@soulofzephir/pi-skill-pentesting 1.0.0

package/skills/pentesting/tools/security-scan.ps1

@@ -0,0 +1,338 @@
+# Security Quick Scanner v1.0
+# Combined scanner for Headers + Ports + Basic Injection Tests
+
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$Target = "",
+    
+    [Parameter(Mandatory=$false)]
+    [switch]$HeadersOnly,
+    
+    [Parameter(Mandatory=$false)]
+    [switch]$PortsOnly,
+    
+    [Parameter(Mandatory=$false)]
+    [switch]$InjectionOnly
+)
+
+$ErrorActionPreference = "SilentlyContinue"
+
+# Color codes
+function Get-Color { param($Score) 
+    if ($Score -ge 80) { return "Green" }
+    if ($Score -ge 60) { return "Yellow" }
+    return "Red"
+}
+
+# Banner
+Write-Host ""
+Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
+Write-Host "║     🔒 Security Quick Scanner v1.0                 ║" -ForegroundColor Cyan
+Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host ""
+
+# Validate target
+if (-not $Target) {
+    Write-Host "Usage: .\security-scan.ps1 -Target https://target.com" -ForegroundColor Yellow
+    Write-Host ""
+    Write-Host "Options:" -ForegroundColor White
+    Write-Host "  -Target       Target URL or hostname"
+    Write-Host "  -HeadersOnly  Scan headers only"
+    Write-Host "  -PortsOnly    Scan ports only"
+    Write-Host "  -InjectionOnly Test injection only"
+    exit
+}
+
+# Parse target
+if ($Target -match "https?://") {
+    $Uri = [System.Uri]$Target
+    $Hostname = $Uri.Host
+} else {
+    $Hostname = $Target
+    $Target = "https://$Target"
+}
+
+Write-Host "Target: $Hostname" -ForegroundColor White
+Write-Host "Mode: $(if($HeadersOnly){'Headers'}elseif($PortsOnly){'Ports'}elseif($InjectionOnly){'Injection'}else{'All'})"
+Write-Host ""
+
+# ═══════════════════════════════════════════════════════════
+# HEADER SCANNER
+# ═══════════════════════════════════════════════════════════
+if (-not $PortsOnly -and -not $InjectionOnly) {
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    Write-Host "🔒 SECURITY HEADERS ANALYSIS" -ForegroundColor Cyan
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    
+    $HeaderScore = 0
+    
+    try {
+        $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 10 -ErrorAction Stop
+        $Headers = $Response.Headers
+    } catch {
+        Write-Host "⚠️  Could not fetch headers (trying HTTP instead)..." -ForegroundColor Yellow
+        try {
+            $Target = $Target -replace "^https", "http"
+            $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 10 -ErrorAction Stop
+            $Headers = $Response.Headers
+        } catch {
+            Write-Host "❌ Cannot connect to target" -ForegroundColor Red
+        }
+    }
+    
+    if ($Headers) {
+        # HSTS Check
+        $HSTS = $Headers["Strict-Transport-Security"]
+        if ($HSTS) {
+            if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") {
+                Write-Host "✅ HSTS: Good (max-age >= 1 year)" -ForegroundColor Green
+                $HeaderScore += 15
+            } else {
+                Write-Host "⚠️  HSTS: Present but max-age < 1 year" -ForegroundColor Yellow
+                $HeaderScore += 8
+            }
+        } else {
+            Write-Host "❌ HSTS: Missing" -ForegroundColor Red
+        }
+        
+        # CSP Check
+        $CSP = $Headers["Content-Security-Policy"]
+        if ($CSP) {
+            Write-Host "✅ CSP: Present" -ForegroundColor Green
+            $HeaderScore += 20
+            if ($CSP -match "unsafe-inline") {
+                Write-Host "   ⚠️  Contains 'unsafe-inline' (XSS risk)" -ForegroundColor Red
+            }
+            if ($CSP -match "unsafe-eval") {
+                Write-Host "   ⚠️  Contains 'unsafe-eval'" -ForegroundColor Red
+            }
+            if ($CSP -match "frame-ancestors") {
+                Write-Host "   ✅ frame-ancestors directive present" -ForegroundColor Green
+            }
+        } else {
+            Write-Host "❌ CSP: Missing (XSS/clickjacking risk)" -ForegroundColor Red
+        }
+        
+        # X-Content-Type-Options
+        $XCTO = $Headers["X-Content-Type-Options"]
+        if ($XCTO -eq "nosniff") {
+            Write-Host "✅ X-Content-Type-Options: nosniff" -ForegroundColor Green
+            $HeaderScore += 10
+        } else {
