@soulofzephir/pi-skill-pentesting 1.0.0 → 1.0.2

package/skills/pentesting/tools/exposed-files-scan.ps1

@@ -0,0 +1,333 @@
+# Exposed Files Scanner v1.0
+# Detects dangerous exposed files and directories
+
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$Target = "",
+    
+    [Parameter(Mandatory=$false)]
+    [string]$OutputDir = "site"
+)
+
+$ErrorActionPreference = "Continue"
+
+# Get current date
+$Date = Get-Date -Format "yyyy-MM-dd"
+
+# Parse target URL
+if ($Target -match "https?://") {
+    $Uri = [System.Uri]$Target
+    $Domain = $Uri.Host
+    $Scheme = $Uri.Scheme
+} else {
+    $Domain = $Target
+    $Target = "https://$Target"
+}
+
+# Create output filename
+$OutputFile = "$OutputDir/$Domain-exposed-$Date.md"
+
+# ═══════════════════════════════════════════════════════════
+# COMMON EXPOSED PATHS
+# ═══════════════════════════════════════════════════════════
+
+$ExposedPaths = @(
+    # Configuration Files
+    @{ Path = "/.env"; Risk = "CRITICAL"; Desc = "Environment variables - may contain secrets" },
+    @{ Path = "/.env.local"; Risk = "CRITICAL"; Desc = "Local environment - secrets" },
+    @{ Path = "/.env.production"; Risk = "CRITICAL"; Desc = "Production environment" },
+    @{ Path = "/.git/config"; Risk = "CRITICAL"; Desc = "Git repository config - may expose remote" },
+    @{ Path = "/.git/HEAD"; Risk = "HIGH"; Desc = "Git branch information" },
+    @{ Path = "/.git/"; Risk = "CRITICAL"; Desc = "Full .git directory exposed" },
+    @{ Path = "/wp-config.php"; Risk = "CRITICAL"; Desc = "WordPress config - DB + keys" },
+    @{ Path = "/config.php"; Risk = "CRITICAL"; Desc = "PHP configuration" },
+    @{ Path = "/settings.py"; Risk = "CRITICAL"; Desc = "Django/Python settings" },
+    @{ Path = "/config.js"; Risk = "HIGH"; Desc = "Node.js configuration" },
+    @{ Path = "/application.properties"; Risk = "CRITICAL"; Desc = "Java Spring config" },
+    @{ Path = "/.htaccess"; Risk = "MEDIUM"; Desc = "Apache config" },
+    @{ Path = "/.htpasswd"; Risk = "CRITICAL"; Desc = "HTTP Basic Auth hashes" },
+    
+    # Backup Files
+    @{ Path = "/backup.zip"; Risk = "CRITICAL"; Desc = "Compressed backup" },
+    @{ Path = "/backups.zip"; Risk = "CRITICAL"; Desc = "Compressed backup" },
+    @{ Path = "/database.zip"; Risk = "CRITICAL"; Desc = "Database backup" },
+    @{ Path = "/db.zip"; Risk = "CRITICAL"; Desc = "Database backup" },
+    @{ Path = "/database.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
+    @{ Path = "/db.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
+    @{ Path = "/dump.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
+    @{ Path = "/backup.sql"; Risk = "CRITICAL"; Desc = "Database backup" },
+    @{ Path = "/site.tar.gz"; Risk = "CRITICAL"; Desc = "Full site backup" },
+    @{ Path = "/backup.tar.gz"; Risk = "CRITICAL"; Desc = "Full backup archive" },
+    @{ Path = "/www.zip"; Risk = "CRITICAL"; Desc = "Web root backup" },
+    @{ Path = "/backup/"; Risk = "HIGH"; Desc = "Backup directory" },
+    @{ Path = "/backups/"; Risk = "HIGH"; Desc = "Backups directory" },
+    @{ Path = "/db/"; Risk = "HIGH"; Desc = "Database directory" },
+    @{ Path = "/*.bak"; Risk = "HIGH"; Desc = "Backup files" },
+    @{ Path = "/*.backup"; Risk = "HIGH"; Desc = "Backup files" },
+    @{ Path = "/old/"; Risk = "MEDIUM"; Desc = "Old files directory" },
+    @{ Path = "/tmp/"; Risk = "MEDIUM"; Desc = "Temporary files" },
+    
+    # Admin & Debug Panels
+    @{ Path = "/admin/"; Risk = "HIGH"; Desc = "Admin panel" },
