@soulofzephir/pi-skill-pentesting 1.0.0 → 1.0.2

package/skills/pentesting/tools/full-scan.ps1

@@ -0,0 +1,508 @@
+# Full Security Scan - All-in-One v2.0
+# Comprehensive security scanner combining all tools
+
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$Target = "",
+    
+    [Parameter(Mandatory=$false)]
+    [string]$OutputDir = "site"
+)
+
+$ErrorActionPreference = "Continue"
+
+# ═══════════════════════════════════════════════════════════
+# CONFIGURATION
+# ═══════════════════════════════════════════════════════════
+
+$Date = Get-Date -Format "yyyy-MM-dd"
+
+if ($Target -match "https?://") {
+    $Uri = [System.Uri]$Target
+    $Domain = $Uri.Host
+    $Scheme = $Uri.Scheme
+} else {
+    $Domain = $Target
+    $Target = "https://$Target"
+}
+
+$OutputFile = "$OutputDir/$Domain-$Date.md"
+
+if (-not (Test-Path $OutputDir)) {
+    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+}
+
+# ═══════════════════════════════════════════════════════════
+# BANNER
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
+Write-Host "║  🛡️ FULL SECURITY SCAN v2.0                     ║" -ForegroundColor Cyan
+Write-Host "║  Target: $Domain" -ForegroundColor Cyan
+Write-Host "║  Date: $Date" -ForegroundColor Cyan
+Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host ""
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 1: SECURITY HEADERS
+# ═══════════════════════════════════════════════════════════
+
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "🔒 PHASE 1: Security Headers" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+
+$HeaderScore = 0
+$HeaderIssues = @()
+
+try {
+    $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 15 -ErrorAction Stop
+    $Headers = $Response.Headers
+} catch {
+    try {
+        $Response = Invoke-WebRequest -Uri ($Target -replace "^https", "http") -Method Head -TimeoutSec 15 -ErrorAction Stop
+        $Headers = $Response.Headers
+    } catch {
+        Write-Host "❌ Cannot connect to target" -ForegroundColor Red
+        $Headers = @{}
+    }
+}
+
+# HSTS
+$HSTS = $Headers["Strict-Transport-Security"]
+if ($HSTS) {
+    Write-Host "✅ HSTS: Present" -ForegroundColor Green
+    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") { $HeaderScore += 15 } else { $HeaderScore += 8 }
+} else {
+    Write-Host "❌ HSTS: Missing" -ForegroundColor Red
+    $HeaderIssues += "HSTS not implemented"
+}
+
+# CSP
+$CSP = $Headers["Content-Security-Policy"]
+if ($CSP) {
+    Write-Host "✅ CSP: Present" -ForegroundColor Green
+    $HeaderScore += 20
+    if ($CSP -match "unsafe-inline") { $HeaderIssues += "CSP contains unsafe-inline" }
+} else {
+    Write-Host "❌ CSP: Missing" -ForegroundColor Red
+    $HeaderIssues += "CSP not implemented (XSS risk)"
+}
+
+# X-Content-Type-Options
+$XCTO = $Headers["X-Content-Type-Options"]
+if ($XCTO -eq "nosniff") {
+    Write-Host "✅ X-Content-Type-Options: nosniff" -ForegroundColor Green
+    $HeaderScore += 10
+} else {
+    Write-Host "❌ X-Content-Type-Options: Missing" -ForegroundColor Red
+    $HeaderIssues += "X-Content-Type-Options not set"
+}
+
+# X-Frame-Options
+$XFO = $Headers["X-Frame-Options"]
+if ($XFO -eq "DENY" -or $XFO -eq "SAMEORIGIN") {
+    Write-Host "✅ X-Frame-Options: $XFO" -ForegroundColor Green
+    $HeaderScore += if ($XFO -eq "DENY") { 10 } else { 8 }
+} else {
+    Write-Host "❌ X-Frame-Options: Missing" -ForegroundColor Red
+    $HeaderIssues += "X-Frame-Options not set (clickjacking risk)"
+}
+
+# Referrer-Policy
+$RP = $Headers["Referrer-Policy"]
+if ($RP) {
+    Write-Host "✅ Referrer-Policy: $RP" -ForegroundColor Green
+    $HeaderScore += 10
+} else {
+    Write-Host "⚠️  Referrer-Policy: Missing" -ForegroundColor Yellow
+    $HeaderScore += 5
+}
+
+# Cache-Control
+$CC = $Headers["Cache-Control"]
+if ($CC -match "no-store|no-cache") {
+    Write-Host "✅ Cache-Control: Secure" -ForegroundColor Green
+    $HeaderScore += 10
+} else {
+    Write-Host "⚠️  Cache-Control: Check if sensitive data cached" -ForegroundColor Yellow
+    $HeaderScore += 5
+}
+
+# Server
+$Server = $Headers["Server"]
+if ($Server -match "/\d|Advanced") {
