npm - @soulofzephir/pi-skill-pentesting - Versions diffs - 1.0.3 → 1.0.5 - Mend

@soulofzephir/pi-skill-pentesting 1.0.3 → 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/package.json +1 -1
package/skills/pentesting/tools/exposed-files-scan.ps1 +141 -238
package/skills/pentesting/tools/full-scan.ps1 +278 -316
package/soulofzephir-pi-skill-pentesting-1.0.3.tgz +0 -0
package/soulofzephir-pi-skill-pentesting-1.0.4.tgz +0 -0

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@soulofzephir/pi-skill-pentesting",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Comprehensive pentesting & security check skill for Pi coding agent - headers, ports, SQLi, XSS, OWASP Top 10",
   "keywords": [
     "pi",

package/skills/pentesting/tools/exposed-files-scan.ps1 CHANGED Viewed

@@ -1,5 +1,5 @@
-# Exposed Files Scanner v1.0
-# Detects dangerous exposed files and directories
+# Exposed Files Scanner v2.0
+# Detects dangerous exposed files with false positive detection
 param(
     [Parameter(Mandatory=$false)]
@@ -11,10 +11,8 @@ param(
 $ErrorActionPreference = "Continue"
-# Get current date
 $Date = Get-Date -Format "yyyy-MM-dd"
-# Parse target URL
 if ($Target -match "https?://") {
     $Uri = [System.Uri]$Target
     $Domain = $Uri.Host
@@ -24,122 +22,61 @@ if ($Target -match "https?://") {
     $Target = "https://$Target"
 }
-# Create output filename
 $OutputFile = "$OutputDir/$Domain-exposed-$Date.md"
-# ═══════════════════════════════════════════════════════════
-# COMMON EXPOSED PATHS
-# ═══════════════════════════════════════════════════════════
 $ExposedPaths = @(
-    # Configuration Files
-    @{ Path = "/.env"; Risk = "CRITICAL"; Desc = "Environment variables - may contain secrets" },
-    @{ Path = "/.env.local"; Risk = "CRITICAL"; Desc = "Local environment - secrets" },
-    @{ Path = "/.env.production"; Risk = "CRITICAL"; Desc = "Production environment" },
-    @{ Path = "/.git/config"; Risk = "CRITICAL"; Desc = "Git repository config - may expose remote" },
-    @{ Path = "/.git/HEAD"; Risk = "HIGH"; Desc = "Git branch information" },
-    @{ Path = "/.git/"; Risk = "CRITICAL"; Desc = "Full .git directory exposed" },
-    @{ Path = "/wp-config.php"; Risk = "CRITICAL"; Desc = "WordPress config - DB + keys" },
-    @{ Path = "/config.php"; Risk = "CRITICAL"; Desc = "PHP configuration" },
-    @{ Path = "/settings.py"; Risk = "CRITICAL"; Desc = "Django/Python settings" },
-    @{ Path = "/config.js"; Risk = "HIGH"; Desc = "Node.js configuration" },
-    @{ Path = "/application.properties"; Risk = "CRITICAL"; Desc = "Java Spring config" },
-    @{ Path = "/.htaccess"; Risk = "MEDIUM"; Desc = "Apache config" },
-    @{ Path = "/.htpasswd"; Risk = "CRITICAL"; Desc = "HTTP Basic Auth hashes" },
-    # Backup Files
-    @{ Path = "/backup.zip"; Risk = "CRITICAL"; Desc = "Compressed backup" },
-    @{ Path = "/backups.zip"; Risk = "CRITICAL"; Desc = "Compressed backup" },
-    @{ Path = "/database.zip"; Risk = "CRITICAL"; Desc = "Database backup" },
-    @{ Path = "/db.zip"; Risk = "CRITICAL"; Desc = "Database backup" },
-    @{ Path = "/database.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
-    @{ Path = "/db.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
-    @{ Path = "/dump.sql"; Risk = "CRITICAL"; Desc = "Database dump" },
-    @{ Path = "/backup.sql"; Risk = "CRITICAL"; Desc = "Database backup" },
-    @{ Path = "/site.tar.gz"; Risk = "CRITICAL"; Desc = "Full site backup" },
-    @{ Path = "/backup.tar.gz"; Risk = "CRITICAL"; Desc = "Full backup archive" },
-    @{ Path = "/www.zip"; Risk = "CRITICAL"; Desc = "Web root backup" },
-    @{ Path = "/backup/"; Risk = "HIGH"; Desc = "Backup directory" },
-    @{ Path = "/backups/"; Risk = "HIGH"; Desc = "Backups directory" },
-    @{ Path = "/db/"; Risk = "HIGH"; Desc = "Database directory" },
-    @{ Path = "/*.bak"; Risk = "HIGH"; Desc = "Backup files" },
-    @{ Path = "/*.backup"; Risk = "HIGH"; Desc = "Backup files" },
-    @{ Path = "/old/"; Risk = "MEDIUM"; Desc = "Old files directory" },
-    @{ Path = "/tmp/"; Risk = "MEDIUM"; Desc = "Temporary files" },
-    # Admin & Debug Panels
-    @{ Path = "/admin/"; Risk = "HIGH"; Desc = "Admin panel" },
-    @{ Path = "/wp-admin/"; Risk = "HIGH"; Desc = "WordPress admin" },