+    @{ Path = "/wp-admin/"; Risk = "HIGH"; Desc = "WordPress admin" },
+    @{ Path = "/administrator/"; Risk = "HIGH"; Desc = "Administrator panel" },
+    @{ Path = "/manage/"; Risk = "MEDIUM"; Desc = "Management panel" },
+    @{ Path = "/phpmyadmin/"; Risk = "CRITICAL"; Desc = "Database UI - major exposure" },
+    @{ Path = "/pma/"; Risk = "CRITICAL"; Desc = "phpMyAdmin alias" },
+    @{ Path = "/mysql/"; Risk = "CRITICAL"; Desc = "MySQL admin" },
+    @{ Path = "/debug/"; Risk = "CRITICAL"; Desc = "Debug mode enabled" },
+    @{ Path = "/api/debug/"; Risk = "CRITICAL"; Desc = "API debug endpoint" },
+    @{ Path = "/console/"; Risk = "HIGH"; Desc = "Debug console" },
+    @{ Path = "/debug.php"; Risk = "CRITICAL"; Desc = "Debug script" },
+    @{ Path = "/test.php"; Risk = "HIGH"; Desc = "Test script" },
+    @{ Path = "/info.php"; Risk = "HIGH"; Desc = "PHP info exposure" },
+    @{ Path = "/phpinfo.php"; Risk = "HIGH"; Desc = "PHP info exposure" },
+    
+    # Spring Boot Actuator
+    @{ Path = "/actuator/"; Risk = "HIGH"; Desc = "Spring Boot actuator" },
+    @{ Path = "/actuator/env"; Risk = "CRITICAL"; Desc = "Environment variables" },
+    @{ Path = "/actuator/heapdump"; Risk = "CRITICAL"; Desc = "Heap dump - contains secrets" },
+    @{ Path = "/actuator/threaddump"; Risk = "HIGH"; Desc = "Thread information" },
+    @{ Path = "/actuator/metrics"; Risk = "MEDIUM"; Desc = "Application metrics" },
+    @{ Path = "/actuator/configprops"; Risk = "CRITICAL"; Desc = "Configuration properties" },
+    @{ Path = "/health"; Risk = "MEDIUM"; Desc = "Health check endpoint" },
+    
+    # API Documentation
+    @{ Path = "/swagger/"; Risk = "MEDIUM"; Desc = "Swagger UI" },
+    @{ Path = "/swagger-ui/"; Risk = "MEDIUM"; Desc = "Swagger documentation" },
+    @{ Path = "/swagger-ui.html"; Risk = "MEDIUM"; Desc = "Swagger HTML" },
+    @{ Path = "/api-docs/"; Risk = "MEDIUM"; Desc = "API documentation" },
+    @{ Path = "/v2/api-docs/"; Risk = "MEDIUM"; Desc = "OpenAPI v2" },
+    @{ Path = "/v3/api-docs/"; Risk = "MEDIUM"; Desc = "OpenAPI v3" },
+    @{ Path = "/graphiql/"; Risk = "HIGH"; Desc = "GraphQL IDE" },
+    @{ Path = "/graphql"; Risk = "MEDIUM"; Desc = "GraphQL endpoint" },
+    @{ Path = "/api/"; Risk = "LOW"; Desc = "API base path" },
+    @{ Path = "/api/v1/"; Risk = "LOW"; Desc = "API v1" },
+    
+    # Log Files
+    @{ Path = "/logs/"; Risk = "HIGH"; Desc = "Log directory" },
+    @{ Path = "/error.log"; Risk = "HIGH"; Desc = "Error log" },
+    @{ Path = "/access.log"; Risk = "HIGH"; Desc = "Access log" },
+    @{ Path = "/debug.log"; Risk = "HIGH"; Desc = "Debug log" },
+    @{ Path = "/application.log"; Risk = "HIGH"; Desc = "Application log" },
+    @{ Path = "/console.log"; Risk = "MEDIUM"; Desc = "Console log" },
+    
+    # Information Disclosure
+    @{ Path = "/robots.txt"; Risk = "LOW"; Desc = "Reveals hidden paths" },
+    @{ Path = "/sitemap.xml"; Risk = "LOW"; Desc = "Site structure" },
+    @{ Path = "/security.txt"; Risk = "LOW"; Desc = "Security contact" },
+    @{ Path = "/humans.txt"; Risk = "LOW"; Desc = "Developer information" },
+    @{ Path = "/crossdomain.xml"; Risk = "LOW"; Desc = "Flash policy" },
+    @{ Path = "/.well-known/security.txt"; Risk = "LOW"; Desc = "Security policy" }
+)
+
+# ═══════════════════════════════════════════════════════════
+# SCAN FUNCTION
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
+Write-Host "║  🔍 Exposed Files Scanner v1.0                    ║" -ForegroundColor Cyan
+Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "Target: $Target" -ForegroundColor White
