns_records.txt"
{
for rtype in A AAAA MX TXT NS SOA CNAME CAA; do
printf "=== %s ===\n" "$rtype"
dig +short "$rtype" "$TARGET_DOMAIN" 2>/dev/null || true
echo ""
done
printf "=== DMARC ===\n"
dig +short TXT "_dmarc.${TARGET_DOMAIN}" 2>/dev/null || true
printf "\n=== SPF (raw TXT) ===\n"
dig +short TXT "$TARGET_DOMAIN" 2>/dev/null | grep -i "v=spf" || true
} > "$dns_file"
log_ok "DNS records saved → $dns_file"
# SPF / DMARC analysis
local spf_record dmarc_record
spf_record=$(dig +short TXT "$TARGET_DOMAIN" 2>/dev/null | grep -i "v=spf1" || true)
dmarc_record=$(dig +short TXT "_dmarc.${TARGET_DOMAIN}" 2>/dev/null | head -1 || true)
if [[ -z "$spf_record" ]]; then
add_finding "MEDIUM" "RECON" "Missing SPF record on ${TARGET_DOMAIN}" \
"No SPF TXT record found. Domain may be used for email spoofing." "" \
"Add a TXT record: v=spf1 include:<provider> -all"
else
log_ok "SPF record present: ${spf_record:0:80}"
# Check for +all (dangerous)
if echo "$spf_record" | grep -q "+all"; then
add_finding "HIGH" "RECON" "SPF record uses +all (permissive)" \
"Any IP is allowed to send email on behalf of this domain." "$spf_record" \
"Change +all to -all or ~all to restrict sending sources."
fi
fi
if [[ -z "$dmarc_record" ]]; then
add_finding "MEDIUM" "RECON" "Missing DMARC record on ${TARGET_DOMAIN}" \
"No DMARC policy found. Email spoofing protection is absent." "" \
"Add TXT record at _dmarc.${TARGET_DOMAIN}: v=DMARC1; p=reject; rua=mailto:dmarc@${TARGET_DOMAIN}"
else
log_ok "DMARC record present: ${dmarc_record:0:80}"
if echo "$dmarc_record" | grep -qi "p=none"; then
add_finding "LOW" "RECON" "DMARC policy set to p=none (monitoring only)" \
"DMARC is in monitor mode and does not enforce rejection." "$dmarc_record" \
"Upgrade DMARC policy to p=quarantine or p=reject."
fi
fi
fi
# ── DNS ZONE TRANSFER ──────────────────────────────────────────────────────
log_subsection "DNS Zone Transfer (AXFR)"
local ns_servers
ns_servers=$(dig +short NS "$TARGET_DOMAIN" 2>/dev/null | head -5 || true)
local axfr_file="${recon_dir}/axfr.txt"
local axfr_found=0
if [[ -n "$ns_servers" ]]; then
while IFS= read -r ns; do
ns="${ns%.}"
log_verbose "Attempting AXFR from $ns"
if dig AXFR "$TARGET_DOMAIN" "@${ns}" 2>/dev/null | \
grep -v "^;;" | grep -v "^$" > "${axfr_file}.tmp" 2>&1; then
local lines; lines=$(wc -l < "${axfr_file}.tmp" 2>/dev/null || echo 0)
if [[ "$lines" -gt 5 ]]; then
cat "${axfr_file}.tmp" >> "$axfr_file"
axfr_found=1
add_finding "CRITICAL" "RECON" "DNS Zone Transfer (AXFR) is permitted" \
"Name server $ns allows AXFR — full DNS zone disclosed." \
"$(head -5 "$axfr_file")" \
"Restrict AXFR to authorized secondary name servers only."
fi
fi
rm -f "${axfr_file}.tmp"
done <<< "$ns_servers"
[[ $axfr_found -eq 0 ]] && log_ok "AXFR not permitted (correct)"
fi
# ── SUBDOMAIN ENUMERATION ──────────────────────────────────────────────────
log_subsection "Subdomain Enumeration"
local subs_file="${recon_dir}/subdomains.txt"
: > "$subs_file"
if has_tool subfinder; then
log_info "Running subfinder..."
timeout 120s subfinder -d "$TARGET_DOMAIN" -silent \
-o "${recon_dir}/subfinder.txt" 2>/dev/null || true
[[ -f "${recon_dir}/subfinder.txt" ]] && \
cat "${recon_dir}/subfinder.txt" >> "$subs_file"
fi
if has_tool amass; then
log_info "Running amass (passive)..."
timeout 180s amass enum -passive -d "$TARGET_DOMAIN" \
-o "${recon_dir}/amass.txt" 2>/dev/null || true
[[ -f "${recon_dir}/amass.txt" ]] && \
cat "${recon_dir}/amass.txt" >> "$subs_file"
fi
if has_tool dnsrecon; then
log_info "Running dnsrecon..."
timeout 120s dnsrecon -d "$TARGET_DOMAIN" -t std \
-j "${recon_dir}/dnsrecon.json" 2>/dev/null || true
fi
# Brute-force fallback if no enumeration tool found
if ! has_tool subfinder && ! has_tool amass && [[ -f "$WL_DNS" ]]; then
log_info "Brute-forcing subdomains via DNS (wordlist: $WL_DNS)..."
local bf_count=0
while IFS= read -r word && [[ $bf_count -lt 500 ]]; do
[[ -z "$word" || "$word" == \#* ]] && continue
local fqdn="${word}.${TARGET_DOMAIN}"
if dig +short A "$fqdn" 2>/dev/null | grep -qP '^\d+\.\d+\.\d+\.\d+'; then
echo "$fqdn" >> "$subs_file"
log_verbose "Found: $fqdn"
fi
bf_count=$((bf_count + 1))
done < "$WL_DNS"
fi
# Deduplicate
if [[ -s "$subs_file" ]]; then
sort -u "$subs_file" -o "$subs_file"
local sub_count; sub_count=$(wc -l < "$subs_file")
log_ok "Discovered $sub_count unique subdomains → $subs_file"
add_finding "INFO" "RECON" "Subdomain enumeration: $sub_count hosts discovered" \
"$(head -10 "$subs_file" | tr '\n' ' ')" "$subs_file" ""
else
log_info "No additional subdomains discovered"
fi
# ── GOOGLE DORKS (generated, not executed) ─────────────────────────────────
log_subsection "Google Dork List"
local dorks_file="${recon_dir}/google_dorks.txt"
cat > "$dorks_file" << DORKS
# Google Dorks — ${TARGET_DOMAIN}
# Generated by ${TOOL_NAME} v${TOOL_VERSION} on ${DATE_HUMAN}
# Run these manually in Google / Bing / DuckDuckGo
## Information disclosure
site:${TARGET_DOMAIN}
site:${TARGET_DOMAIN} filetype:pdf OR filetype:doc OR filetype:xls OR filetype:xlsx OR filetype:csv
site:${TARGET_DOMAIN} ext:php inurl:id=
site:${TARGET_DOMAIN} ext:asp OR ext:aspx
site:${TARGET_DOMAIN} "index of /"
site:${TARGET_DOMAIN} "index of /admin"
site:${TARGET_DOMAIN} "index of /backup"
site:${TARGET_DOMAIN} intext:"sql syntax" OR intext:"mysql_fetch_array" OR intext:"ORA-"
## Admin/login panels
site:${TARGET_DOMAIN} inurl:admin OR inurl:administrator
site:${TARGET_DOMAIN} inurl:login OR inurl:signin OR inurl:auth
site:${TARGET_DOMAIN} inurl:phpmyadmin OR inurl:adminer
site:${TARGET_DOMAIN} inurl:wp-admin OR inurl:wp-login.php
## Credentials & secrets
site:${TARGET_DOMAIN} intext:"password" filetype:log
site:${TARGET_DOMAIN} intext:"DB_PASSWORD" OR intext:"MYSQL_ROOT_PASSWORD"
site:${TARGET_DOMAIN} intext:"api_key" OR intext:"api_secret" OR intext:"client_secret"
"${TARGET_DOMAIN}" site:pastebin.com
"${TARGET_DOMAIN}" site:github.com password OR secret OR token OR credential
## Config files
site:${TARGET_DOMAIN} filetype:env OR filetype:conf OR filetype:cfg OR filetype:ini
site:${TARGET_DOMAIN} filetype:bak OR filetype:backup OR filetype:old OR filetype:orig
## Exposed panels & services
site:${TARGET_DOMAIN} inurl:swagger OR inurl:api-docs OR inurl:openapi
site:${TARGET_DOMAIN} inurl:console OR inurl:debug OR inurl:phpinfo
DORKS
log_ok "Google Dorks generated → $dorks_file"
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 02 — PORT SCANNING
# ─────────────────────────────────────────────────────────────────────────────
module_portscan() {
[[ $MOD_PORTSCAN -eq 0 ]] && return
log_section "MODULE 02 — PORT SCANNING"
require_tool nmap || return
local scan_target="${TARGET_IP:-$TARGET_DOMAIN}"
local nmap_base="${OUTPUT_DIR}/portscan/nmap"
# Build nmap flags
local ports_arg
case "$OPT_PORTS" in
top-100) ports_arg="--top-ports 100" ;;
full) ports_arg="-p-" ;;
*) ports_arg="--top-ports 1000" ;;
esac
local nmap_flags="-sV -sC --open"
if [[ $OPT_AGGRESSIVE -eq 1 ]]; then
nmap_flags="$nmap_flags -A -O --script=vuln,auth,default,discovery"
elif [[ $OPT_STEALTH -eq 1 ]]; then
nmap_flags="$nmap_flags -sS -T2 -f --data-length 32 --randomize-hosts"
else
nmap_flags="$nmap_flags -T4"
fi
[[ -n "$OPT_PROXY" ]] && nmap_flags="$nmap_flags --proxies $OPT_PROXY"
log_info "Target : $scan_target"
log_info "Profile: $OPT_PORTS"
log_info "Flags : $nmap_flags"
echo ""
# shellcheck disable=SC2086
nmap $nmap_flags $ports_arg \
-oN "${nmap_base}.txt" \
-oX "${nmap_base}.xml" \
-oG "${nmap_base}.gnmap" \
"$scan_target" 2>&1 | tee -a "$LOG_FILE" || true
[[ ! -f "${nmap_base}.txt" ]] && { log_error "nmap failed to produce output"; return; }
log_ok "nmap completed → ${nmap_base}.txt"
# Parse open ports and flag dangerous ones
local open_ports
open_ports=$(grep -P "^\d+/tcp\s+open" "${nmap_base}.txt" 2>/dev/null || true)
if [[ -z "$open_ports" ]]; then
log_info "No open ports found in scan range"
return
fi
log_info "Open ports:"
echo "$open_ports" | tee -a "$LOG_FILE"
echo ""
add_finding "INFO" "PORTSCAN" "Port scan results for $scan_target" \
"$(echo "$open_ports" | wc -l) open port(s) found." \
"$(echo "$open_ports" | head -5 | tr '\n' ' ')" ""
# Risk-based analysis of open ports
declare -A port_risks=(
[21]="CRITICAL|FTP (port 21) — plaintext credentials|Close FTP; use SFTP (port 22) instead."
[23]="CRITICAL|Telnet (port 23) — unencrypted remote shell|Disable Telnet; use SSH."
[25]="MEDIUM|SMTP (port 25) exposed publicly|Restrict if not a mail relay."
[110]="MEDIUM|POP3 (port 110) — plaintext email retrieval|Use POP3S (port 995)."
[143]="MEDIUM|IMAP (port 143) — plaintext email access|Use IMAPS (port 993)."