+            Write-Host "❌ X-Content-Type-Options: Missing or wrong" -ForegroundColor Red
+        }
+        
+        # X-Frame-Options
+        $XFO = $Headers["X-Frame-Options"]
+        if ($XFO) {
+            if ($XFO -eq "DENY") {
+                Write-Host "✅ X-Frame-Options: DENY" -ForegroundColor Green
+                $HeaderScore += 10
+            } elseif ($XFO -eq "SAMEORIGIN") {
+                Write-Host "✅ X-Frame-Options: SAMEORIGIN" -ForegroundColor Green
+                $HeaderScore += 8
+            } else {
+                Write-Host "⚠️  X-Frame-Options: $XFO" -ForegroundColor Yellow
+                $HeaderScore += 5
+            }
+        } else {
+            Write-Host "❌ X-Frame-Options: Missing" -ForegroundColor Red
+        }
+        
+        # Referrer-Policy
+        $RP = $Headers["Referrer-Policy"]
+        if ($RP) {
+            Write-Host "✅ Referrer-Policy: $RP" -ForegroundColor Green
+            $HeaderScore += 10
+        } else {
+            Write-Host "⚠️  Referrer-Policy: Missing" -ForegroundColor Yellow
+        }
+        
+        # Cache-Control
+        $CC = $Headers["Cache-Control"]
+        if ($CC -match "no-store|no-cache") {
+            Write-Host "✅ Cache-Control: Secure" -ForegroundColor Green
+            $HeaderScore += 10
+        } elseif ($CC) {
+            Write-Host "⚠️  Cache-Control: $CC" -ForegroundColor Yellow
+            $HeaderScore += 5
+        }
+        
+        # Server info leakage
+        $Server = $Headers["Server"]
+        if ($Server -match "/\d" -or $Server -match "Advanced") {
+            Write-Host "❌ Server: Leaks version - $Server" -ForegroundColor Red
+        } elseif ($Server) {
+            Write-Host "⚠️  Server: $Server" -ForegroundColor Yellow
+        }
+        
+        # X-Powered-By
+        $XPB = $Headers["X-Powered-By"]
+        if ($XPB) {
+            Write-Host "❌ X-Powered-By: $XPB" -ForegroundColor Red
+        }
+        
+        # Permissions-Policy
+        $PP = $Headers["Permissions-Policy"]
+        if ($PP) {
+            Write-Host "✅ Permissions-Policy: Present" -ForegroundColor Green
+            $HeaderScore += 10
+        }
+    }
+    
+    Write-Host ""
+    Write-Host "📊 Header Score: $HeaderScore/100" -ForegroundColor $(Get-Color $HeaderScore)
+}
+
+# ═══════════════════════════════════════════════════════════
+# PORT SCANNER
+# ═══════════════════════════════════════════════════════════
+if (-not $HeadersOnly -and -not $InjectionOnly) {
+    Write-Host ""
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    Write-Host "🔌 PORT SCAN" -ForegroundColor Cyan
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    
+    # Check if nmap available
+    $NmapAvailable = Get-Command nmap -ErrorAction SilentlyContinue
+    
+    if ($NmapAvailable) {
+        Write-Host "Using Nmap for port scan..." -ForegroundColor Gray
+        nmap -sV -p 21,22,23,25,53,80,110,135,139,143,443,445,993,995,3306,3389,5432,5900,6379,8080,8443,27017 $Hostname 2>&1 | Where-Object { $_ -match "^\d|open|closed|filtered" }
+    } else {
+        Write-Host "Nmap not found. Checking common ports with TCP..." -ForegroundColor Yellow
+        
+        $Ports = @(21,22,80,443,3306,5432,8080,3389)
+        $OpenPorts = @()
+        
+        foreach ($Port in $Ports) {
+            try {
+                $TCP = New-Object System.Net.Sockets.TcpClient
+                $Result = $TCP.BeginConnect($Hostname, $Port, $null, $null)
+                $Wait = $Result.AsyncWaitHandle.WaitOne(500)
+                
+                if ($Wait -and $TCP.Connected) {
+                    $OpenPorts += $Port
+                    $Service = switch ($Port) {
+                        21 {"FTP"}
+                        22 {"SSH"}
+                        80 {"HTTP"}
+                        443 {"HTTPS"}
+                        3306 {"MySQL"}
+                        3389 {"RDP"}
+                        5432 {"PostgreSQL"}
+                        8080 {"HTTP-Alt"}
+                    }
+                    Write-Host "⚠️  Port $Port ($Service) - OPEN" -ForegroundColor Yellow
+                }
+                $TCP.Close()
+            } catch {}
+        }
+        
+        if ($OpenPorts.Count -eq 0) {
+            Write-Host "✅ No common high-risk ports detected" -ForegroundColor Green
