@soulofzephir/pi-skill-pentesting 1.0.0 → 1.0.1

package/skills/pentesting/tools/full-scan.sh

@@ -0,0 +1,454 @@
+#!/bin/bash
+# Full Security Scan - All-in-One v2.0
+# Usage: ./full-scan.sh https://target.com
+
+TARGET=${1:-https://example.com}
+DATE=$(date +%Y-%m-%d)
+
+# Parse domain
+DOMAIN=$(echo "$TARGET" | sed -E 's|https?://||' | cut -d'/' -f1 | cut -d':' -f1)
+
+# Output
+OUTPUT="site/${DOMAIN}-${DATE}.md"
+mkdir -p site
+
+# Colors
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# ═══════════════════════════════════════════════════════════
+# BANNER
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "╔═══════════════════════════════════════════════════╗"
+echo "║  🛡️ FULL SECURITY SCAN v2.0                     ║"
+echo "║  Target: $DOMAIN"
+echo "║  Date: $DATE"
+echo "╚═══════════════════════════════════════════════════╝"
+echo ""
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 1: SECURITY HEADERS
+# ═══════════════════════════════════════════════════════════
+
+echo "═══════════════════════════════════════════════════"
+echo "🔒 PHASE 1: Security Headers"
+echo "═══════════════════════════════════════════════════"
+
+HEADER_SCORE=0
+HEADER_ISSUES=""
+
+# Get headers
+HEADERS=$(curl -I -s -L "$TARGET" 2>/dev/null)
+
+# HSTS
+if echo "$HEADERS" | grep -qi "strict-transport-security"; then
+    echo -e "${GREEN}✅ HSTS: Present${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 15))
+else
+    echo -e "${RED}❌ HSTS: Missing${NC}"
+    HEADER_ISSUES="$HEADER_ISSUES - HSTS not implemented\n"
+fi
+
+# CSP
+if echo "$HEADERS" | grep -qi "content-security-policy"; then
+    echo -e "${GREEN}✅ CSP: Present${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 20))
+else
+    echo -e "${RED}❌ CSP: Missing${NC}"
+    HEADER_ISSUES="$HEADER_ISSUES - CSP not implemented (XSS risk)\n"
+fi
+
+# X-Content-Type-Options
+if echo "$HEADERS" | grep -qi "x-content-type-options.*nosniff"; then
+    echo -e "${GREEN}✅ X-Content-Type-Options: nosniff${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 10))
+else
+    echo -e "${RED}❌ X-Content-Type-Options: Missing${NC}"
+    HEADER_ISSUES="$HEADER_ISSUES - X-Content-Type-Options not set\n"
+fi
+
+# X-Frame-Options
+if echo "$HEADERS" | grep -qiE "x-frame-options.*(DENY|SAMEORIGIN)"; then
+    XFO=$(echo "$HEADERS" | grep -i "x-frame-options" | head -1)
+    echo -e "${GREEN}✅ X-Frame-Options: $XFO${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 10))
+else
+    echo -e "${RED}❌ X-Frame-Options: Missing${NC}"
+    HEADER_ISSUES="$HEADER_ISSUES - X-Frame-Options not set\n"
+fi
+
+# Referrer-Policy
+if echo "$HEADERS" | grep -qi "referrer-policy"; then
+    echo -e "${GREEN}✅ Referrer-Policy: Present${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 10))
+else
+    echo -e "${YELLOW}⚠️  Referrer-Policy: Missing${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 5))
+fi
+
+# Cache-Control
+if echo "$HEADERS" | grep -qi "cache-control.*no-store\|cache-control.*no-cache"; then
+    echo -e "${GREEN}✅ Cache-Control: Secure${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 10))
+else
+    echo -e "${YELLOW}⚠️  Cache-Control: Check configuration${NC}"
+    HEADER_SCORE=$((HEADER_SCORE + 5))
+fi
+
+# Server
+SERVER=$(echo "$HEADERS" | grep -i "^server:" | head -1)
+if [ -n "$SERVER" ]; then
+    if echo "$SERVER" | grep -qE "/\d|Advanced|Version"; then