[389]="MEDIUM|LDAP (port 389) — unencrypted directory|Use LDAPS (port 636)."
[445]="HIGH|SMB (port 445) exposed — risk of EternalBlue/ransomware|Block SMB at firewall; do not expose to internet."
[1433]="HIGH|MSSQL (port 1433) exposed — database accessible|Block with firewall; allow local access only."
[1521]="HIGH|Oracle DB (port 1521) exposed|Block with firewall; allow local access only."
[2375]="CRITICAL|Docker API (port 2375) — unauthenticated exposure|Enable TLS on Docker socket; never expose to internet."
[2376]="MEDIUM|Docker TLS API (port 2376) exposed|Restrict to authorized hosts only."
[3306]="HIGH|MySQL (port 3306) exposed to internet|Block with firewall; bind to 127.0.0.1."
[3389]="HIGH|RDP (port 3389) exposed — brute-force target|Use VPN gateway; disable direct RDP access."
[5432]="HIGH|PostgreSQL (port 5432) exposed|Block with firewall; bind to 127.0.0.1."
[5900]="HIGH|VNC (port 5900) exposed|Use VPN; require strong authentication."
[6379]="HIGH|Redis (port 6379) — often unauthenticated|Require auth; bind to 127.0.0.1."
[8080]="LOW|HTTP alternate port (8080) open|Verify intentional exposure; check for admin panels."
[8443]="LOW|HTTPS alternate port (8443) open|Verify intentional exposure."
[9200]="HIGH|Elasticsearch (port 9200) — often unauthenticated|Enable auth (X-Pack); do not expose publicly."
[9300]="HIGH|Elasticsearch transport (port 9300) exposed|Block with firewall."
[11211]="HIGH|Memcached (port 11211) — no auth by default|Block with firewall; bind to localhost."
[27017]="HIGH|MongoDB (port 27017) — often unauthenticated|Enable auth; bind to localhost."
)
echo "$open_ports" | while IFS= read -r line; do
local port; port=$(echo "$line" | awk '{print $1}' | cut -d/ -f1)
local risk="${port_risks[$port]:-}"
if [[ -n "$risk" ]]; then
IFS='|' read -r sev title rec <<< "$risk"
add_finding "$sev" "PORTSCAN" "$title" \
"Service exposed: $line" "$line" "$rec"
fi
done
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 03 — WEB FINGERPRINTING
# ─────────────────────────────────────────────────────────────────────────────
module_fingerprint() {
[[ $MOD_FINGERPRINT -eq 0 ]] && return
log_section "MODULE 03 — WEB FINGERPRINTING"
local recon_dir="${OUTPUT_DIR}/recon"
# ── WhatWeb ────────────────────────────────────────────────────────────────
log_subsection "Technology Detection"
if has_tool whatweb; then
local aggr_level=1
[[ $OPT_AGGRESSIVE -eq 1 ]] && aggr_level=3
whatweb -a $aggr_level "$TARGET" \
--log-json="${recon_dir}/whatweb.json" \
--log-brief="${recon_dir}/whatweb_brief.txt" \
2>/dev/null | tee -a "$LOG_FILE" || true
log_ok "WhatWeb → ${recon_dir}/whatweb.json"
else
# Fallback: header-based detection
log_info "whatweb not available — performing header-based detection"
local resp
resp=$(_curl -I "$TARGET" 2>/dev/null || true)
echo "$resp" > "${recon_dir}/basic_headers_raw.txt"
local techs=("WordPress" "Drupal" "Joomla" "Magento" "Laravel" "Django"
"Rails" "Express" "nginx" "Apache" "IIS" "LiteSpeed"
"PHP" "ASP.NET" "ColdFusion" "Tomcat" "Jetty" "Cloudflare")
for tech in "${techs[@]}"; do
if echo "$resp" | grep -qi "$tech"; then
log_info "Technology detected: $tech"
add_finding "INFO" "FINGERPRINT" "Technology detected: $tech" \
"Identified via response headers." "" ""
fi
done
fi
# ── WAF Detection ──────────────────────────────────────────────────────────
log_subsection "WAF Detection"
if has_tool wafw00f; then
wafw00f "$TARGET" 2>/dev/null | tee -a "$LOG_FILE" | \
tee "${recon_dir}/waf_detection.txt" > /dev/null || true
if grep -qi "is behind" "${recon_dir}/waf_detection.txt" 2>/dev/null; then
local waf_name
waf_name=$(grep -i "is behind" "${recon_dir}/waf_detection.txt" | head -1 | sed 's/.*behind //')
log_info "WAF detected: $waf_name"
add_finding "INFO" "FINGERPRINT" "WAF detected: $waf_name" \
"The target appears to be protected by a Web Application Firewall." "$waf_name" ""
else
add_finding "LOW" "FINGERPRINT" "No WAF detected" \
"No known WAF signatures were identified in server responses." "" \
"Consider deploying a WAF (Cloudflare, ModSecurity, AWS WAF, etc.)"
fi
else
log_warn "wafw00f not available — WAF detection skipped"
fi
# ── Version-leaking headers ────────────────────────────────────────────────
log_subsection "Server Version Disclosure"
local headers
headers=$(_curl -I "$TARGET" 2>/dev/null || true)
echo "$headers" > "${OUTPUT_DIR}/headers/initial_response.txt"
local leaking_headers=("Server" "X-Powered-By" "X-AspNet-Version"
"X-AspNetMvc-Version" "X-Generator" "X-Drupal-Cache"
"X-WordPress-Cache" "Via")
for h in "${leaking_headers[@]}"; do
local val
val=$(echo "$headers" | grep -i "^${h}:" | head -1 || true)
if [[ -n "$val" ]]; then
log_warn "Version-leaking header: $val"
add_finding "LOW" "FINGERPRINT" "Version disclosure via '$h' header" \
"The server reveals technology/version info in response headers." \
"$val" \
"Remove or neutralise the '$h' header in your web server configuration."
fi
done
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 04 — SSL/TLS ANALYSIS
# ─────────────────────────────────────────────────────────────────────────────
module_ssl() {
[[ $MOD_SSL -eq 0 ]] && return
if ! is_https; then
log_info "[SSL] Target is not HTTPS — skipping SSL/TLS analysis"
add_finding "HIGH" "SSL" "Target is served over HTTP (no TLS)" \
"All traffic between client and server is transmitted in plaintext." "" \
"Deploy a TLS certificate (Let's Encrypt is free). Redirect all HTTP to HTTPS."
return
fi
log_section "MODULE 04 — SSL/TLS ANALYSIS"
local ssl_dir="${OUTPUT_DIR}/ssl"
# ── testssl.sh (primary) ───────────────────────────────────────────────────
if has_tool "testssl.sh"; then
log_info "Running testssl.sh (full analysis)..."
timeout 600s testssl.sh \
--quiet \
--severity LOW \
--jsonfile "${ssl_dir}/testssl.json" \
--logfile "${ssl_dir}/testssl.log" \
"$TARGET_DOMAIN" 2>/dev/null || true
log_ok "testssl.sh → ${ssl_dir}/testssl.json"
# Parse findings from JSON
if has_tool jq && [[ -f "${ssl_dir}/testssl.json" ]]; then
while IFS= read -r entry; do
local sev finding_id finding_text
sev=$(echo "$entry" | jq -r '.severity // ""' 2>/dev/null)
finding_id=$(echo "$entry" | jq -r '.id // ""' 2>/dev/null)
finding_text=$(echo "$entry"| jq -r '.finding // ""' 2>/dev/null)
[[ -z "$sev" || -z "$finding_id" ]] && continue
case "$sev" in
CRITICAL|HIGH|MEDIUM|LOW)
add_finding "$sev" "SSL" "testssl: [${finding_id}] ${finding_text:0:120}" \
"" "" "Refer to testssl documentation for ${finding_id}" ;;
esac
done < <(jq -c '.[] | select(.severity != "OK" and .severity != "INFO" and .severity != "DEBUG" and .severity != "")' \
"${ssl_dir}/testssl.json" 2>/dev/null || true)
fi
# ── sslscan (secondary) ────────────────────────────────────────────────────
elif has_tool sslscan; then
log_info "Running sslscan..."
sslscan --no-colour "${TARGET_DOMAIN}:443" > "${ssl_dir}/sslscan.txt" 2>&1 || true
log_ok "sslscan → ${ssl_dir}/sslscan.txt"
local scan_output
scan_output=$(cat "${ssl_dir}/sslscan.txt")
# Deprecated protocols
for proto in "SSLv2" "SSLv3" "TLSv1.0" "TLSv1.1"; do
if echo "$scan_output" | grep -qP "^\s*${proto}\s+enabled"; then
add_finding "HIGH" "SSL" "Insecure protocol enabled: $proto" \
"$proto is deprecated and vulnerable to known attacks." "$proto" \
"Disable $proto. Allow TLS 1.2 and TLS 1.3 only."
fi
done
# Weak cipher suites
if echo "$scan_output" | grep -qiE "RC4|NULL|EXPORT|anon|DES\b|3DES"; then
add_finding "HIGH" "SSL" "Weak cipher suites detected" \
"RC4, NULL, EXPORT or DES ciphers are enabled." \
"$(echo "$scan_output" | grep -iE 'RC4|NULL|EXPORT|anon|DES' | head -3)" \
"Disable weak ciphers. Prefer ECDHE+AESGCM and ChaCha20-Poly1305."
fi
# Self-signed or untrusted
if echo "$scan_output" | grep -qi "self-signed\|not trusted"; then
add_finding "HIGH" "SSL" "Untrusted or self-signed certificate" \
"The certificate is not issued by a trusted CA." "" \
"Use a certificate from a trusted CA (Let's Encrypt, DigiCert, etc.)"
fi
# ── openssl fallback ───────────────────────────────────────────────────────
else
log_info "testssl.sh/sslscan not available — using openssl fallback"
local openssl_out="${ssl_dir}/openssl_info.txt"
{
echo "=== Certificate Info ==="
echo | timeout "$OPT_TIMEOUT" openssl s_client \
-connect "${TARGET_DOMAIN}:443" \
-servername "$TARGET_DOMAIN" 2>/dev/null \
| openssl x509 -noout -text 2>/dev/null || true
echo ""
echo "=== Protocol Support ==="
for proto in ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; do
if echo | timeout 5s openssl s_client \
-"$proto" -connect "${TARGET_DOMAIN}:443" \
-servername "$TARGET_DOMAIN" 2>/dev/null \
| grep -q "CONNECTED"; then
echo "${proto}: ENABLED"
else
echo "${proto}: disabled"
fi
done
} > "$openssl_out" 2>&1
# Flag insecure protocols found
grep "ENABLED" "$openssl_out" 2>/dev/null | while IFS= read -r line; do
local proto; proto=$(echo "$line" | cut -d: -f1)
case "$proto" in
ssl2|ssl3|tls1|tls1_1)
add_finding "HIGH" "SSL" "Insecure protocol enabled: $proto" \
"$proto is deprecated and vulnerable." "$proto" \
"Disable $proto. Use TLS 1.2+ only." ;;
esac
done
log_ok "OpenSSL analysis → $openssl_out"
fi
# ── Certificate expiry check ───────────────────────────────────────────────
log_subsection "Certificate Expiry Check"
local expiry_raw
expiry_raw=$(echo | timeout "$OPT_TIMEOUT" openssl s_client \
-connect "${TARGET_DOMAIN}:443" \
-servername "$TARGET_DOMAIN" 2>/dev/null \
| openssl x509 -noout -enddate 2>/dev/null \
| cut -d= -f2 || true)
if [[ -n "$expiry_raw" ]]; then
local exp_epoch now_epoch days_left
exp_epoch=$(date -d "$expiry_raw" +%s 2>/dev/null || echo 0)
now_epoch=$(date +%s)
days_left=$(( (exp_epoch - now_epoch) / 86400 ))
if [[ "$days_left" -lt 0 ]]; then
add_finding "CRITICAL" "SSL" "Certificate has EXPIRED" \
"Certificate expired $((days_left * -1)) days ago." "$expiry_raw" \
"Renew the TLS certificate immediately."