+Write-Host ""
+
+$FoundIssues = @()
+$Scanned = 0
+
+foreach ($item in $ExposedPaths) {
+    $Scanned++
+    $Progress = [math]::Round(($Scanned / $ExposedPaths.Count) * 100)
+    Write-Progress -Activity "Scanning exposed files..." -Status "$Progress% complete" -PercentComplete $Progress
+    
+    $URL = "$Target$($item.Path)"
+    
+    try {
+        $Response = Invoke-WebRequest -Uri $URL -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
+        
+        if ($Response.StatusCode -ne 404 -and $Response.StatusCode -ne 403) {
+            $ContentType = $Response.Headers["Content-Type"] -join ", "
+            
+            $Finding = [PSCustomObject]@{
+                Path = $item.Path
+                StatusCode = $Response.StatusCode
+                Risk = $item.Risk
+                Description = $item.Desc
+                ContentType = $ContentType
+            }
+            $FoundIssues += $Finding
+            
+            $Color = switch ($item.Risk) {
+                "CRITICAL" { "Red" }
+                "HIGH" { "Yellow" }
+                "MEDIUM" { "Cyan" }
+                "LOW" { "Gray" }
+            }
+            
+            Write-Host "⚠️  FOUND [$($item.Risk)]: $($item.Path)" -ForegroundColor $Color
+            Write-Host "   Status: $($Response.StatusCode) | Type: $($ContentType.Substring(0, [Math]::Min(50, $ContentType.Length)))" -ForegroundColor Gray
+        }
+    } catch {
+        # Connection error or timeout - not found
+    }
+}
+
+Write-Progress -Activity "Scanning" -Completed
+
+# ═══════════════════════════════════════════════════════════
+# SUMMARY
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "📊 SCAN SUMMARY" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host ""
+
+$CriticalCount = ($FoundIssues | Where-Object { $_.Risk -eq "CRITICAL" }).Count
+$HighCount = ($FoundIssues | Where-Object { $_.Risk -eq "HIGH" }).Count
+$MediumCount = ($FoundIssues | Where-Object { $_.Risk -eq "MEDIUM" }).Count
+$LowCount = ($FoundIssues | Where-Object { $_.Risk -eq "LOW" }).Count
+
+Write-Host "Files Scanned: $Scanned" -ForegroundColor White
+Write-Host "Issues Found: $($FoundIssues.Count)" -ForegroundColor Yellow
+Write-Host ""
+Write-Host "🔴 CRITICAL: $CriticalCount" -ForegroundColor Red
+Write-Host "🟠 HIGH:     $HighCount" -ForegroundColor Yellow
+Write-Host "🟡 MEDIUM:   $MediumCount" -ForegroundColor Cyan
+Write-Host "🟢 LOW:      $LowCount" -ForegroundColor Gray
+
+# ═══════════════════════════════════════════════════════════
+# GENERATE REPORT
+# ═══════════════════════════════════════════════════════════
+
+if (-not (Test-Path $OutputDir)) {
+    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+}
+
+$Report = @"
+# 🔍 Exposed Files Report
+
+**Target:** $Target
+**Date:** $Date
+**Scanner:** Exposed Files Scanner v1.0
+
+---
+
+## 📋 Summary
+
+| Metric | Value |
+|--------|-------|
+| Files Scanned | $Scanned |
+| Issues Found | $($FoundIssues.Count) |
+| 🔴 CRITICAL | $CriticalCount |
+| 🟠 HIGH | $HighCount |
+| 🟡 MEDIUM | $MediumCount |
+| 🟢 LOW | $LowCount |
+
+---
+
+## 🚨 Critical Issues
+
+$(if ($CriticalCount -gt 0) {
+    $FoundIssues | Where-Object { $_.Risk -eq "CRITICAL" } | ForEach-Object {
+        @"
+### Found: $($_.Path)
+
+| Field | Value |
+|-------|-------|
+| Status Code | $($_.StatusCode) |
+| Risk Level | 🔴 $($_.Risk) |
+| Content Type | $($_.ContentType) |
+
+**Description:** $($_.Description)
+
+**Recommendation:** Immediate action required. Remove or restrict access.