+        echo -e "${YELLOW}⚠️  Server: Leaks version - $SERVER${NC}"
+        HEADER_ISSUES="$HEADER_ISSUES - Server header leaks version\n"
+    else
+        echo -e "${YELLOW}⚠️  Server: $SERVER${NC}"
+    fi
+fi
+
+# X-Powered-By
+XPB=$(echo "$HEADERS" | grep -i "x-powered-by" | head -1)
+if [ -n "$XPB" ]; then
+    echo -e "${YELLOW}⚠️  X-Powered-By: $XPB${NC}"
+    HEADER_ISSUES="$HEADER_ISSUES - X-Powered-By leaks technology\n"
+fi
+
+echo ""
+echo "📊 Header Score: $HEADER_SCORE/100"
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 2: EXPOSED FILES
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo "🔍 PHASE 2: Exposed Files Check"
+echo "═══════════════════════════════════════════════════"
+
+EXPOSED_COUNT=0
+EXPOSED_LIST=""
+
+check_path() {
+    local PATH=$1
+    local RISK=$2
+    
+    STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${TARGET}${PATH}" --max-time 5)
+    
+    if [ "$STATUS" != "404" ] && [ "$STATUS" != "000" ] && [ "$STATUS" != "403" ]; then
+        EXPOSED_COUNT=$((EXPOSED_COUNT + 1))
+        echo -e "${RED}⚠️  FOUND: ${PATH} (HTTP $STATUS)${NC}"
+        EXPOSED_LIST="$EXPOSED_LIST| $PATH | $STATUS | $RISK |\n"
+    fi
+}
+
+check_path "/.env" "CRITICAL"
+check_path "/.git/config" "CRITICAL"
+check_path "/.git/HEAD" "HIGH"
+check_path "/.git/" "CRITICAL"
+check_path "/wp-config.php" "CRITICAL"
+check_path "/config.php" "CRITICAL"
+check_path "/settings.py" "CRITICAL"
+check_path "/backup.zip" "CRITICAL"
+check_path "/database.sql" "CRITICAL"
+check_path "/db.sql" "CRITICAL"
+check_path "/admin/" "HIGH"
+check_path "/debug/" "CRITICAL"
+check_path "/phpmyadmin/" "CRITICAL"
+check_path "/pma/" "CRITICAL"
+check_path "/actuator/env" "CRITICAL"
+check_path "/actuator/heapdump" "CRITICAL"
+check_path "/swagger-ui/" "MEDIUM"
+check_path "/graphiql/" "HIGH"
+
+if [ $EXPOSED_COUNT -eq 0 ]; then
+    echo -e "${GREEN}✅ No critical files exposed${NC}"
+fi
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 3: PORT CHECK
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo "🔌 PHASE 3: Quick Port Check"
+echo "═══════════════════════════════════════════════════"
+
+HIGH_RISK_PORTS=0
+PORT_LIST=""
+
+check_port() {
+    local PORT=$1
+    local SERVICE=$2
+    local RISK=$3
+    
+    timeout 1 bash -c "echo >/dev/tcp/$DOMAIN/$PORT" 2>/dev/null
+    if [ $? -eq 0 ]; then
+        echo "⚠️  Port $PORT ($SERVICE) - OPEN"
+        PORT_LIST="$PORT_LIST| $PORT | $SERVICE | $RISK |\n"
+        if [ "$RISK" = "HIGH" ]; then
+            HIGH_RISK_PORTS=$((HIGH_RISK_PORTS + 1))
+        fi
+    fi
+}
+
+check_port 80 "HTTP" "INFO"
+check_port 443 "HTTPS" "INFO"
+check_port 8080 "HTTP-Alt" "MEDIUM"
+check_port 3306 "MySQL" "HIGH"
+check_port 5432 "PostgreSQL" "HIGH"
+check_port 6379 "Redis" "HIGH"
+check_port 27017 "MongoDB" "HIGH"
+check_port 22 "SSH" "MEDIUM"
+
+if [ -z "$PORT_LIST" ]; then
+    echo -e "${GREEN}✅ No common ports detected${NC}"
+fi
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 4: BASIC INJECTION TEST
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo "💉 PHASE 4: Basic Injection Tests"
+echo "═══════════════════════════════════════════════════"
+
+# XSS Test
+echo "Testing XSS..." -n
+XSS_PAYLOAD="<script>alert(1)</script>"
+RESPONSE=$(curl -s "${TARGET}/search?q=${XSS_PAYLOAD}" 2>/dev/null)
+if echo "$RESPONSE" | grep -q "$XSS_PAYLOAD"; then