elif [[ "$days_left" -lt 14 ]]; then
add_finding "CRITICAL" "SSL" "Certificate expires in $days_left days" \
"Imminent certificate expiry will cause service disruption." "$expiry_raw" \
"Renew the certificate immediately."
elif [[ "$days_left" -lt 30 ]]; then
add_finding "HIGH" "SSL" "Certificate expires in $days_left days" \
"Certificate is close to expiry." "$expiry_raw" \
"Renew the certificate urgently."
elif [[ "$days_left" -lt 90 ]]; then
add_finding "MEDIUM" "SSL" "Certificate expires in $days_left days" \
"" "$expiry_raw" "Plan certificate renewal."
else
log_ok "Certificate valid — $days_left days remaining (${expiry_raw})"
fi
fi
# ── HSTS ──────────────────────────────────────────────────────────────────
log_subsection "HSTS (HTTP Strict Transport Security)"
local hsts_header
hsts_header=$(_curl -I "$TARGET" 2>/dev/null | grep -i "^strict-transport-security:" || true)
if [[ -z "$hsts_header" ]]; then
add_finding "MEDIUM" "SSL" "HSTS header not configured" \
"Strict-Transport-Security is absent — browsers may access the site over HTTP." "" \
"Add: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload"
else
local maxage
maxage=$(echo "$hsts_header" | grep -oP 'max-age=\K\d+' || echo 0)
if [[ "$maxage" -lt 15552000 ]]; then
add_finding "LOW" "SSL" "HSTS max-age is too short ($maxage seconds)" \
"Recommended minimum is 6 months (15552000 seconds)." "$hsts_header" \
"Increase HSTS max-age to at least 15552000."
else
log_ok "HSTS configured: $hsts_header"
fi
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 05 — HTTP SECURITY HEADERS
# ─────────────────────────────────────────────────────────────────────────────
module_headers() {
[[ $MOD_HEADERS -eq 0 ]] && return
log_section "MODULE 05 — HTTP SECURITY HEADERS"
local hdrs_dir="${OUTPUT_DIR}/headers"
local hdr_file="${hdrs_dir}/response_headers.txt"
_curl -I -L --max-redirs 5 "$TARGET" 2>/dev/null > "$hdr_file" || true
log_info "Response headers captured → $hdr_file"
cat "$hdr_file" | tee -a "$LOG_FILE"
echo ""
# ── Security headers that MUST be present ──────────────────────────────────
declare -A REQUIRED_HEADERS=(
["content-security-policy"]="MEDIUM|Content-Security-Policy (CSP) missing|Implement a strict CSP to mitigate XSS and data injection attacks."
["x-frame-options"]="MEDIUM|X-Frame-Options missing — clickjacking risk|Add: X-Frame-Options: SAMEORIGIN"
["x-content-type-options"]="LOW|X-Content-Type-Options missing — MIME sniffing risk|Add: X-Content-Type-Options: nosniff"
["referrer-policy"]="LOW|Referrer-Policy missing|Add: Referrer-Policy: strict-origin-when-cross-origin"
["permissions-policy"]="LOW|Permissions-Policy missing|Add: Permissions-Policy: geolocation=(), microphone=(), camera=()"
["cross-origin-opener-policy"]="LOW|Cross-Origin-Opener-Policy (COOP) missing|Add: Cross-Origin-Opener-Policy: same-origin"
["cross-origin-resource-policy"]="LOW|Cross-Origin-Resource-Policy (CORP) missing|Add: Cross-Origin-Resource-Policy: same-origin"
)
for header in "${!REQUIRED_HEADERS[@]}"; do
IFS='|' read -r sev title rec <<< "${REQUIRED_HEADERS[$header]}"
if ! grep -qi "^${header}:" "$hdr_file" 2>/dev/null; then
add_finding "$sev" "HEADERS" "$title" \
"The response is missing the '${header}' security header." "" "$rec"
else
log_ok "Present: $(grep -i "^${header}:" "$hdr_file" | head -1)"
# CSP audit — flag dangerous directives
if [[ "$header" == "content-security-policy" ]]; then
local csp_val
csp_val=$(grep -i "^content-security-policy:" "$hdr_file" | head -1)
if echo "$csp_val" | grep -qi "unsafe-inline\|unsafe-eval"; then
add_finding "MEDIUM" "HEADERS" "CSP contains 'unsafe-inline' or 'unsafe-eval'" \
"Overly permissive CSP directive undermines XSS protection." "$csp_val" \
"Remove 'unsafe-inline'/'unsafe-eval'. Use nonces or hashes instead."
fi
if echo "$csp_val" | grep -qi "default-src \*\|script-src \*"; then
add_finding "HIGH" "HEADERS" "CSP uses wildcard (*) for script-src or default-src" \
"A wildcard CSP directive provides no protection against XSS." "$csp_val" \
"Specify explicit allowed origins in Content-Security-Policy."
fi
fi
fi
done
# ── Headers that should NOT be present ─────────────────────────────────────
log_subsection "Sensitive Header Exposure"
local forbidden_headers=("Server" "X-Powered-By" "X-AspNet-Version"
"X-AspNetMvc-Version" "X-Generator" "X-CF-Powered-By")
for h in "${forbidden_headers[@]}"; do
local val; val=$(grep -i "^${h}:" "$hdr_file" 2>/dev/null | head -1 || true)
if [[ -n "$val" ]]; then
add_finding "LOW" "HEADERS" "Informative header exposed: $h" \
"Server reveals technology details via '$h' header." "$val" \
"Remove or anonymise the '$h' header in your server configuration."
fi
done
# ── Cookie flags ────────────────────────────────────────────────────────────
log_subsection "Cookie Security Flags"
local cookies
cookies=$(_curl -I "$TARGET" 2>/dev/null | grep -i "^set-cookie:" || true)
if [[ -n "$cookies" ]]; then
echo "$cookies" | while IFS= read -r cookie; do
local cookie_name; cookie_name=$(echo "$cookie" | grep -oP 'Set-Cookie:\s*\K[^=]+' || echo "?")
if ! echo "$cookie" | grep -qi "httponly"; then
add_finding "MEDIUM" "HEADERS" "Cookie '$cookie_name' missing HttpOnly flag" \
"Cookie is accessible via JavaScript — XSS can steal session tokens." \
"$cookie" "Add 'HttpOnly' flag to all session cookies."
fi
if ! echo "$cookie" | grep -qi "secure"; then
add_finding "MEDIUM" "HEADERS" "Cookie '$cookie_name' missing Secure flag" \
"Cookie may be transmitted over unencrypted HTTP connections." \
"$cookie" "Add 'Secure' flag to all session cookies."
fi
if ! echo "$cookie" | grep -qi "samesite"; then
add_finding "LOW" "HEADERS" "Cookie '$cookie_name' missing SameSite attribute" \
"Absence of SameSite exposes the cookie to CSRF risks." \
"$cookie" "Add 'SameSite=Strict' or 'SameSite=Lax' to session cookies."
fi
if echo "$cookie" | grep -qiP "samesite=none(?!.*secure)" ; then
add_finding "MEDIUM" "HEADERS" "Cookie '$cookie_name' uses SameSite=None without Secure" \
"SameSite=None requires the Secure flag." \
"$cookie" "Add 'Secure' flag when using 'SameSite=None'."
fi
done
else
log_info "No Set-Cookie headers found in initial response"
fi
# ── HTTP → HTTPS redirect ───────────────────────────────────────────────────
log_subsection "HTTP to HTTPS Redirect"
local http_url="${TARGET/https:\/\//http://}"
local redirect_code
redirect_code=$(_curl -sI -o /dev/null -w "%{http_code}" \
--max-redirs 0 "$http_url" 2>/dev/null || echo "000")
if echo "$redirect_code" | grep -qP "^30[1-8]$"; then
log_ok "HTTP → HTTPS redirect in place (HTTP $redirect_code)"
else
add_finding "MEDIUM" "HEADERS" "HTTP does not redirect to HTTPS (HTTP $redirect_code)" \
"Requests over HTTP are not automatically upgraded to HTTPS." "$http_url → $redirect_code" \
"Configure a permanent 301 redirect from HTTP to HTTPS."
fi
# ── Cache-Control on sensitive pages ───────────────────────────────────────
local cache_ctrl
cache_ctrl=$(_curl -I "$TARGET" 2>/dev/null | grep -i "^cache-control:" || true)
if [[ -z "$cache_ctrl" ]]; then
add_finding "LOW" "HEADERS" "Cache-Control header missing" \
"Without Cache-Control, sensitive pages may be cached by intermediaries." "" \
"Add: Cache-Control: no-store, no-cache on authenticated/sensitive pages."