+    Write-Host "⚠️  Server: Leaks version - $Server" -ForegroundColor Yellow
+    $HeaderIssues += "Server header leaks version"
+}
+
+# X-Powered-By
+$XPB = $Headers["X-Powered-By"]
+if ($XPB) {
+    Write-Host "⚠️  X-Powered-By: $XPB" -ForegroundColor Yellow
+    $HeaderIssues += "X-Powered-By leaks technology"
+}
+
+Write-Host ""
+Write-Host "📊 Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 2: EXPOSED FILES
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "🔍 PHASE 2: Exposed Files Check" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+
+$ExposedFiles = @()
+$CriticalPaths = @(
+    "/.env", "/.git/config", "/.git/HEAD", "/.git/",
+    "/wp-config.php", "/config.php", "/settings.py",
+    "/backup.zip", "/database.sql", "/db.sql",
+    "/admin/", "/debug/", "/phpmyadmin/", "/pma/",
+    "/actuator/env", "/actuator/heapdump",
+    "/swagger-ui/", "/graphiql/"
+)
+
+foreach ($path in $CriticalPaths) {
+    try {
+        $resp = Invoke-WebRequest -Uri "$Target$path" -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
+        if ($resp.StatusCode -ne 404) {
+            Write-Host "⚠️  FOUND: $path (HTTP $($resp.StatusCode))" -ForegroundColor Red
+            $ExposedFiles += $path
+        }
+    } catch {}
+}
+
+if ($ExposedFiles.Count -eq 0) {
+    Write-Host "✅ No critical files exposed" -ForegroundColor Green
+}
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 3: PORT CHECK
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "🔌 PHASE 3: Quick Port Check" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+
+$Ports = @(80, 443, 8080, 3306, 5432, 6379, 27017, 22)
+$OpenPorts = @()
+
+foreach ($Port in $Ports) {
+    try {
+        $TCP = New-Object System.Net.Sockets.TcpClient
+        $Result = $TCP.BeginConnect($Domain, $Port, $null, $null)
+        $Wait = $Result.AsyncWaitHandle.WaitOne(500)
+        
+        if ($Wait -and $TCP.Connected) {
+            $Service = switch ($Port) {
+                80 { "HTTP" }
+                443 { "HTTPS" }
+                8080 { "HTTP-Alt" }
+                3306 { "MySQL" }
+                5432 { "PostgreSQL" }
+                6379 { "Redis" }
+                27017 { "MongoDB" }
+                22 { "SSH" }
+            }
+            $Risk = if ($Port -in @(3306, 5432, 6379, 27017)) { "HIGH" } else { "INFO" }
+            
+            Write-Host "⚠️  Port $Port ($Service) - OPEN" -ForegroundColor $(if($Risk -eq "HIGH"){"Red"}else{"Yellow"})
+            $OpenPorts += [PSCustomObject]@{ Port = $Port; Service = $Service; Risk = $Risk }
+        }
+        $TCP.Close()
+    } catch {}
+}
+
+if ($OpenPorts.Count -eq 0) {
+    Write-Host "✅ No common ports detected" -ForegroundColor Green
+}
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 4: BASIC INJECTION TEST
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "💉 PHASE 4: Basic Injection Tests" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+
+# XSS Test
+Write-Host "Testing XSS..." -ForegroundColor Gray
+$XSSPayload = "<script>alert(1)</script>"
+try {
+    $Response = Invoke-WebRequest -Uri "$Target/search?q=$XSSPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
+    if ($Response.Content -match [regex]::Escape($XSSPayload)) {
+        Write-Host "⚠️  Possible XSS reflection detected" -ForegroundColor Yellow
+    } else {
+        Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
+    }
+} catch {
+    Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
+}
+
+# SQLi Test
+Write-Host "Testing SQL Injection..." -ForegroundColor Gray
+$SQLPayload = "' OR '1'='1"
+try {
+    $Response = Invoke-WebRequest -Uri "$Target/?id=$SQLPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
+    $SQLErrors = @("SQL syntax", "MySQL", "PostgreSQL", "sqlite", "Microsoft SQL", "Warning: mysql", "error in your SQL")
+    $Found = $SQLErrors | Where-Object { $Response.Content -match $_ }
+    if ($Found) {
+        Write-Host "⚠️  SQL error detected in response" -ForegroundColor Yellow
+    } else {
+        Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
+    }
+} catch {