+        } else {
+            Write-Host ""
+            Write-Host "📊 High-Risk Open Ports: $($OpenPorts.Count)" -ForegroundColor Yellow
+            Write-Host "   Review: Port 3306/5432/6379 should not be public!" -ForegroundColor Red
+        }
+    }
+}
+
+# ═══════════════════════════════════════════════════════════
+# INJECTION TESTER
+# ═══════════════════════════════════════════════════════════
+if (-not $HeadersOnly -and -not $PortsOnly) {
+    Write-Host ""
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    Write-Host "💉 BASIC INJECTION TESTS" -ForegroundColor Cyan
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    
+    # XSS Test
+    Write-Host ""
+    Write-Host "🧪 XSS Test:" -ForegroundColor White
+    $XSSPayload = "<script>alert(1)</script>"
+    $TestURL = "$Target/search?q=$XSSPayload"
+    
+    try {
+        $Response = Invoke-WebRequest -Uri $TestURL -TimeoutSec 10 -ErrorAction SilentlyContinue
+        $Content = $Response.Content
+        
+        if ($Content -match [regex]::Escape($XSSPayload)) {
+            Write-Host "⚠️  REFLECTED XSS - Payload found in response" -ForegroundColor Red
+            Write-Host "   Payload: $XSSPayload" -ForegroundColor Gray
+        } else {
+            Write-Host "✅ No obvious XSS reflection detected" -ForegroundColor Green
+        }
+    } catch {
+        Write-Host "⚠️  Could not complete XSS test" -ForegroundColor Yellow
+    }
+    
+    # SQLi Test
+    Write-Host ""
+    Write-Host "🧪 SQLi Test:" -ForegroundColor White
+    $SQLPayload = "' OR '1'='1"
+    $TestURL = "$Target/?id=$SQLPayload"
+    
+    try {
+        $Response = Invoke-WebRequest -Uri $TestURL -TimeoutSec 10 -ErrorAction SilentlyContinue
+        $Content = $Response.Content
+        $Headers = $Response.Headers
+        
+        # Check for SQL errors
+        $SQLErrors = @("SQL syntax", "MySQL", "PostgreSQL", "sqlite", "Microsoft SQL", "ODBC", "Warning: mysql", "error in your SQL")
+        $FoundError = $SQLErrors | Where-Object { $Content -match $_ }
+        
+        if ($FoundError) {
+            Write-Host "⚠️  SQL ERROR DETECTED in response" -ForegroundColor Red
+            Write-Host "   Error hint: $($FoundError[0])" -ForegroundColor Gray
+        } else {
+            Write-Host "✅ No obvious SQL errors in response" -ForegroundColor Green
+        }
+    } catch {
+        Write-Host "⚠️  Could not complete SQLi test" -ForegroundColor Yellow
+    }
+    
+    # Command Injection Test
+    Write-Host ""
+    Write-Host "🧪 Command Injection Test:" -ForegroundColor White
+    $CmdPayload = ";ls"
+    $TestURL = "$Target/?cmd=$CmdPayload"
+    
+    try {
+        $Response = Invoke-WebRequest -Uri $TestURL -TimeoutSec 10 -ErrorAction SilentlyContinue
+        $Content = $Response.Content
+        
+        # Check for common command output patterns
+        if ($Content -match "total \d+|drwx|root:|bin|etc|passwd" -and $Content -match "root|daemon|bin") {
+            Write-Host "⚠️  Possible command injection - system output detected" -ForegroundColor Red
+        } else {
+            Write-Host "✅ No obvious command injection detected" -ForegroundColor Green
+        }
+    } catch {
+        Write-Host "✅ No obvious command injection detected" -ForegroundColor Green
+    }
+    
+    Write-Host ""
+    Write-Host "⚠️  Note: Automated injection tests are basic. Manual testing recommended." -ForegroundColor Yellow
+}
+
+# ═══════════════════════════════════════════════════════════
+# SUMMARY
+# ═══════════════════════════════════════════════════════════
+if (-not $HeadersOnly -and -not $PortsOnly -and -not $InjectionOnly) {
+    Write-Host ""
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    Write-Host "📋 SCAN COMPLETE" -ForegroundColor Cyan
+    Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+    
+    Write-Host ""
+    Write-Host "🔗 Online Tools for Deeper Analysis:" -ForegroundColor White
+    Write-Host "   Headers: https://securityheaders.com/?q=$Hostname"
+    Write-Host "   SSL/TLS: https://ssllabs.com/ssltest/analyze.html?d=$Hostname"
+    Write-Host "   DNS:     https://dnsdumpster.com/?domain=$Hostname"
+    Write-Host ""
+}
+
+Write-Host "Scan completed at: $(Get-Date)" -ForegroundColor Gray
+Write-Host ""