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 06 — DIRECTORY & FILE BRUTE-FORCING
# ─────────────────────────────────────────────────────────────────────────────
module_dirbrute() {
[[ $MOD_DIRBRUTE -eq 0 ]] && return
log_section "MODULE 06 — DIRECTORY & FILE ENUMERATION"
local dirs_dir="${OUTPUT_DIR}/dirs"
local wordlist="$WL_DIRS_SMALL"
[[ $OPT_AGGRESSIVE -eq 1 ]] && wordlist="$WL_DIRS_BIG"
if [[ ! -f "$wordlist" ]]; then
log_warn "Wordlist not found: $wordlist"
log_warn "Install wordlists: sudo apt-get install wordlists"
log_info "Skipping brute-force, running sensitive file checks only"
else
# ── gobuster ──────────────────────────────────────────────────────────────
if has_tool gobuster; then
log_subsection "gobuster (directory)"
gobuster dir \
-u "$TARGET" \
-w "$wordlist" \
-t "$OPT_THREADS" \
--timeout "${OPT_TIMEOUT}s" \
-q \
-o "${dirs_dir}/gobuster_dirs.txt" \
$( [[ -n "$OPT_PROXY" ]] && printf -- "--proxy %s" "$OPT_PROXY" ) \
2>/dev/null || true
if [[ -f "${dirs_dir}/gobuster_dirs.txt" ]]; then
local found; found=$(wc -l < "${dirs_dir}/gobuster_dirs.txt")
log_ok "$found paths found → ${dirs_dir}/gobuster_dirs.txt"
[[ $found -gt 0 ]] && add_finding "INFO" "DIRBRUTE" \
"$found directories/files discovered" \
"$(head -10 "${dirs_dir}/gobuster_dirs.txt" | tr '\n' ' ')" \
"${dirs_dir}/gobuster_dirs.txt" ""
fi
# DNS subdomain brute-force
if [[ -f "$WL_DNS" ]]; then
log_subsection "gobuster (DNS)"
gobuster dns \
-d "$TARGET_DOMAIN" \
-w "$WL_DNS" \
-t "$OPT_THREADS" \
-q \
-o "${dirs_dir}/gobuster_dns.txt" \
2>/dev/null || true
fi
# ── ffuf fallback ──────────────────────────────────────────────────────────
elif has_tool ffuf; then
log_subsection "ffuf"
ffuf -u "${TARGET}/FUZZ" \
-w "$wordlist" \
-t "$OPT_THREADS" \
-timeout "$OPT_TIMEOUT" \
-mc 200,201,204,301,302,307,401,403 \
-of json \
-o "${dirs_dir}/ffuf_results.json" \
-s 2>/dev/null || true
log_ok "ffuf → ${dirs_dir}/ffuf_results.json"
# ── dirb fallback ──────────────────────────────────────────────────────────
elif has_tool dirb; then
log_subsection "dirb"
dirb "$TARGET" "$wordlist" -S -r \
-o "${dirs_dir}/dirb_results.txt" 2>/dev/null || true
log_ok "dirb → ${dirs_dir}/dirb_results.txt"
else
log_warn "No directory brute-force tool found (gobuster/ffuf/dirb)"
fi
fi
# ── Sensitive file/path probing ────────────────────────────────────────────
log_subsection "Sensitive File Probing"
declare -A SENSITIVE_PATHS=(
# Format: PATH="SEVERITY|short description"
["/.git/HEAD"]="CRITICAL|Git repository exposed — source code may be accessible"
["/.git/config"]="CRITICAL|Git config file exposed"
["/.env"]="CRITICAL|Environment file exposed — may contain credentials"
["/.env.local"]="CRITICAL|Local env file exposed"
["/.env.production"]="CRITICAL|Production env file exposed"
["/wp-config.php"]="CRITICAL|WordPress config file accessible — DB credentials exposed"
["/wp-config.php.bak"]="CRITICAL|WordPress config backup exposed"
["/configuration.php"]="CRITICAL|Joomla config file exposed"
["/config/database.yml"]="CRITICAL|Rails database config exposed"
["/.aws/credentials"]="CRITICAL|AWS credentials file exposed"
["/db.sql"]="CRITICAL|Database dump accessible"
["/dump.sql"]="CRITICAL|SQL dump accessible"
["/backup.sql"]="CRITICAL|SQL backup accessible"
["/backup.zip"]="HIGH|Backup archive accessible"
["/backup.tar.gz"]="HIGH|Backup archive accessible"
["/phpinfo.php"]="HIGH|phpinfo() page accessible — full PHP/server info exposed"
["/info.php"]="HIGH|PHP info page accessible"
["/test.php"]="MEDIUM|Test PHP file accessible"
["/phpmyadmin/"]="HIGH|phpMyAdmin interface exposed"
["/adminer.php"]="HIGH|Adminer database interface exposed"
["/adminer/"]="HIGH|Adminer database interface exposed"
["/admin/"]="MEDIUM|Admin panel accessible"
["/administrator/"]="MEDIUM|Administrator panel accessible"
["/.htaccess"]="MEDIUM|.htaccess file readable — server config exposed"
["/web.config"]="HIGH|web.config exposed — IIS config/credentials may be disclosed"
["/server-status"]="MEDIUM|Apache server-status page accessible"
["/server-info"]="MEDIUM|Apache server-info page accessible"
["/_profiler/"]="MEDIUM|Symfony profiler exposed"
["/_debugbar"]="MEDIUM|DebugBar exposed"
["/api/swagger.json"]="LOW|Swagger API spec accessible"
["/api/openapi.json"]="LOW|OpenAPI spec accessible"
["/swagger-ui.html"]="LOW|Swagger UI exposed"
["/api-docs"]="LOW|API documentation exposed"
["/graphql"]="LOW|GraphQL endpoint accessible"
["/graphiql"]="MEDIUM|GraphiQL IDE exposed"
["/console"]="HIGH|Interactive console exposed"
["/robots.txt"]="INFO|robots.txt accessible — may reveal hidden paths"
["/sitemap.xml"]="INFO|sitemap.xml accessible"
["/.well-known/security.txt"]="INFO|security.txt present — check responsible disclosure policy"
["/crossdomain.xml"]="LOW|crossdomain.xml present"
["/clientaccesspolicy.xml"]="LOW|clientaccesspolicy.xml present"
["/.DS_Store"]="MEDIUM|.DS_Store file exposed — directory structure leaked"
["/package.json"]="MEDIUM|package.json exposed — dependency list revealed"
["/composer.json"]="MEDIUM|composer.json exposed"
["/Dockerfile"]="HIGH|Dockerfile exposed"
["/docker-compose.yml"]="HIGH|docker-compose.yml exposed — may contain credentials"
["/Makefile"]="LOW|Makefile accessible"
["/.travis.yml"]="LOW|CI config exposed"
["/.circleci/config.yml"]="LOW|CircleCI config exposed"
)
local sensitive_found="${dirs_dir}/sensitive_paths_found.txt"
: > "$sensitive_found"
for path in "${!SENSITIVE_PATHS[@]}"; do
IFS='|' read -r sev description <<< "${SENSITIVE_PATHS[$path]}"
local url="${TARGET}${path}"
local status
status=$(_curl -o /dev/null -w "%{http_code}" "$url" 2>/dev/null || echo "000")
if [[ "$status" =~ ^(200|206|301|302)$ ]]; then
echo "[HTTP ${status}] ${url}" | tee -a "$sensitive_found" | tee -a "$LOG_FILE"
add_finding "$sev" "DIRBRUTE" "Sensitive path accessible: ${path}" \
"$description" "HTTP ${status} — ${url}" \
"Restrict access, remove the file, or block the path at the web server level."
fi
done
if [[ -s "$sensitive_found" ]]; then
log_warn "$(wc -l < "$sensitive_found") sensitive path(s) found — review $sensitive_found"
else
log_ok "No high-priority sensitive files detected"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 07 — NIKTO
# ─────────────────────────────────────────────────────────────────────────────
module_nikto() {
[[ $MOD_NIKTO -eq 0 ]] && return
log_section "MODULE 07 — NIKTO WEB SERVER SCAN"
require_tool nikto || return
local nikto_base="${OUTPUT_DIR}/vulns/nikto"
local nikto_flags="-host $TARGET -nointeractive -maxtime 600"
[[ $OPT_AGGRESSIVE -eq 1 ]] && nikto_flags="$nikto_flags -Plugins @@ALL"
[[ -n "$OPT_PROXY" ]] && nikto_flags="$nikto_flags -useproxy $OPT_PROXY"
log_info "Running Nikto (may take several minutes)..."
# shellcheck disable=SC2086
timeout 650s nikto $nikto_flags \
-output "${nikto_base}.txt" -Format txt 2>/dev/null | tee -a "$LOG_FILE" || true
# shellcheck disable=SC2086
timeout 650s nikto $nikto_flags \
-output "${nikto_base}.json" -Format json 2>/dev/null || true
if [[ ! -f "${nikto_base}.txt" ]]; then
log_warn "Nikto did not produce output"
return
fi
log_ok "Nikto → ${nikto_base}.txt"
# Parse findings
grep -E "^\+ " "${nikto_base}.txt" 2>/dev/null | while IFS= read -r line; do
local sev="LOW"
echo "$line" | grep -qiE "vuln|exploit|inject|XSS|SQL|CVE|OSVDB-[0-9]{4,}" && sev="HIGH"
echo "$line" | grep -qiE "outdated|version|disclose|found|enabled" && sev="MEDIUM"
add_finding "$sev" "NIKTO" "${line:2:120}" \
"" "$line" "Investigate Nikto finding and apply the appropriate remediation."
done
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 08 — SQL INJECTION
# ─────────────────────────────────────────────────────────────────────────────
module_sqli() {
[[ $MOD_SQLI -eq 0 ]] && return
log_section "MODULE 08 — SQL INJECTION (sqlmap)"
require_tool sqlmap || return
local sqli_dir="${OUTPUT_DIR}/vulns/sqlmap"
mkdir -p "$sqli_dir"
local sqlmap_flags="--batch --random-agent --timeout=$OPT_TIMEOUT --threads=$OPT_THREADS"
sqlmap_flags="$sqlmap_flags --level=3 --risk=2"
if [[ $OPT_AGGRESSIVE -eq 1 ]]; then
sqlmap_flags="$sqlmap_flags --level=5 --risk=3 --forms --crawl=${OPT_DEPTH} --dbs --tamper=space2comment"
fi
[[ $OPT_STEALTH -eq 1 ]] && sqlmap_flags="$sqlmap_flags --delay=2 --safe-freq=3 --smart"
[[ -n "$OPT_PROXY" ]] && sqlmap_flags="$sqlmap_flags --proxy=$OPT_PROXY"
log_info "Running sqlmap on $TARGET"
log_verbose "Flags: $sqlmap_flags"
# shellcheck disable=SC2086
timeout 600s sqlmap -u "$TARGET" $sqlmap_flags \
--output-dir="$sqli_dir" \
2>/dev/null | tee "${sqli_dir}/sqlmap_console.txt" || true
local output_file="${sqli_dir}/sqlmap_console.txt"
if grep -qiE "is vulnerable|sqlmap identified|injectable" "$output_file" 2>/dev/null; then
add_finding "CRITICAL" "SQLI" "SQL Injection confirmed on ${TARGET}" \
"sqlmap identified injectable parameter(s)." \
"$(grep -iE 'Parameter:|Type:|Title:' "$output_file" | head -5 | tr '\n' ' ')" \
"Use parameterised queries / prepared statements. Never concatenate user input into SQL."
else
log_ok "No SQL injection detected on the main target URL"
add_finding "INFO" "SQLI" "No obvious SQLi on primary URL" \
"Manual testing with specific parameters recommended." "" ""
fi
log_info "sqlmap results → $sqli_dir"
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 09 — CROSS-SITE SCRIPTING (XSS)
# ─────────────────────────────────────────────────────────────────────────────
module_xss() {
[[ $MOD_XSS -eq 0 ]] && return
log_section "MODULE 09 — CROSS-SITE SCRIPTING (XSS)"
local xss_dir="${OUTPUT_DIR}/vulns/xss"
mkdir -p "$xss_dir"
# ── dalfox ────────────────────────────────────────────────────────────────
if has_tool dalfox; then
log_subsection "dalfox XSS Scanner"
local dalfox_flags="--silence --timeout $OPT_TIMEOUT"
[[ $OPT_AGGRESSIVE -eq 1 ]] && dalfox_flags="$dalfox_flags --deep-domxss --follow-redirects"
[[ -n "$OPT_PROXY" ]] && dalfox_flags="$dalfox_flags --proxy $OPT_PROXY"
# shellcheck disable=SC2086
timeout 300s dalfox url "$TARGET" $dalfox_flags \
--output "${xss_dir}/dalfox_results.txt" 2>/dev/null || true
if [[ -s "${xss_dir}/dalfox_results.txt" ]] && \
grep -qiE "\[V\]|WEAK|MEDIUM|HIGH|CRITICAL" "${xss_dir}/dalfox_results.txt" 2>/dev/null; then
add_finding "HIGH" "XSS" "XSS vulnerability confirmed by dalfox" \
"dalfox identified reflected or DOM-based XSS." \
"$(head -3 "${xss_dir}/dalfox_results.txt")" \
"Escape all HTML output. Implement a strict Content-Security-Policy."
fi
fi
# ── Reflected XSS — manual probe ──────────────────────────────────────────
log_subsection "Reflected XSS Probe"
local xss_payloads=(
"<script>alert(1)</script>"
"'><img src=x onerror=alert(1)>"
"<svg onload=alert(1)>"
"\"><script>alert(1)</script>"
"javascript:alert(1)"
"';alert(1);//"
"<details open ontoggle=alert(1)>"
"<iframe srcdoc='<script>alert(1)</script>'>"
)
local xss_params=("q" "s" "search" "query" "keyword" "id" "name" "page"
"url" "ref" "return" "redirect" "next" "view" "lang")
local xss_found="${xss_dir}/reflected_xss.txt"
: > "$xss_found"
for param in "${xss_params[@]}"; do
for payload in "${xss_payloads[@]}"; do
local enc; enc=$(url_encode "$payload")
local test_url="${TARGET}?${param}=${enc}"
local response
response=$(_curl "$test_url" 2>/dev/null | head -100 || true)
if echo "$response" | grep -qF "$payload"; then
echo "[REFLECTED XSS] param=$param payload=$payload" | tee -a "$xss_found" | tee -a "$LOG_FILE"
add_finding "HIGH" "XSS" "Reflected XSS in parameter '$param'" \
"Payload is reflected verbatim in the response without encoding." \
"${test_url:0:200}" \
"Encode all user-supplied output. Add Content-Security-Policy."