+    Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
+}
+
+# ═══════════════════════════════════════════════════════════
+# PHASE 5: SSL/TLS CHECK
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "🔐 PHASE 5: SSL/TLS Check" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+
+$SSLIssues = @()
+
+if ($Scheme -eq "https") {
+    Write-Host "✅ HTTPS enabled" -ForegroundColor Green
+    
+    # Check HSTS
+    if ($HSTS -notmatch "max-age=([3-9]\d{5,}|\d{7,})") {
+        Write-Host "⚠️  HSTS max-age should be at least 1 year" -ForegroundColor Yellow
+        $SSLIssues += "HSTS max-age too short"
+    }
+    
+    Write-Host "📝 For full SSL analysis: https://ssllabs.com/ssltest/analyze.html?d=$Domain" -ForegroundColor Cyan
+} else {
+    Write-Host "❌ HTTPS not enforced" -ForegroundColor Red
+    $SSLIssues += "HTTPS not enabled"
+}
+
+# ═══════════════════════════════════════════════════════════
+# SUMMARY
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "📊 SCAN SUMMARY" -ForegroundColor Cyan
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host "🔒 Header Score:  $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "🔍 Exposed Files: $($ExposedFiles.Count)" -ForegroundColor $(if($ExposedFiles.Count -gt 0){"Yellow"}else{"Green"})
+Write-Host "🔌 Open Ports:    $($OpenPorts.Count)" -ForegroundColor $(if(($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0){"Red"}else{"Green"})
+Write-Host "💉 Injection:     Basic tests completed" -ForegroundColor Green
+Write-Host "🔐 SSL/TLS:       HTTPS $($SSLIssues.Count -eq 0 ? 'OK' : 'Issues')" -ForegroundColor $(if($SSLIssues.Count -eq 0){"Green"}else{"Yellow"})
+
+# ═══════════════════════════════════════════════════════════
+# GENERATE REPORT
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "📝 Generating detailed report..." -ForegroundColor Yellow
+
+$Report = @"
+# 🛡️ Full Security Audit Report
+
+**Target:** $Target
+**Domain:** $Domain
+**Date:** $Date
+**Scanner:** Full Security Scan v2.0
+
+---
+
+## 📋 Executive Summary
+
+| Metric | Value |
+|--------|-------|
+| Target | $Target |
+| Scan Date | $Date |
+| Header Score | $HeaderScore/100 |
+| Exposed Files | $($ExposedFiles.Count) |
+| Open Ports | $($OpenPorts.Count) |
+| SSL Issues | $($SSLIssues.Count) |
+
+### Overall Risk Assessment
+
+$(if ($HeaderScore -lt 50 -or $ExposedFiles.Count -gt 0 -or ($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
+    "🔴 **HIGH RISK** - Issues found requiring immediate attention"
+} elseif ($HeaderScore -lt 70 -or $ExposedFiles.Count -gt 0) {
+    "🟠 **MEDIUM RISK** - Some security improvements recommended"
+} else {
+    "🟢 **LOW RISK** - Minor issues to address"
+})
+
+---
+
+## 🔒 1. Security Headers Analysis
+
+### Header Score: $HeaderScore/100
+
+$(if ($HeaderScore -ge 90) { "✅ **Grade A - Excellent**" }
+elseif ($HeaderScore -ge 70) { "✅ **Grade B - Good**" }
+elseif ($HeaderScore -ge 50) { "⚠️ **Grade C - Needs Improvement**" }
+else { "❌ **Grade D/F - Poor**" })
+
+| Header | Status |
+|--------|--------|
+| HSTS | $(if ($HSTS) { "✅ Present" } else { "❌ Missing" }) |
+| CSP | $(if ($CSP) { "✅ Present" } else { "❌ Missing" }) |
+| X-Content-Type-Options | $(if ($XCTO -eq "nosniff") { "✅ nosniff" } else { "❌ Missing" }) |
+| X-Frame-Options | $(if ($XFO) { "✅ $XFO" } else { "❌ Missing" }) |
+| Referrer-Policy | $(if ($RP) { "✅ Present" } else { "⚠️ Missing" }) |
+| Cache-Control | $(if ($CC) { "✅ Present" } else { "⚠️ Missing" }) |
+| Server | $(if ($Server) { "⚠️ $Server" } else { "✅ Hidden" }) |
+| X-Powered-By | $(if ($XPB) { "⚠️ $XPB" } else { "✅ Hidden" }) |
+
+### Issues Found
+
+$(if ($HeaderIssues.Count -gt 0) {
+    foreach ($issue in $HeaderIssues) {
+        "- ⚠️  $issue"
+    }
+} else {
+    "✅ No major header issues"
+})
+
+---
+
+## 🔍 2. Exposed Files Check
+
+$(if ($ExposedFiles.Count -gt 0) {
+    "### 🚨 Found $($ExposedFiles.Count) Exposed Files"
+} else {
+    "### ✅ No Critical Files Exposed"
+})
+
+| Path | Risk |
+|------|------|
+$(foreach ($file in $ExposedFiles) {
+    "| $file | 🔴 CRITICAL |"
+})
+
+**Recommendation:** Remove or protect these files from public access.