+
+---
+"@
+    }
+} else {
+    "✅ No critical issues found"
+})
+
+## 🟠 High Risk Issues
+
+$(if ($HighCount -gt 0) {
+    $FoundIssues | Where-Object { $_.Risk -eq "HIGH" } | ForEach-Object {
+        @"
+- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
+"@
+    }
+} else {
+    "✅ No high-risk issues found"
+})
+
+## 🟡 Medium Risk Issues
+
+$(if ($MediumCount -gt 0) {
+    $FoundIssues | Where-Object { $_.Risk -eq "MEDIUM" } | ForEach-Object {
+        @"
+- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
+"@
+    }
+} else {
+    "✅ No medium-risk issues found"
+})
+
+## 🟢 Low Risk Issues
+
+$(if ($LowCount -gt 0) {
+    $FoundIssues | Where-Object { $_.Risk -eq "LOW" } | ForEach-Object {
+        @"
+- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
+"@
+    }
+} else {
+    "✅ No low-risk issues found"
+})
+
+---
+
+## 📝 All Findings
+
+| Path | Status | Risk | Description |
+|------|--------|------|-------------|
+$(foreach ($issue in $FoundIssues) {
+    "| $($issue.Path) | $($issue.StatusCode) | $($issue.Risk) | $($issue.Description) |"
+})
+
+---
+
+## 🛡️ Remediation Checklist
+
+- [ ] Block .env files in web server config
+- [ ] Disable .git directory listing
+- [ ] Remove backup files from web root
+- [ ] Protect admin panels with IP restriction
+- [ ] Disable debug mode in production
+- [ ] Secure Spring Boot actuator endpoints
+- [ ] Add authentication to API documentation
+- [ ] Disable directory listing
+- [ ] Remove test/debug files
+
+---
+
+**Report Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
+"@
+
+# Save report
+$Report | Out-File -FilePath $OutputFile -Encoding UTF8
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "✅ Scan Complete!" -ForegroundColor Green
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "📄 Report: $OutputFile" -ForegroundColor White
+Write-Host ""
+
+if ($CriticalCount -gt 0) {
+    Write-Host "⚠️  IMMEDIATE ACTION REQUIRED for critical findings!" -ForegroundColor Red
+}

package/skills/pentesting/tools/exposed-files-scan.sh

@@ -0,0 +1,291 @@
+#!/bin/bash
+# Exposed Files Scanner v1.0
+# Usage: ./exposed-files-scan.sh https://target.com
+
+TARGET=${1:-https://example.com}
+DATE=$(date +%Y-%m-%d)
+
+echo "========================================"
+echo "🔍 Exposed Files Scanner"
+echo "Target: $TARGET"
+echo "Date: $DATE"
+echo "========================================"
+echo ""
+
+# Parse domain from URL
+DOMAIN=$(echo "$TARGET" | sed -E 's|https?://||' | cut -d'/' -f1)
+
+# Output file
+OUTPUT="site/${DOMAIN}-exposed-${DATE}.md"
+mkdir -p site
+
+# Counters
+CRITICAL=0
+HIGH=0
+MEDIUM=0
+LOW=0
+FOUND_COUNT=0
+
+# Color codes
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+# ═══════════════════════════════════════════════════════════
+# EXPOSED PATHS TO CHECK
+# ═══════════════════════════════════════════════════════════
+
+check_path() {
+    local PATH=$1
+    local RISK=$2
+    local DESC=$3
+    