break # One confirmed finding per param is enough
fi
done
done
if [[ ! -s "$xss_found" ]]; then
log_ok "No reflected XSS detected in common parameters"
fi
log_info "XSS tests → $xss_dir"
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 10 — CMS SCANNING
# ─────────────────────────────────────────────────────────────────────────────
module_cms() {
[[ $MOD_CMS -eq 0 ]] && return
log_section "MODULE 10 — CMS DETECTION & SCANNING"
local cms_dir="${OUTPUT_DIR}/cms"
# Detect CMS
local page
page=$(_curl "$TARGET" 2>/dev/null || true)
local headers
headers=$(_curl -I "$TARGET" 2>/dev/null || true)
local combined="${page}${headers}"
local detected_cms="unknown"
if echo "$combined" | grep -qi "wp-content\|wp-includes\|wordpress"; then
detected_cms="wordpress"
elif echo "$combined" | grep -qi "sites/all/modules\|Drupal.settings\|X-Generator: Drupal"; then
detected_cms="drupal"
elif echo "$combined" | grep -qi "Joomla\|/media/jui\|generator.*joomla"; then
detected_cms="joomla"
elif echo "$combined" | grep -qi "Mage.Cookies\|magento\|/skin/frontend"; then
detected_cms="magento"
fi
log_info "Detected CMS: $detected_cms"
add_finding "INFO" "CMS" "CMS detected: $detected_cms" "" "" ""
# ── WordPress ──────────────────────────────────────────────────────────────
if [[ "$detected_cms" == "wordpress" ]]; then
log_subsection "WordPress — wpscan"
if has_tool wpscan; then
local wpscan_flags="--url $TARGET --no-banner"
[[ $OPT_AGGRESSIVE -eq 1 ]] && \
wpscan_flags="$wpscan_flags --enumerate ap,at,cb,dbe,u --plugins-detection aggressive"
[[ -n "$OPT_PROXY" ]] && wpscan_flags="$wpscan_flags --proxy $OPT_PROXY"
# shellcheck disable=SC2086
timeout 600s wpscan $wpscan_flags \
--format json \
--output "${cms_dir}/wpscan_results.json" \
2>/dev/null | tee "${cms_dir}/wpscan_console.txt" || true
log_ok "wpscan → ${cms_dir}/wpscan_results.json"
if has_tool jq && [[ -f "${cms_dir}/wpscan_results.json" ]]; then
local wp_version
wp_version=$(jq -r '.version.number // "unknown"' \
"${cms_dir}/wpscan_results.json" 2>/dev/null || echo "unknown")
log_info "WordPress version: $wp_version"
local plugin_vulns
plugin_vulns=$(jq '[.plugins[]?.vulnerabilities[]?] | length' \
"${cms_dir}/wpscan_results.json" 2>/dev/null || echo 0)
[[ "$plugin_vulns" -gt 0 ]] && add_finding "HIGH" "CMS" \
"WordPress: $plugin_vulns plugin vulnerability/vulnerabilities found" \
"wpscan identified vulnerable plugins." \
"See ${cms_dir}/wpscan_results.json" \
"Update all plugins to the latest version immediately."
local theme_vulns
theme_vulns=$(jq '[.themes[]?.vulnerabilities[]?] | length' \
"${cms_dir}/wpscan_results.json" 2>/dev/null || echo 0)
[[ "$theme_vulns" -gt 0 ]] && add_finding "MEDIUM" "CMS" \
"WordPress: $theme_vulns theme vulnerability/vulnerabilities found" \
"" "See ${cms_dir}/wpscan_results.json" \
"Update all themes. Remove inactive/unused themes."
local wp_users
wp_users=$(jq '.users | length' \
"${cms_dir}/wpscan_results.json" 2>/dev/null || echo 0)
[[ "$wp_users" -gt 0 ]] && add_finding "MEDIUM" "CMS" \
"WordPress: $wp_users user(s) enumerable via the API" \
"Username enumeration can aid brute-force attacks." \
"$(jq -r '.users | keys[]' "${cms_dir}/wpscan_results.json" 2>/dev/null | head -5 | tr '\n' ' ')" \
"Add 'remove_action(\"template_redirect\",\"redirect_canonical\")' and restrict REST API user endpoint."
fi
fi
# WordPress-specific path probes
declare -A WP_PATHS=(
["/xmlrpc.php"]="MEDIUM|WordPress XML-RPC enabled — brute-force amplification risk|Disable xmlrpc.php if not required."
["/wp-json/wp/v2/users"]="MEDIUM|REST API exposes user list|Restrict REST API user endpoint."
["/wp-content/debug.log"]="HIGH|WordPress debug.log accessible|Delete file; disable WP_DEBUG_LOG in production."
["/?author=1"]="LOW|Author enumeration via ?author= parameter|Add redirect to prevent author slug leakage."
["/wp-login.php"]="INFO|WordPress login page accessible|Enable two-factor authentication; limit login attempts."
)
for wpath in "${!WP_PATHS[@]}"; do
IFS='|' read -r sev desc rec <<< "${WP_PATHS[$wpath]}"
local status
status=$(_curl -o /dev/null -w "%{http_code}" "${TARGET}${wpath}" 2>/dev/null || echo "000")
[[ "$status" =~ ^(200|301|302)$ ]] && add_finding "$sev" "CMS" "$desc" \
"" "${TARGET}${wpath} (HTTP $status)" "$rec"
done
# ── Drupal / Joomla ────────────────────────────────────────────────────────
elif [[ "$detected_cms" =~ ^(drupal|joomla)$ ]] && has_tool droopescan; then
log_subsection "droopescan — $detected_cms"
droopescan scan "$detected_cms" -u "$TARGET" \
--output-format json \
> "${cms_dir}/droopescan_${detected_cms}.json" 2>/dev/null || true
log_ok "droopescan → ${cms_dir}/droopescan_${detected_cms}.json"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 11 — CORS MISCONFIGURATION
# ─────────────────────────────────────────────────────────────────────────────
module_cors() {
[[ $MOD_CORS -eq 0 ]] && return
log_section "MODULE 11 — CORS MISCONFIGURATION"
local cors_file="${OUTPUT_DIR}/misc/cors_tests.txt"
: > "$cors_file"
local test_origins=(
"https://evil.com"
"https://${TARGET_DOMAIN}.evil.com"
"https://evil.${TARGET_DOMAIN}"
"null"
"https://attacker.io"
"http://localhost"
"https://not${TARGET_DOMAIN}"
)
log_info "Testing ${#test_origins[@]} adversarial origins..."
for origin in "${test_origins[@]}"; do
local response
response=$(_curl \
-H "Origin: ${origin}" \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: Authorization" \
-I "$TARGET" 2>/dev/null || true)
local acao acac acam
acao=$(echo "$response" | grep -i "access-control-allow-origin:" | head -1 | tr -d '\r' || true)
acac=$(echo "$response" | grep -i "access-control-allow-credentials:" | head -1 | tr -d '\r' || true)
acam=$(echo "$response" | grep -i "access-control-allow-methods:" | head -1 | tr -d '\r' || true)
printf "Origin: %s\n ACAO: %s\n ACAC: %s\n\n" "$origin" "$acao" "$acac" >> "$cors_file"
# Origin reflected back
if echo "$acao" | grep -qi "$(echo "$origin" | sed 's|https://||')"; then
local sev="MEDIUM"
echo "$acac" | grep -qi "true" && sev="CRITICAL"
add_finding "$sev" "CORS" "CORS: arbitrary origin reflected — Origin: $origin" \
"The server reflects the attacker's origin in Access-Control-Allow-Origin.$(
echo "$acac" | grep -qi 'true' && echo ' ACAC: true permits credentialed cross-origin requests.')" \
"ACAO: $acao | ACAC: $acac" \
"Validate origins against an explicit allowlist. Never reflect the Origin header directly."
fi
# Wildcard
if echo "$acao" | grep -qP ":\s*\*\s*$"; then
add_finding "MEDIUM" "CORS" "CORS wildcard (*) in Access-Control-Allow-Origin" \
"Any origin can make cross-origin requests to this endpoint." "$acao" \
"Specify allowed origins explicitly. Wildcard is unsafe for authenticated endpoints."
fi
# null origin accepted
if [[ "$origin" == "null" ]] && echo "$acao" | grep -qi "null"; then
add_finding "HIGH" "CORS" "CORS: 'null' origin accepted" \
"'null' origin can be triggered from sandboxed iframes — allows cross-origin attacks." \
"$acao" "Never allow 'null' origin in CORS policy."
fi
done
log_info "CORS tests → $cors_file"
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 12 — OPEN REDIRECT
# ─────────────────────────────────────────────────────────────────────────────
module_open_redirect() {
[[ $MOD_REDIRECT -eq 0 ]] && return
log_section "MODULE 12 — OPEN REDIRECT"
local redirect_file="${OUTPUT_DIR}/misc/open_redirect.txt"
: > "$redirect_file"
local payloads=(
"https://evil.com"
"//evil.com"
"///evil.com"
"https:evil.com"
"/\\evil.com"
"https://evil.com%2F%2E%2E"
"%2F%2Fevil.com"
"https:///evil.com"
"/%5Cevil.com"
"https://evil.com@${TARGET_DOMAIN}"
)
local params=(
"next" "url" "redirect" "redirect_uri" "redirect_url"
"return" "return_url" "returnUrl" "returnTo"
"go" "goto" "dest" "destination" "target"
"forward" "redir" "link" "to" "r" "out" "ref"
"continue" "callback" "successUrl" "failureUrl"
)
log_info "Testing ${#params[@]} params × ${#payloads[@]} payloads..."
local found=0
for param in "${params[@]}"; do
for payload in "${payloads[@]}"; do
local enc; enc=$(url_encode "$payload")
local test_url="${TARGET}?${param}=${enc}"
local location
location=$(_curl -sI -o /dev/null -w "%{redirect_url}" \
--max-redirs 0 "$test_url" 2>/dev/null || true)
if echo "$location" | grep -qi "evil\.com"; then
found=$((found + 1))
echo "[OPEN REDIRECT] param=${param} payload=${payload} → ${location}" | \
tee -a "$redirect_file" | tee -a "$LOG_FILE"
add_finding "MEDIUM" "REDIRECT" "Open Redirect via parameter '$param'" \
"Unvalidated redirect to external domain." \
"${test_url:0:200} → $location" \
"Validate redirect targets against an allowlist of internal paths/domains."