+
+---
+
+## 🔌 3. Port Scan Results
+
+$(if (($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
+    "### 🚨 High-Risk Ports Open"
+} else {
+    "### ✅ No High-Risk Ports Detected"
+})
+
+| Port | Service | Risk |
+|------|---------|------|
+$(foreach ($p in $OpenPorts) {
+    "| $($p.Port) | $($p.Service) | $(if($p.Risk -eq "HIGH"){"🔴 HIGH"}else{"🟢 INFO"}) |"
+})
+
+**Recommendation:** Database ports (3306, 5432, 6379, 27017) should never be exposed to the internet.
+
+---
+
+## 💉 4. Injection Tests
+
+Basic automated tests completed.
+
+| Test | Status |
+|------|--------|
+| XSS Reflection | ⚠️ Review manually |
+| SQL Injection | ⚠️ Review manually |
+
+**Note:** For comprehensive injection testing, use:
+- SQLMap: \`sqlmap -u "$Target"\`
+- Dalfox: \`dalfox url "$Target"\`
+
+---
+
+## 🔐 5. SSL/TLS
+
+$(if ($Scheme -eq "https") {
+    "✅ HTTPS is enabled"
+} else {
+    "❌ HTTPS is NOT enabled"
+})
+
+$(if ($SSLIssues.Count -gt 0) {
+    "### ⚠️ SSL Issues:"
+    foreach ($issue in $SSLIssues) {
+        "- $issue"
+    }
+})
+
+**Full SSL Analysis:** https://ssllabs.com/ssltest/analyze.html?d=$Domain
+
+---
+
+## 🛡️ Remediation Priority
+
+### Immediate (Critical)
+1. Implement missing security headers
+2. Remove/block exposed sensitive files (.env, .git/, backups)
+3. Close database ports from public access
+
+### Short-term
+1. Enable HSTS with long max-age
+2. Configure Content-Security-Policy
+3. Set up proper Cache-Control
+4. Hide server information
+
+### Long-term
+1. Regular security scanning
+2. Implement OWASP Top 10 controls
+3. Set up monitoring and alerting
+4. Security headers automated testing
+
+---
+
+## 🔗 Recommended Tools for Deeper Analysis
+
+| Tool | Purpose |
+|------|---------|
+| Nuclei | Vulnerability scanning |
+| SQLMap | SQL injection testing |
+| Dalfox | XSS scanning |
+| Nmap | Full port scan |
+| testssl.sh | SSL/TLS audit |
+| Burp Suite | Web vulnerability testing |
+
+---
+
+## 📄 Report Location
+
+**File:** \`$OutputFile\`
+**Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
+**Author:** Rz (@soulofzephir)
+
+---
+
+**⚠️ Disclaimer:** This is an automated scan. Manual testing recommended for comprehensive security assessment.
+"@
+
+$Report | Out-File -FilePath $OutputFile -Encoding UTF8
+
+# ═══════════════════════════════════════════════════════════
+# COMPLETE
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
+Write-Host "✅ FULL SCAN COMPLETE!" -ForegroundColor Green
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
+Write-Host ""
+Write-Host "📄 Report: $OutputFile" -ForegroundColor White
+Write-Host ""
+Write-Host "🔗 Quick Links:" -ForegroundColor Cyan
+Write-Host "   Headers: https://securityheaders.com/?q=$Domain"
+Write-Host "   SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
+Write-Host ""