+    STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${TARGET}${PATH}" --max-time 5)
+    
+    if [ "$STATUS" != "404" ] && [ "$STATUS" != "000" ] && [ "$STATUS" != "403" ]; then
+        FOUND_COUNT=$((FOUND_COUNT + 1))
+        
+        case $RISK in
+            "CRITICAL")
+                CRITICAL=$((CRITICAL + 1))
+                echo -e "${RED}⚠️  FOUND [CRITICAL]: ${PATH}${NC}"
+                echo "   Status: $STATUS | $DESC"
+                echo "$PATH|$STATUS|CRITICAL|$DESC" >> /tmp/found_issues.tmp
+                ;;
+            "HIGH")
+                HIGH=$((HIGH + 1))
+                echo -e "${YELLOW}⚠️  FOUND [HIGH]: ${PATH}${NC}"
+                echo "   Status: $STATUS | $DESC"
+                echo "$PATH|$STATUS|HIGH|$DESC" >> /tmp/found_issues.tmp
+                ;;
+            "MEDIUM")
+                MEDIUM=$((MEDIUM + 1))
+                echo -e "${CYAN}⚠️  FOUND [MEDIUM]: ${PATH}${NC}"
+                echo "   Status: $STATUS | $DESC"
+                echo "$PATH|$STATUS|MEDIUM|$DESC" >> /tmp/found_issues.tmp
+                ;;
+            "LOW")
+                LOW=$((LOW + 1))
+                echo -e "${NC}ℹ️  FOUND [LOW]: ${PATH}"
+                echo "   Status: $STATUS | $DESC"
+                echo "$PATH|$STATUS|LOW|$DESC" >> /tmp/found_issues.tmp
+                ;;
+        esac
+    fi
+}
+
+echo "Scanning for exposed files..."
+echo ""
+
+# Configuration Files
+check_path "/.env" "CRITICAL" "Environment variables with secrets"
+check_path "/.env.local" "CRITICAL" "Local environment variables"
+check_path "/.env.production" "CRITICAL" "Production environment"
+check_path "/.git/config" "CRITICAL" "Git repository config"
+check_path "/.git/HEAD" "HIGH" "Git branch info"
+check_path "/.git/" "CRITICAL" "Full .git directory"
+check_path "/wp-config.php" "CRITICAL" "WordPress config - DB + keys"
+check_path "/config.php" "CRITICAL" "PHP configuration"
+check_path "/settings.py" "CRITICAL" "Django/Python settings"
+check_path "/config.js" "HIGH" "Node.js configuration"
+check_path "/application.properties" "CRITICAL" "Java Spring config"
+check_path "/.htaccess" "MEDIUM" "Apache config"
+check_path "/.htpasswd" "CRITICAL" "HTTP Basic Auth hashes"
+
+# Backup Files
+check_path "/backup.zip" "CRITICAL" "Compressed backup"
+check_path "/backups.zip" "CRITICAL" "Compressed backup"
+check_path "/database.zip" "CRITICAL" "Database backup"
+check_path "/database.sql" "CRITICAL" "Database dump"
+check_path "/db.sql" "CRITICAL" "Database dump"
+check_path "/dump.sql" "CRITICAL" "Database dump"
+check_path "/site.tar.gz" "CRITICAL" "Full site backup"
+check_path "/www.zip" "CRITICAL" "Web root backup"
+check_path "/backup.tar.gz" "CRITICAL" "Backup archive"
+check_path "/backup/" "HIGH" "Backup directory"
+check_path "/backups/" "HIGH" "Backups directory"
+
+# Admin & Debug Panels
+check_path "/admin/" "HIGH" "Admin panel"
+check_path "/wp-admin/" "HIGH" "WordPress admin"