+    echo -e "${YELLOW}⚠️  Possible XSS reflection${NC}"
+else
+    echo -e "${GREEN}✅ No obvious XSS reflection${NC}"
+fi
+
+# SQLi Test
+echo "Testing SQL Injection..." -n
+SQL_PAYLOAD="' OR '1'='1"
+RESPONSE=$(curl -s "${TARGET}/?id=${SQL_PAYLOAD}" 2>/dev/null)
+SQL_ERRORS="SQL syntax|MySQL|PostgreSQL|sqlite|Microsoft SQL|Warning: mysql|error in your SQL"
+if echo "$RESPONSE" | grep -qiE "$SQL_ERRORS"; then
+    echo -e "${YELLOW}⚠️  SQL error detected${NC}"
+else
+    echo -e "${GREEN}✅ No obvious SQL errors${NC}"
+fi
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 5: SSL/TLS CHECK
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo "🔐 PHASE 5: SSL/TLS Check"
+echo "═══════════════════════════════════════════════════"
+
+if echo "$TARGET" | grep -q "https"; then
+    echo -e "${GREEN}✅ HTTPS enabled${NC}"
+    echo "📝 For full SSL analysis: https://ssllabs.com/ssltest/analyze.html?d=$DOMAIN"
+else
+    echo -e "${RED}❌ HTTPS not enforced${NC}"
+fi
+
+# ═══════════════════════════════════════════════════════════
+# SUMMARY
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo "📊 SCAN SUMMARY"
+echo "═══════════════════════════════════════════════════"
+echo ""
+echo "🔒 Header Score:  $HEADER_SCORE/100"
+echo "🔍 Exposed Files: $EXPOSED_COUNT"
+echo "🔌 High-Risk Ports: $HIGH_RISK_PORTS"
+echo ""
+
+# ═══════════════════════════════════════════════════════════
+# GENERATE REPORT
+# ═══════════════════════════════════════════════════════════
+
+echo "📝 Generating detailed report..."
+
+cat > "$OUTPUT" << 'REPORT_EOF'
+# 🛡️ Full Security Audit Report
+
+**Target:** TARGET_PLACEHOLDER
+**Domain:** DOMAIN_PLACEHOLDER
+**Date:** DATE_PLACEHOLDER
+**Scanner:** Full Security Scan v2.0
+
+---
+
+## 📋 Executive Summary
+
+| Metric | Value |
+|--------|-------|
+| Target | TARGET_PLACEHOLDER |
+| Scan Date | DATE_PLACEHOLDER |
+| Header Score | HEADER_SCORE_PLACEHOLDER/100 |
+| Exposed Files | EXPOSED_COUNT_PLACEHOLDER |
+| High-Risk Ports | HIGH_RISK_PORTS_PLACEHOLDER |
+
+### Overall Risk Assessment
+
+OVERALL_RISK_PLACEHOLDER
+
+---
+
+## 🔒 1. Security Headers Analysis
+
+### Header Score: HEADER_SCORE_PLACEHOLDER/100
+
+HEADER_GRADE_PLACEHOLDER
+
+### Issues Found
+
+HEADER_ISSUES_PLACEHOLDER
+
+---
+
+## 🔍 2. Exposed Files Check
+
+EXPOSED_SUMMARY_PLACEHOLDER
+
+EXPOSED_LIST_PLACEHOLDER
+
+---
+
+## 🔌 3. Port Scan Results
+
+PORT_SUMMARY_PLACEHOLDER
+
+PORT_LIST_PLACEHOLDER
+
+---
+
+## 💉 4. Injection Tests
+
+| Test | Status |
+|------|--------|
+| XSS Reflection | ⚠️ Review manually |
+| SQL Injection | ⚠️ Review manually |
+
+---
+
+## 🔐 5. SSL/TLS
+
+SSL_STATUS_PLACEHOLDER
+
+---
+
+## 🛡️ Remediation Priority
+
+### Immediate (Critical)
+1. Implement missing security headers
+2. Remove/block exposed sensitive files (.env, .git/, backups)
+3. Close database ports from public access
+
+### Short-term
+1. Enable HSTS with long max-age
+2. Configure Content-Security-Policy
+3. Set up proper Cache-Control
+4. Hide server information
+
+---
+
+## 🔗 Recommended Tools
+
+- Nuclei - Vulnerability scanning
+- SQLMap - SQL injection testing
+- Dalfox - XSS scanning
+- Nmap - Full port scan
+
+---
+
+## 📄 Report Location
+
+**File:** OUTPUT_PLACEHOLDER
+**Generated:** TIMESTAMP_PLACEHOLDER
+**Author:** Rz (@soulofzephir)
+
+---
+
+**⚠️ Disclaimer:** Automated scan. Manual testing recommended.