break # One finding per parameter
fi
done
done
if [[ $found -eq 0 ]]; then
log_ok "No open redirects detected in common parameters"
else
log_warn "$found open redirect(s) confirmed — see $redirect_file"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 13 — SERVER-SIDE REQUEST FORGERY (SSRF)
# ─────────────────────────────────────────────────────────────────────────────
module_ssrf() {
[[ $MOD_SSRF -eq 0 ]] && return
log_section "MODULE 13 — SERVER-SIDE REQUEST FORGERY (SSRF)"
local ssrf_file="${OUTPUT_DIR}/misc/ssrf_tests.txt"
: > "$ssrf_file"
local payloads=(
"http://127.0.0.1/"
"http://127.0.0.1:22/"
"http://127.0.0.1:8080/"
"http://localhost/"
"http://[::1]/"
"http://0.0.0.0/"
"http://2130706433/" # 127.0.0.1 decimal
"http://0x7f000001/" # 127.0.0.1 hex
"http://169.254.169.254/" # IMDS (AWS/Azure/GCP shared)
"http://169.254.169.254/latest/meta-data/"
"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
"http://metadata.google.internal/"
"http://metadata.google.internal/computeMetadata/v1/"
"http://169.254.169.254/metadata/v1/"
"http://192.168.0.1/"
"http://10.0.0.1/"
)
local params=(
"url" "uri" "src" "href" "path" "dest" "redirect"
"image" "img" "load" "fetch" "proxy" "resource"
"data" "continue" "file" "page" "feed" "host"
"api" "callback" "endpoint" "target" "domain"
)
# Cloud SSRF indicator patterns
local indicators=("ami-id" "instance-id" "availability-zone" "instance-type"
"iam" "security-credentials" "computeMetadata"
"root:" "daemon:" "mysql:" "postgres:" # /etc/passwd fragments
"127.0.0.1" "localhost" "internal")
log_info "Testing ${#params[@]} params × ${#payloads[@]} SSRF payloads..."
local found=0
for param in "${params[@]}"; do
for payload in "${payloads[@]}"; do
local enc; enc=$(url_encode "$payload")
local test_url="${TARGET}?${param}=${enc}"
local response
response=$(_curl "$test_url" 2>/dev/null | head -30 || true)
for indicator in "${indicators[@]}"; do
if echo "$response" | grep -qi "$indicator"; then
found=$((found + 1))
echo "[SSRF CONFIRMED] param=$param payload=$payload indicator=$indicator" | \
tee -a "$ssrf_file" | tee -a "$LOG_FILE"
add_finding "CRITICAL" "SSRF" "SSRF confirmed via parameter '$param'" \
"Response contains internal/cloud-metadata content ('$indicator')." \
"${test_url:0:200}" \
"Validate and allowlist outbound URLs. Block IMDS access (e.g. IMDSv2 on AWS). Use egress firewalling."
break 2 # Next param
fi
done
done
done
if [[ $found -eq 0 ]]; then
log_ok "No in-band SSRF detected"
add_finding "INFO" "SSRF" "No in-band SSRF detected on common parameters" \
"Out-of-band (OOB) SSRF may still exist. Use Burp Collaborator or Interactsh for blind testing." "" ""
fi
log_info "SSRF tests → $ssrf_file"
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 14 — SUBDOMAIN TAKEOVER
# ─────────────────────────────────────────────────────────────────────────────
module_subtakeover() {
[[ $MOD_SUBTAKEOVER -eq 0 ]] && return
log_section "MODULE 14 — SUBDOMAIN TAKEOVER"
local subs_file="${OUTPUT_DIR}/recon/subdomains.txt"
local takeover_file="${OUTPUT_DIR}/misc/subtakeover.txt"
: > "$takeover_file"
if [[ ! -s "$subs_file" ]]; then
log_info "No subdomain list available — run with MOD_RECON enabled first"
return
fi
# ── subjack ────────────────────────────────────────────────────────────────
if has_tool subjack; then
log_subsection "subjack"
subjack \
-w "$subs_file" \
-t "$OPT_THREADS" \
-timeout "$OPT_TIMEOUT" \
-o "$takeover_file" \
-ssl 2>/dev/null || true
if [[ -s "$takeover_file" ]]; then
add_finding "HIGH" "SUBTAKEOVER" "Potential subdomain takeover(s) detected by subjack" \
"$(cat "$takeover_file")" "$takeover_file" \
"Remove stale DNS records pointing to deprovisioned external services."
fi
fi
# ── Nuclei takeover templates ──────────────────────────────────────────────
if has_tool nuclei && [[ $MOD_NUCLEI -eq 1 ]]; then
log_subsection "Nuclei — takeover templates"
timeout 300s nuclei \
-l "$subs_file" \
-tags takeover \
-o "${OUTPUT_DIR}/misc/nuclei_takeover.txt" \
-silent 2>/dev/null || true
if [[ -s "${OUTPUT_DIR}/misc/nuclei_takeover.txt" ]]; then
add_finding "HIGH" "SUBTAKEOVER" "Nuclei: subdomain takeover template matched" \
"$(cat "${OUTPUT_DIR}/misc/nuclei_takeover.txt")" \
"${OUTPUT_DIR}/misc/nuclei_takeover.txt" \
"Remove the stale DNS record immediately."
fi
fi
# ── Manual CNAME → dangling-service check ──────────────────────────────────
log_subsection "Dangling CNAME analysis"
declare -A TAKEOVER_SERVICES=(
["amazonaws.com"]="AWS S3 / Elastic Beanstalk"
["elasticbeanstalk.com"]="AWS Elastic Beanstalk"
["cloudfront.net"]="AWS CloudFront"
["github.io"]="GitHub Pages"
["heroku.com"]="Heroku"
["herokussl.com"]="Heroku"
["zendesk.com"]="Zendesk"
["freshdesk.com"]="Freshdesk"
["helpscoutdocs.com"]="HelpScout"
["surge.sh"]="Surge.sh"
["netlify.app"]="Netlify"
["render.com"]="Render"
["azurewebsites.net"]="Azure Web Apps"
["azure-api.net"]="Azure API Management"
["myshopify.com"]="Shopify"
["squarespace.com"]="Squarespace"
["tumblr.com"]="Tumblr"
["ghost.io"]="Ghost"
["webflow.io"]="Webflow"
["fly.dev"]="Fly.io"
["pages.dev"]="Cloudflare Pages"
)
local sub_count; sub_count=$(wc -l < "$subs_file")
log_info "Analysing $sub_count subdomain(s) for dangling CNAMEs..."
while IFS= read -r sub; do
[[ -z "$sub" ]] && continue
local cname
cname=$(dig +short CNAME "$sub" 2>/dev/null | sed 's/\.$//' || true)
[[ -z "$cname" ]] && continue
for svc_domain in "${!TAKEOVER_SERVICES[@]}"; do
if echo "$cname" | grep -qi "$svc_domain"; then
local http_code
http_code=$(_curl -o /dev/null -w "%{http_code}" "https://${sub}" 2>/dev/null || echo "000")
if [[ "$http_code" =~ ^(404|410|403|503)$ ]]; then
echo "[TAKEOVER RISK] ${sub} → CNAME ${cname} (${TAKEOVER_SERVICES[$svc_domain]}) HTTP ${http_code}" | \
tee -a "$takeover_file" | tee -a "$LOG_FILE"
add_finding "HIGH" "SUBTAKEOVER" \
"Dangling CNAME: ${sub} → ${TAKEOVER_SERVICES[$svc_domain]}" \
"CNAME points to $cname but the resource returns HTTP $http_code — takeover may be possible." \
"${sub} → ${cname} (HTTP ${http_code})" \
"Remove the CNAME record for ${sub} or reclaim the resource at ${TAKEOVER_SERVICES[$svc_domain]}."
fi
break
fi
done
done < "$subs_file"
if [[ -s "$takeover_file" ]]; then
log_warn "Takeover findings → $takeover_file"
else
log_ok "No subdomain takeover candidates found"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# MODULE 15 — NUCLEI TEMPLATE SCAN
# ─────────────────────────────────────────────────────────────────────────────
module_nuclei() {
[[ $MOD_NUCLEI -eq 0 ]] && return
require_tool nuclei || return
log_section "MODULE 15 — NUCLEI TEMPLATE SCAN"
local nuclei_dir="${OUTPUT_DIR}/vulns/nuclei"
mkdir -p "$nuclei_dir"
local severity_filter="medium,high,critical"
[[ $OPT_AGGRESSIVE -eq 1 ]] && severity_filter="low,medium,high,critical"
local nuclei_flags="-silent -no-interactsh"
[[ -n "$OPT_PROXY" ]] && nuclei_flags="$nuclei_flags -proxy $OPT_PROXY"
log_info "Running Nuclei (severity: $severity_filter)..."
# shellcheck disable=SC2086
timeout 600s nuclei \
-u "$TARGET" \
-severity "$severity_filter" \
-o "${nuclei_dir}/nuclei_results.txt" \
-json -o "${nuclei_dir}/nuclei_results.json" \
$nuclei_flags \
2>/dev/null || true
if [[ -s "${nuclei_dir}/nuclei_results.txt" ]]; then
local ncount; ncount=$(wc -l < "${nuclei_dir}/nuclei_results.txt")
log_ok "Nuclei: $ncount finding(s) → ${nuclei_dir}/nuclei_results.txt"
grep -oP '\[.*?\]\s+\[.*?\]\s+\[.*?\]\s+.*' "${nuclei_dir}/nuclei_results.txt" 2>/dev/null | \
head -50 | while IFS= read -r finding; do
local sev="MEDIUM"
echo "$finding" | grep -qi "\[critical\]" && sev="CRITICAL"
echo "$finding" | grep -qi "\[high\]" && sev="HIGH"
echo "$finding" | grep -qi "\[low\]" && sev="LOW"
echo "$finding" | grep -qi "\[info\]" && sev="INFO"
add_finding "$sev" "NUCLEI" "${finding:0:120}" \
"" "$finding" "Review Nuclei finding and apply corresponding remediation."