+check_path "/administrator/" "HIGH" "Administrator panel"
+check_path "/phpmyadmin/" "CRITICAL" "Database UI"
+check_path "/pma/" "CRITICAL" "phpMyAdmin alias"
+check_path "/debug/" "CRITICAL" "Debug mode enabled"
+check_path "/api/debug/" "CRITICAL" "API debug endpoint"
+check_path "/console/" "HIGH" "Debug console"
+check_path "/debug.php" "CRITICAL" "Debug script"
+check_path "/test.php" "HIGH" "Test script"
+check_path "/info.php" "HIGH" "PHP info exposure"
+check_path "/phpinfo.php" "HIGH" "PHP info exposure"
+
+# Spring Boot Actuator
+check_path "/actuator/" "HIGH" "Spring Boot actuator"
+check_path "/actuator/env" "CRITICAL" "Environment variables"
+check_path "/actuator/heapdump" "CRITICAL" "Heap dump - secrets"
+check_path "/actuator/threaddump" "HIGH" "Thread information"
+check_path "/actuator/configprops" "CRITICAL" "Configuration properties"
+check_path "/health" "MEDIUM" "Health check"
+
+# API Documentation
+check_path "/swagger/" "MEDIUM" "Swagger UI"
+check_path "/swagger-ui/" "MEDIUM" "Swagger documentation"
+check_path "/swagger-ui.html" "MEDIUM" "Swagger HTML"
+check_path "/api-docs/" "MEDIUM" "API documentation"
+check_path "/v2/api-docs/" "MEDIUM" "OpenAPI v2"
+check_path "/v3/api-docs/" "MEDIUM" "OpenAPI v3"
+check_path "/graphiql/" "HIGH" "GraphQL IDE"
+check_path "/graphql" "MEDIUM" "GraphQL endpoint"
+
+# Log Files
+check_path "/logs/" "HIGH" "Log directory"
+check_path "/error.log" "HIGH" "Error log"
+check_path "/access.log" "HIGH" "Access log"
+check_path "/debug.log" "HIGH" "Debug log"
+check_path "/application.log" "HIGH" "Application log"
+
+# Information Disclosure
+check_path "/robots.txt" "LOW" "Reveals hidden paths"
+check_path "/sitemap.xml" "LOW" "Site structure"
+check_path "/security.txt" "LOW" "Security contact"
+check_path "/humans.txt" "LOW" "Developer information"
+
+# ═══════════════════════════════════════════════════════════
+# SUMMARY
+# ═══════════════════════════════════════════════════════════
+
+echo ""
+echo "========================================"
+echo "📊 SCAN SUMMARY"
+echo "========================================"
+echo ""
+echo "Files Scanned: 50+"
+echo "Issues Found: $FOUND_COUNT"
+echo ""
+echo -e "${RED}🔴 CRITICAL: $CRITICAL${NC}"
+echo -e "${YELLOW}🟠 HIGH:     $HIGH${NC}"
+echo -e "${CYAN}🟡 MEDIUM:   $MEDIUM${NC}"
+echo -e "${NC}🟢 LOW:      $LOW${NC}"
+
+# ═══════════════════════════════════════════════════════════
+# GENERATE REPORT
+# ═══════════════════════════════════════════════════════════
+
+cat > "$OUTPUT" << 'REPORT_EOF'
+# 🔍 Exposed Files Report
+
+**Target:** TARGET_PLACEHOLDER
+**Date:** DATE_PLACEHOLDER
+**Scanner:** Exposed Files Scanner v1.0
+
+---
+
+## 📋 Summary
+
+| Metric | Value |
+|--------|-------|
+| Files Scanned | 50+ |
+| Issues Found | FOUND_COUNT_PLACEHOLDER |
+| 🔴 CRITICAL | CRITICAL_PLACEHOLDER |
+| 🟠 HIGH | HIGH_PLACEHOLDER |
+| 🟡 MEDIUM | MEDIUM_PLACEHOLDER |
+| 🟢 LOW | LOW_PLACEHOLDER |
+
+---
+