+REPORT_EOF
+
+# Replace placeholders
+sed -i "s|TARGET_PLACEHOLDER|$TARGET|g" "$OUTPUT"
+sed -i "s|DOMAIN_PLACEHOLDER|$DOMAIN|g" "$OUTPUT"
+sed -i "s|DATE_PLACEHOLDER|$DATE|g" "$OUTPUT"
+sed -i "s|HEADER_SCORE_PLACEHOLDER|$HEADER_SCORE|g" "$OUTPUT"
+sed -i "s|EXPOSED_COUNT_PLACEHOLDER|$EXPOSED_COUNT|g" "$OUTPUT"
+sed -i "s|HIGH_RISK_PORTS_PLACEHOLDER|$HIGH_RISK_PORTS|g" "$OUTPUT"
+sed -i "s|OUTPUT_PLACEHOLDER|$OUTPUT|g" "$OUTPUT"
+sed -i "s|TIMESTAMP_PLACEHOLDER|$(date '+%Y-%m-%d %H:%M:%S')|g" "$OUTPUT"
+
+# Header grade
+if [ $HEADER_SCORE -ge 90 ]; then
+    sed -i 's|HEADER_GRADE_PLACEHOLDER|✅ **Grade A - Excellent**|g' "$OUTPUT"
+elif [ $HEADER_SCORE -ge 70 ]; then
+    sed -i 's|HEADER_GRADE_PLACEHOLDER|✅ **Grade B - Good**|g' "$OUTPUT"
+elif [ $HEADER_SCORE -ge 50 ]; then
+    sed -i 's|HEADER_GRADE_PLACEHOLDER|⚠️ **Grade C - Needs Improvement**|g' "$OUTPUT"
+else
+    sed -i 's|HEADER_GRADE_PLACEHOLDER|❌ **Grade D/F - Poor**|g' "$OUTPUT"
+fi
+
+# Overall risk
+if [ $HEADER_SCORE -lt 50 ] || [ $EXPOSED_COUNT -gt 0 ] || [ $HIGH_RISK_PORTS -gt 0 ]; then
+    sed -i 's|OVERALL_RISK_PLACEHOLDER|🔴 **HIGH RISK** - Issues found requiring immediate attention|g' "$OUTPUT"
+elif [ $HEADER_SCORE -lt 70 ] || [ $EXPOSED_COUNT -gt 0 ]; then
+    sed -i 's|OVERALL_RISK_PLACEHOLDER|🟠 **MEDIUM RISK** - Some security improvements recommended|g' "$OUTPUT"
+else
+    sed -i 's|OVERALL_RISK_PLACEHOLDER|🟢 **LOW RISK** - Minor issues to address|g' "$OUTPUT"
+fi
+
+# Header issues
+if [ -n "$HEADER_ISSUES" ]; then
+    sed -i "s|HEADER_ISSUES_PLACEHOLDER|$HEADER_ISSUES|g" "$OUTPUT"
+else
+    sed -i 's|HEADER_ISSUES_PLACEHOLDER|✅ No major header issues|g' "$OUTPUT"
+fi
+
+# Exposed files summary
+if [ $EXPOSED_COUNT -gt 0 ]; then
+    sed -i 's|EXPOSED_SUMMARY_PLACEHOLDER|### 🚨 Found EXPOSED_COUNT_PLACEHOLDER Exposed Files|g' "$OUTPUT"
+else
+    sed -i 's|EXPOSED_SUMMARY_PLACEHOLDER|### ✅ No Critical Files Exposed|g' "$OUTPUT"
+fi
+
+# Port summary
+if [ $HIGH_RISK_PORTS -gt 0 ]; then
+    sed -i 's|PORT_SUMMARY_PLACEHOLDER|### 🚨 High-Risk Ports Open|g' "$OUTPUT"
+else
+    sed -i 's|PORT_SUMMARY_PLACEHOLDER|### ✅ No High-Risk Ports Detected|g' "$OUTPUT"
+fi
+
+# SSL status
+if echo "$TARGET" | grep -q "https"; then
+    sed -i 's|SSL_STATUS_PLACEHOLDER|✅ HTTPS is enabled|g' "$OUTPUT"
+else
+    sed -i 's|SSL_STATUS_PLACEHOLDER|❌ HTTPS is NOT enabled|g' "$OUTPUT"
+fi
+
+# ═══════════════════════════════════════════════════════════
+# COMPLETE
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "═══════════════════════════════════════════════════"
+echo -e "${GREEN}✅ FULL SCAN COMPLETE!${NC}"
+echo "═══════════════════════════════════════════════════"
+echo ""
+echo "📄 Report: $OUTPUT"
+echo ""
+echo "🔗 Quick Links:"
+echo "   Headers: https://securityheaders.com/?q=$DOMAIN"
+echo "   SSL:     https://ssllabs.com/ssltest/analyze.html?d=$DOMAIN"
+echo ""