done
else
log_ok "No Nuclei findings for severity level: $severity_filter"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# REPORT GENERATOR
# ─────────────────────────────────────────────────────────────────────────────
generate_reports() {
log_section "GENERATING REPORTS"
local do_all=1
[[ -n "$OPT_OUTPUT_ONLY" && "$OPT_OUTPUT_ONLY" != "all" ]] && do_all=0
local elapsed; elapsed=$(elapsed_secs)
# ── JSON REPORT ─────────────────────────────────────────────────────────────
if [[ $do_all -eq 1 || "$OPT_OUTPUT_ONLY" == "json" ]]; then
{
printf '{\n'
printf ' "metadata": {\n'
printf ' "tool": "%s",\n' "$TOOL_NAME"
printf ' "version": "%s",\n' "$TOOL_VERSION"
printf ' "author": "%s",\n' "$TOOL_AUTHOR"
printf ' "target": "%s",\n' "$TARGET"
printf ' "domain": "%s",\n' "$TARGET_DOMAIN"
printf ' "ip": "%s",\n' "${TARGET_IP:-}"
printf ' "start_time": "%s",\n' "$DATE_HUMAN"
printf ' "duration_secs": %d\n' "$elapsed"
printf ' },\n'
printf ' "summary": {\n'
printf ' "total": %d,\n' "$TOTAL_FINDINGS"
printf ' "critical": %d,\n' "$COUNT_CRITICAL"
printf ' "high": %d,\n' "$COUNT_HIGH"
printf ' "medium": %d,\n' "$COUNT_MEDIUM"
printf ' "low": %d,\n' "$COUNT_LOW"
printf ' "info": %d\n' "$COUNT_INFO"
printf ' },\n'
printf ' "findings": [\n'
local first=1
while IFS= read -r line; do
[[ -z "$line" ]] && continue
[[ $first -eq 0 ]] && printf ',\n'
printf ' %s' "$line"
first=0
done < "$FINDINGS_JSONL"
printf '\n ]\n}\n'
} > "$REPORT_JSON"
log_ok "JSON report → $REPORT_JSON"
fi
# ── TXT REPORT ──────────────────────────────────────────────────────────────
if [[ $do_all -eq 1 || "$OPT_OUTPUT_ONLY" == "txt" ]]; then
{
local sep="════════════════════════════════════════════════════════════════"
echo "$sep"
echo " ${TOOL_NAME^^} v${TOOL_VERSION} — Security Audit Report"
echo "$sep"
printf " Target : %s\n" "$TARGET"
printf " IP : %s\n" "${TARGET_IP:-N/A}"
printf " Date : %s\n" "$DATE_HUMAN"
printf " Duration : %d seconds\n" "$elapsed"
printf " Auditor : %s@%s\n" "$(whoami)" "$(hostname)"
echo "$sep"
echo ""
echo " RISK SUMMARY"
echo " ─────────────────────────────────"
printf " %-10s %d\n" "CRITICAL" "$COUNT_CRITICAL"
printf " %-10s %d\n" "HIGH" "$COUNT_HIGH"
printf " %-10s %d\n" "MEDIUM" "$COUNT_MEDIUM"
printf " %-10s %d\n" "LOW" "$COUNT_LOW"
printf " %-10s %d\n" "INFO" "$COUNT_INFO"
printf " %-10s %d\n" "TOTAL" "$TOTAL_FINDINGS"
echo ""
echo "$sep"
echo " FINDINGS"
echo "$sep"
echo ""
cat "$LOG_FILE"
} > "$REPORT_TXT"
log_ok "TXT report → $REPORT_TXT"
fi
# ── HTML REPORT ─────────────────────────────────────────────────────────────
if [[ $do_all -eq 1 || "$OPT_OUTPUT_ONLY" == "html" ]]; then
local risk_color="#3fb950"
[[ $COUNT_LOW -gt 0 ]] && risk_color="#58a6ff"
[[ $COUNT_MEDIUM -gt 0 ]] && risk_color="#d29922"
[[ $COUNT_HIGH -gt 0 ]] && risk_color="#f0883e"
[[ $COUNT_CRITICAL -gt 0 ]] && risk_color="#f85149"
local total_non_info=$(( COUNT_CRITICAL + COUNT_HIGH + COUNT_MEDIUM + COUNT_LOW ))
local bar_critical=0 bar_high=0 bar_medium=0 bar_low=0
if [[ $total_non_info -gt 0 ]]; then
bar_critical=$(( COUNT_CRITICAL * 100 / total_non_info ))
bar_high=$(( COUNT_HIGH * 100 / total_non_info ))
bar_medium=$(( COUNT_MEDIUM * 100 / total_non_info ))
bar_low=$(( COUNT_LOW * 100 / total_non_info ))
fi
cat > "$REPORT_HTML" << HTMLSTART
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>${TOOL_NAME} — ${TARGET_DOMAIN} — Security Audit Report</title>
<style>
:root {
--bg: #0d1117;
--bg2: #161b22;
--bg3: #21262d;
--border: #30363d;
--text: #c9d1d9;
--muted: #8b949e;
--green: #3fb950;
--blue: #58a6ff;
--yellow: #d29922;
--orange: #f0883e;
--red: #f85149;
--purple: #bc8cff;
--c-critical: #f85149;
--c-high: #f0883e;
--c-medium: #d29922;
--c-low: #58a6ff;
--c-info: #8b949e;
--font: 'Segoe UI', system-ui, -apple-system, sans-serif;
--mono: 'Consolas', 'Monaco', 'Courier New', monospace;
}
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
body { font-family: var(--font); background: var(--bg); color: var(--text); line-height: 1.6; font-size: 14px; }
a { color: var(--blue); text-decoration: none; }
a:hover { text-decoration: underline; }
/* ── Header ── */
header {
background: var(--bg2);
border-bottom: 1px solid var(--border);
padding: 20px 40px;
display: flex; align-items: center; justify-content: space-between;
}
.header-left h1 { font-size: 22px; color: var(--blue); font-weight: 600; }
.header-left .subtitle { color: var(--muted); font-size: 13px; margin-top: 4px; }
.risk-badge {
padding: 8px 20px; border-radius: 6px; font-size: 13px;
font-weight: 700; letter-spacing: 1px;
background: ${risk_color}22; color: ${risk_color};
border: 1px solid ${risk_color};
}
/* ── Layout ── */
main { max-width: 1280px; margin: 0 auto; padding: 32px 40px; }
.grid-2 { display: grid; grid-template-columns: 1fr 1fr; gap: 20px; margin-bottom: 28px; }
.grid-5 { display: grid; grid-template-columns: repeat(5,1fr); gap: 16px; margin-bottom: 28px; }
/* ── Cards ── */
.card {
background: var(--bg2); border: 1px solid var(--border);
border-radius: 8px; padding: 20px;
}
/* ── Severity count cards ── */
.sev-card { text-align: center; border-radius: 8px; padding: 20px; background: var(--bg2); border: 1px solid var(--border); }
.sev-card .count { font-size: 42px; font-weight: 700; line-height: 1; }
.sev-card .label { font-size: 11px; color: var(--muted); margin-top: 6px; text-transform: uppercase; letter-spacing: 1px; }
.sev-card.c { border-color: var(--c-critical); } .sev-card.c .count { color: var(--c-critical); }
.sev-card.h { border-color: var(--c-high); } .sev-card.h .count { color: var(--c-high); }
.sev-card.m { border-color: var(--c-medium); } .sev-card.m .count { color: var(--c-medium); }
.sev-card.l { border-color: var(--c-low); } .sev-card.l .count { color: var(--c-low); }
.sev-card.i .count { color: var(--c-info); }
/* ── Risk bar ── */
.risk-bar { height: 6px; background: var(--bg3); border-radius: 3px; overflow: hidden; display: flex; margin: 16px 0; }
.rb-c { background: var(--c-critical); }
.rb-h { background: var(--c-high); }
.rb-m { background: var(--c-medium); }
.rb-l { background: var(--c-low); }
/* ── Section heading ── */
h2 { font-size: 16px; font-weight: 600; margin-bottom: 16px;
padding-left: 12px; border-left: 3px solid var(--blue); color: var(--text); }
/* ── Filter bar ── */
.filter-bar { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 16px; align-items: center; }
.filter-btn {
padding: 5px 14px; border-radius: 6px; cursor: pointer; font-size: 12px;
border: 1px solid var(--border); background: var(--bg2); color: var(--muted);
transition: all .15s;
}
.filter-btn:hover { border-color: var(--blue); color: var(--blue); }
.filter-btn.active { border-color: var(--blue); color: var(--blue); background: #58a6ff11; }
.search-box {
margin-left: auto; padding: 5px 12px; border-radius: 6px; border: 1px solid var(--border);
background: var(--bg3); color: var(--text); font-size: 12px; width: 220px;
}
.search-box:focus { outline: none; border-color: var(--blue); }
/* ── Findings table ── */
.findings-table { width: 100%; border-collapse: collapse; font-size: 13px; }
.findings-table th {
background: var(--bg3); color: var(--muted); text-align: left;
padding: 10px 14px; font-weight: 500; border-bottom: 1px solid var(--border);
white-space: nowrap; position: sticky; top: 0; z-index: 10;
}
.findings-table td { padding: 10px 14px; border-bottom: 1px solid var(--border); vertical-align: top; }
.findings-table tr:hover td { background: rgba(255,255,255,.02); }
.findings-table tr[hidden] { display: none; }
/* ── Badges ── */
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 10px;
font-weight: 700; letter-spacing: .5px; white-space: nowrap;
}
.badge-CRITICAL { background: #f8514918; color: var(--c-critical); border: 1px solid var(--c-critical); }
.badge-HIGH { background: #f0883e18; color: var(--c-high); border: 1px solid var(--c-high); }
.badge-MEDIUM { background: #d2992218; color: var(--c-medium); border: 1px solid var(--c-medium); }
.badge-LOW { background: #58a6ff18; color: var(--c-low); border: 1px solid var(--c-low); }
.badge-INFO { background: #8b949e18; color: var(--c-info); border: 1px solid var(--c-info); }
.module-tag {
display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px;
background: var(--bg3); color: var(--muted); border: 1px solid var(--border);
font-family: var(--mono);
}
/* ── Evidence / recommendation ── */
.evidence {
font-family: var(--mono); font-size: 11px; color: var(--muted);
background: var(--bg3); padding: 4px 8px; border-radius: 4px;
margin-top: 5px; word-break: break-all; border-left: 2px solid var(--border);
}
.rec { font-size: 12px; color: var(--green); margin-top: 5px; }
.rec::before { content: "💡 "; }
/* ── Metadata card ── */
.meta-grid { display: grid; grid-template-columns: auto 1fr; gap: 4px 16px; font-size: 13px; }
.meta-key { color: var(--muted); }
.meta-val { color: var(--text); font-family: var(--mono); font-size: 12px; }
/* ── Footer ── */
footer { text-align: center; color: var(--muted); font-size: 12px; padding: 24px 40px;
border-top: 1px solid var(--border); margin-top: 40px; }
/* ── Empty state ── */
.empty { text-align: center; padding: 40px; color: var(--muted); font-size: 13px; }
</style>
</head>
<body>
<header>
<div class="header-left">
<h1>🔐 ${TOOL_NAME} — Security Audit Report</h1>
<div class="subtitle">${TARGET} &nbsp;|&nbsp; ${DATE_HUMAN} &nbsp;|&nbsp; ${TOOL_NAME} v${TOOL_VERSION} by ${TOOL_AUTHOR}</div>
</div>
<div class="risk-badge">
$( [[ $COUNT_CRITICAL -gt 0 ]] && echo "CRITICAL RISK" || \
[[ $COUNT_HIGH -gt 0 ]] && echo "HIGH RISK" || \
[[ $COUNT_MEDIUM -gt 0 ]] && echo "MEDIUM RISK" || \
[[ $COUNT_LOW -gt 0 ]] && echo "LOW RISK" || echo "INFO ONLY" )
</div>
</header>
<main>
<!-- Summary cards -->
<div class="grid-5">
<div class="sev-card c"><div class="count">${COUNT_CRITICAL}</div><div class="label">Critical</div></div>
<div class="sev-card h"><div class="count">${COUNT_HIGH}</div><div class="label">High</div></div>
<div class="sev-card m"><div class="count">${COUNT_MEDIUM}</div><div class="label">Medium</div></div>
<div class="sev-card l"><div class="count">${COUNT_LOW}</div><div class="label">Low</div></div>
<div class="sev-card i"><div class="count">${COUNT_INFO}</div><div class="label">Info</div></div>
</div>
<!-- Risk bar -->
<div class="risk-bar">