+## 🚨 Critical Issues
+
+CRITICAL_ISSUES_PLACEHOLDER
+
+## 🟠 High Risk Issues
+
+HIGH_ISSUES_PLACEHOLDER
+
+## 🟡 Medium Risk Issues
+
+MEDIUM_ISSUES_PLACEHOLDER
+
+## 🟢 Low Risk Issues
+
+LOW_ISSUES_PLACEHOLDER
+
+---
+
+## 📝 All Findings
+
+| Path | Status | Risk | Description |
+|------|--------|------|-------------|
+ALL_FINDINGS_PLACEHOLDER
+
+---
+
+## 🛡️ Remediation Checklist
+
+- [ ] Block .env files in web server config
+- [ ] Disable .git directory listing
+- [ ] Remove backup files from web root
+- [ ] Protect admin panels with IP restriction
+- [ ] Disable debug mode in production
+- [ ] Secure Spring Boot actuator endpoints
+- [ ] Add authentication to API documentation
+- [ ] Disable directory listing
+- [ ] Remove test/debug files
+
+---
+
+**Report Generated:** TIMESTAMP_PLACEHOLDER
+REPORT_EOF
+
+# Replace placeholders
+sed -i "s|TARGET_PLACEHOLDER|$TARGET|g" "$OUTPUT"
+sed -i "s|DATE_PLACEHOLDER|$DATE|g" "$OUTPUT"
+sed -i "s|FOUND_COUNT_PLACEHOLDER|$FOUND_COUNT|g" "$OUTPUT"
+sed -i "s|CRITICAL_PLACEHOLDER|$CRITICAL|g" "$OUTPUT"
+sed -i "s|HIGH_PLACEHOLDER|$HIGH|g" "$OUTPUT"
+sed -i "s|MEDIUM_PLACEHOLDER|$MEDIUM|g" "$OUTPUT"
+sed -i "s|LOW_PLACEHOLDER|$LOW|g" "$OUTPUT"
+sed -i "s|TIMESTAMP_PLACEHOLDER|$(date '+%Y-%m-%d %H:%M:%S')|g" "$OUTPUT"
+
+# Add critical issues
+if [ $CRITICAL -gt 0 ]; then
+    sed -i 's|CRITICAL_ISSUES_PLACEHOLDER||g' "$OUTPUT"
+    while IFS='|' read -r path status risk desc; do
+        if [ "$risk" = "CRITICAL" ]; then
+            sed -i "s|CRITICAL_ISSUES_PLACEHOLDER|CRITICAL_ISSUES_PLACEHOLDER\n\n### Found: $path\n\n| Field | Value |\n|-------|-------|\n| Status Code | $status |\n| Risk Level | 🔴 CRITICAL |\n\n**Description:** $desc\n\n**Recommendation:** Immediate action required.|\n|g" "$OUTPUT"
+        fi
+    done < /tmp/found_issues.tmp
+    sed -i 's|CRITICAL_ISSUES_PLACEHOLDER|✅ No critical issues found|g' "$OUTPUT"
+else
+    sed -i 's|CRITICAL_ISSUES_PLACEHOLDER|✅ No critical issues found|g' "$OUTPUT"
+fi
+
+# Add all findings
+if [ -f /tmp/found_issues.tmp ]; then
+    ALL_FINDINGS=""
+    while IFS='|' read -r path status risk desc; do
+        ALL_FINDINGS="$ALL_FINDINGS\n| $path | $status | $risk | $desc |"
+    done < /tmp/found_issues.tmp
+    sed -i "s|ALL_FINDINGS_PLACEHOLDER|$ALL_FINDINGS|g" "$OUTPUT"
+    rm /tmp/found_issues.tmp
+else
+    sed -i 's|ALL_FINDINGS_PLACEHOLDER||g' "$OUTPUT"
+fi
+
+# Clear remaining placeholders
+sed -i 's|HIGH_ISSUES_PLACEHOLDER|✅ No high-risk issues found|g' "$OUTPUT"
+sed -i 's|MEDIUM_ISSUES_PLACEHOLDER|✅ No medium-risk issues found|g' "$OUTPUT"
+sed -i 's|LOW_ISSUES_PLACEHOLDER|✅ No low-risk issues found|g' "$OUTPUT"
+
+echo ""
+echo "========================================"
+echo "✅ Scan Complete!"
+echo "========================================"
+echo ""
+echo "📄 Report: $OUTPUT"
+echo ""
+
+if [ $CRITICAL -gt 0 ]; then
+    echo -e "${RED}⚠️  IMMEDIATE ACTION REQUIRED for critical findings!${NC}"
+fi