<div class="rb-c" style="width:${bar_critical}%"></div>
<div class="rb-h" style="width:${bar_high}%"></div>
<div class="rb-m" style="width:${bar_medium}%"></div>
<div class="rb-l" style="width:${bar_low}%"></div>
</div>
<!-- Meta + scan info -->
<div class="grid-2" style="margin-bottom:32px">
<div class="card">
<h2>Scan Metadata</h2>
<div class="meta-grid">
<span class="meta-key">Target</span> <span class="meta-val">${TARGET}</span>
<span class="meta-key">Domain</span> <span class="meta-val">${TARGET_DOMAIN}</span>
<span class="meta-key">IP</span> <span class="meta-val">${TARGET_IP:-N/A}</span>
<span class="meta-key">Date</span> <span class="meta-val">${DATE_HUMAN}</span>
<span class="meta-key">Duration</span> <span class="meta-val">${elapsed}s</span>
<span class="meta-key">Auditor</span> <span class="meta-val">$(whoami)@$(hostname)</span>
<span class="meta-key">Mode</span> <span class="meta-val">$(
[[ $OPT_AGGRESSIVE -eq 1 ]] && echo AGGRESSIVE || \
[[ $OPT_STEALTH -eq 1 ]] && echo STEALTH || echo NORMAL)</span>
<span class="meta-key">Tool</span> <span class="meta-val">${TOOL_NAME} v${TOOL_VERSION}</span>
</div>
</div>
<div class="card">
<h2>Modules Executed</h2>
<div class="meta-grid">
<span class="meta-key">Recon</span> <span class="meta-val">$( [[ $MOD_RECON -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">Port Scan</span> <span class="meta-val">$( [[ $MOD_PORTSCAN -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">Fingerprint</span> <span class="meta-val">$( [[ $MOD_FINGERPRINT -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">SSL/TLS</span> <span class="meta-val">$( [[ $MOD_SSL -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">Headers</span> <span class="meta-val">$( [[ $MOD_HEADERS -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">Dir Brute</span> <span class="meta-val">$( [[ $MOD_DIRBRUTE -eq 1 ]] && echo "✔ enabled" || echo "— skipped")</span>
<span class="meta-key">SQLi / XSS</span> <span class="meta-val">$( [[ $MOD_SQLI -eq 1 ]] && echo "✔" || echo "—") / $( [[ $MOD_XSS -eq 1 ]] && echo "✔" || echo "—")</span>
<span class="meta-key">CMS / Nuclei</span> <span class="meta-val">$( [[ $MOD_CMS -eq 1 ]] && echo "✔" || echo "—") / $( [[ $MOD_NUCLEI -eq 1 ]] && echo "✔" || echo "—")</span>
</div>
</div>
</div>
<!-- Findings -->
<h2>Security Findings (${TOTAL_FINDINGS})</h2>
<div class="filter-bar">
<button class="filter-btn active" onclick="applyFilter('ALL',this)">All (${TOTAL_FINDINGS})</button>
<button class="filter-btn" onclick="applyFilter('CRITICAL',this)">⬤ Critical (${COUNT_CRITICAL})</button>
<button class="filter-btn" onclick="applyFilter('HIGH',this)">⬤ High (${COUNT_HIGH})</button>
<button class="filter-btn" onclick="applyFilter('MEDIUM',this)">⬤ Medium (${COUNT_MEDIUM})</button>
<button class="filter-btn" onclick="applyFilter('LOW',this)">⬤ Low (${COUNT_LOW})</button>
<button class="filter-btn" onclick="applyFilter('INFO',this)">Info (${COUNT_INFO})</button>
<input class="search-box" type="text" placeholder="Search findings…" oninput="applySearch(this.value)">
</div>
<div id="no-results" class="empty" style="display:none">No findings match the current filter.</div>
<table class="findings-table" id="findings-table">
<thead>
<tr>
<th style="width:40px">#</th>
<th style="width:100px">Severity</th>
<th style="width:110px">Module</th>
<th>Finding</th>
<th style="width:140px;white-space:nowrap">Timestamp</th>
</tr>
</thead>
<tbody id="findings-body">
HTMLSTART
# Generate table rows from JSONL
local row=0
while IFS= read -r entry; do
[[ -z "$entry" ]] && continue
row=$((row + 1))
local sev mod title desc evid rec ts
if has_tool jq; then
sev=$(echo "$entry" | jq -r '.severity // "INFO"' 2>/dev/null)
mod=$(echo "$entry" | jq -r '.module // ""' 2>/dev/null)
title=$(echo "$entry"| jq -r '.title // ""' 2>/dev/null)
desc=$(echo "$entry" | jq -r '.description // ""' 2>/dev/null)
evid=$(echo "$entry" | jq -r '.evidence // ""' 2>/dev/null)
rec=$(echo "$entry" | jq -r '.recommendation // ""' 2>/dev/null)
ts=$(echo "$entry" | jq -r '.timestamp // ""' 2>/dev/null)
else
sev=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('severity','INFO'))" 2>/dev/null || echo "INFO")
mod=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('module',''))" 2>/dev/null || echo "")
title=$(echo "$entry"| python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('title',''))" 2>/dev/null || echo "")
desc=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('description',''))" 2>/dev/null || echo "")
evid=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('evidence',''))" 2>/dev/null || echo "")
rec=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('recommendation',''))" 2>/dev/null || echo "")
ts=$(echo "$entry" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('timestamp',''))" 2>/dev/null || echo "")
fi
# HTML-escape special chars
title=$(echo "$title" | sed 's/</\&lt;/g; s/>/\&gt;/g')
desc=$(echo "$desc" | sed 's/</\&lt;/g; s/>/\&gt;/g')
evid=$(echo "$evid" | sed 's/</\&lt;/g; s/>/\&gt;/g')
rec=$(echo "$rec" | sed 's/</\&lt;/g; s/>/\&gt;/g')
printf '<tr data-sev="%s" data-text="%s">\n' \
"$sev" "$(echo "$sev $mod $title $desc" | tr '[:upper:]' '[:lower:]')" >> "$REPORT_HTML"
printf ' <td>%d</td>\n' "$row" >> "$REPORT_HTML"
printf ' <td><span class="badge badge-%s">%s</span></td>\n' "$sev" "$sev" >> "$REPORT_HTML"
printf ' <td><span class="module-tag">%s</span></td>\n' "$mod" >> "$REPORT_HTML"
{
printf ' <td>\n'
printf ' <strong>%s</strong>\n' "$title"
[[ -n "$desc" ]] && printf ' <br><small style="color:var(--muted)">%s</small>\n' "$desc"
[[ -n "$evid" ]] && printf ' <div class="evidence">%s</div>\n' "$evid"
[[ -n "$rec" ]] && printf ' <div class="rec">%s</div>\n' "$rec"
printf ' </td>\n'
printf ' <td style="white-space:nowrap;color:var(--muted);font-family:var(--mono);font-size:11px">%s</td>\n' "$ts"
printf '</tr>\n'
} >> "$REPORT_HTML"
done < "$FINDINGS_JSONL"
cat >> "$REPORT_HTML" << HTMLEND
</tbody>
</table>
</main>
<footer>
Generated by <strong>${TOOL_NAME}</strong> v${TOOL_VERSION} &mdash;
<a href="${TOOL_URL}">${TOOL_URL}</a> &mdash;
For authorized security assessments only
</footer>
<script>
let currentFilter = 'ALL';
let currentSearch = '';
function applyFilter(sev, btn) {
currentFilter = sev;
document.querySelectorAll('.filter-btn').forEach(b => b.classList.remove('active'));
if (btn) btn.classList.add('active');
updateTable();
}
function applySearch(q) {
currentSearch = q.toLowerCase();
updateTable();
}
function updateTable() {
let visible = 0;
document.querySelectorAll('#findings-body tr').forEach(row => {
const sevMatch = currentFilter === 'ALL' || row.dataset.sev === currentFilter;
const textMatch = !currentSearch || (row.dataset.text || '').includes(currentSearch);
const show = sevMatch && textMatch;
row.hidden = !show;
if (show) visible++;
});
document.getElementById('no-results').style.display = visible === 0 ? '' : 'none';
}
</script>
</body>
</html>
HTMLEND
log_ok "HTML report → $REPORT_HTML"
fi
}
# ─────────────────────────────────────────────────────────────────────────────
# FINAL SUMMARY
# ─────────────────────────────────────────────────────────────────────────────
print_summary() {
log_section "AUDIT COMPLETE"
local elapsed; elapsed=$(elapsed_secs)
local risk="LOW"
[[ $COUNT_MEDIUM -gt 0 ]] && risk="MEDIUM"
[[ $COUNT_HIGH -gt 0 ]] && risk="HIGH"
[[ $COUNT_CRITICAL -gt 0 ]] && risk="CRITICAL"
local risk_color="$C_CYAN"
case "$risk" in
CRITICAL) risk_color="$C_RED" ;;
HIGH) risk_color="$C_MAGENTA" ;;
MEDIUM) risk_color="$C_YELLOW" ;;
esac
echo ""
echo -e "${C_BOLD}"
printf " ┌───────────────────────────────────────────────────┐\n"
printf " │ %-49s│\n" "TARGET : $TARGET"
printf " │ %-49s│\n" "IP : ${TARGET_IP:-N/A}"
printf " │ ${risk_color}%-49s${C_RESET}${C_BOLD}│\n" "RISK : $risk"
printf " ├───────────────────────────────────────────────────┤\n"
printf " │ ${C_RED}%-49s${C_RESET}${C_BOLD}│\n" "CRITICAL : $COUNT_CRITICAL"
printf " │ ${C_MAGENTA}%-49s${C_RESET}${C_BOLD}│\n" "HIGH : $COUNT_HIGH"
printf " │ ${C_YELLOW}%-49s${C_RESET}${C_BOLD}│\n" "MEDIUM : $COUNT_MEDIUM"
printf " │ ${C_CYAN}%-49s${C_RESET}${C_BOLD}│\n" "LOW : $COUNT_LOW"
printf " │ ${C_DIM}%-49s${C_RESET}${C_BOLD}│\n" "INFO : $COUNT_INFO"
printf " ├───────────────────────────────────────────────────┤\n"
printf " │ %-49s│\n" "TOTAL : $TOTAL_FINDINGS finding(s)"
printf " │ %-49s│\n" "DURATION : ${elapsed}s"
printf " └───────────────────────────────────────────────────┘\n"
echo -e "${C_RESET}"
echo ""
log_ok "Output directory : $OUTPUT_DIR"
log_ok "HTML report : $REPORT_HTML"
log_ok "JSON report : $REPORT_JSON"
log_ok "TXT report : $REPORT_TXT"
log_ok "Audit log : $LOG_FILE"
echo ""
}
# ─────────────────────────────────────────────────────────────────────────────
# SIGNAL HANDLING & CLEANUP
# ─────────────────────────────────────────────────────────────────────────────
handle_interrupt() {
echo ""
log_warn "Audit interrupted by user (SIGINT/SIGTERM)"
[[ -f "$LOG_FILE" ]] && echo "[INTERRUPTED] PID=$AUDIT_PID" >> "$LOG_FILE"
# Try to generate partial reports
generate_reports 2>/dev/null || true
print_summary 2>/dev/null || true
exit 130
}
trap 'handle_interrupt' INT TERM
# ─────────────────────────────────────────────────────────────────────────────
# ENTRY POINT
# ─────────────────────────────────────────────────────────────────────────────
main() {
AUDIT_START_TIME=$(date +%s)
parse_args "$@"
print_banner
# Legal notice
echo -e "${C_RED}${C_BOLD}"
printf " ╔══════════════════════════════════════════════════════╗\n"
printf " ║ ⚠ LEGAL NOTICE ║\n"
printf " ║ This tool may only be used against systems you ║\n"
printf " ║ own or have explicit written authorisation to ║\n"
printf " ║ test. Unauthorised use is illegal. ║\n"
printf " ╚══════════════════════════════════════════════════════╝\n"
echo -e "${C_RESET}"
read -r -t 5 -p " Press ENTER to continue (auto-continues in 5s)..." 2>/dev/null || true
echo ""
echo ""
log_info "Starting ${TOOL_NAME} v${TOOL_VERSION} | PID: ${AUDIT_PID}"
module_check_deps
module_target_info
module_recon
module_portscan
module_fingerprint
module_ssl
module_headers
module_dirbrute
module_nikto
module_sqli
module_xss
module_cms
module_cors
module_open_redirect
module_ssrf
module_subtakeover
module_nuclei
generate_reports
print_summary
}
main "$@"
Reference in New Issue Copy Permalink