-    @{ Path = "/administrator/"; Risk = "HIGH"; Desc = "Administrator panel" },
-    @{ Path = "/manage/"; Risk = "MEDIUM"; Desc = "Management panel" },
-    @{ Path = "/phpmyadmin/"; Risk = "CRITICAL"; Desc = "Database UI - major exposure" },
-    @{ Path = "/pma/"; Risk = "CRITICAL"; Desc = "phpMyAdmin alias" },
-    @{ Path = "/mysql/"; Risk = "CRITICAL"; Desc = "MySQL admin" },
-    @{ Path = "/debug/"; Risk = "CRITICAL"; Desc = "Debug mode enabled" },
-    @{ Path = "/api/debug/"; Risk = "CRITICAL"; Desc = "API debug endpoint" },
-    @{ Path = "/console/"; Risk = "HIGH"; Desc = "Debug console" },
-    @{ Path = "/debug.php"; Risk = "CRITICAL"; Desc = "Debug script" },
-    @{ Path = "/test.php"; Risk = "HIGH"; Desc = "Test script" },
-    @{ Path = "/info.php"; Risk = "HIGH"; Desc = "PHP info exposure" },
-    @{ Path = "/phpinfo.php"; Risk = "HIGH"; Desc = "PHP info exposure" },
-    # Spring Boot Actuator
-    @{ Path = "/actuator/"; Risk = "HIGH"; Desc = "Spring Boot actuator" },
-    @{ Path = "/actuator/env"; Risk = "CRITICAL"; Desc = "Environment variables" },
-    @{ Path = "/actuator/heapdump"; Risk = "CRITICAL"; Desc = "Heap dump - contains secrets" },
-    @{ Path = "/actuator/threaddump"; Risk = "HIGH"; Desc = "Thread information" },
-    @{ Path = "/actuator/metrics"; Risk = "MEDIUM"; Desc = "Application metrics" },
-    @{ Path = "/actuator/configprops"; Risk = "CRITICAL"; Desc = "Configuration properties" },
-    @{ Path = "/health"; Risk = "MEDIUM"; Desc = "Health check endpoint" },
-    # API Documentation
-    @{ Path = "/swagger/"; Risk = "MEDIUM"; Desc = "Swagger UI" },
-    @{ Path = "/swagger-ui/"; Risk = "MEDIUM"; Desc = "Swagger documentation" },
-    @{ Path = "/swagger-ui.html"; Risk = "MEDIUM"; Desc = "Swagger HTML" },
-    @{ Path = "/api-docs/"; Risk = "MEDIUM"; Desc = "API documentation" },
-    @{ Path = "/v2/api-docs/"; Risk = "MEDIUM"; Desc = "OpenAPI v2" },
-    @{ Path = "/v3/api-docs/"; Risk = "MEDIUM"; Desc = "OpenAPI v3" },
-    @{ Path = "/graphiql/"; Risk = "HIGH"; Desc = "GraphQL IDE" },
-    @{ Path = "/graphql"; Risk = "MEDIUM"; Desc = "GraphQL endpoint" },
-    @{ Path = "/api/"; Risk = "LOW"; Desc = "API base path" },
-    @{ Path = "/api/v1/"; Risk = "LOW"; Desc = "API v1" },
-    # Log Files
-    @{ Path = "/logs/"; Risk = "HIGH"; Desc = "Log directory" },
-    @{ Path = "/error.log"; Risk = "HIGH"; Desc = "Error log" },
-    @{ Path = "/access.log"; Risk = "HIGH"; Desc = "Access log" },
-    @{ Path = "/debug.log"; Risk = "HIGH"; Desc = "Debug log" },
-    @{ Path = "/application.log"; Risk = "HIGH"; Desc = "Application log" },
-    @{ Path = "/console.log"; Risk = "MEDIUM"; Desc = "Console log" },
-    # Information Disclosure
-    @{ Path = "/robots.txt"; Risk = "LOW"; Desc = "Reveals hidden paths" },
-    @{ Path = "/sitemap.xml"; Risk = "LOW"; Desc = "Site structure" },
-    @{ Path = "/security.txt"; Risk = "LOW"; Desc = "Security contact" },
-    @{ Path = "/humans.txt"; Risk = "LOW"; Desc = "Developer information" },
-    @{ Path = "/crossdomain.xml"; Risk = "LOW"; Desc = "Flash policy" },
-    @{ Path = "/.well-known/security.txt"; Risk = "LOW"; Desc = "Security policy" }
+    @{ Path="/.env"; Risk="CRITICAL"; Desc="Environment variables with secrets" },
+    @{ Path="/.env.local"; Risk="CRITICAL"; Desc="Local environment" },
+    @{ Path="/.git/config"; Risk="CRITICAL"; Desc="Git repository config" },
+    @{ Path="/.git/HEAD"; Risk="HIGH"; Desc="Git branch info" },
+    @{ Path="/.git/"; Risk="CRITICAL"; Desc="Full .git directory" },
+    @{ Path="/wp-config.php"; Risk="CRITICAL"; Desc="WordPress config" },
+    @{ Path="/config.php"; Risk="HIGH"; Desc="PHP configuration" },
+    @{ Path="/settings.py"; Risk="HIGH"; Desc="Python/Django settings" },
+    @{ Path="/config.js"; Risk="HIGH"; Desc="Node.js config" },
+    @{ Path="/application.properties"; Risk="CRITICAL"; Desc="Java Spring config" },
+    @{ Path="/backup.zip"; Risk="CRITICAL"; Desc="Compressed backup" },
+    @{ Path="/backups.zip"; Risk="CRITICAL"; Desc="Compressed backup" },
+    @{ Path="/database.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/db.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/dump.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/backup.sql"; Risk="CRITICAL"; Desc="Database backup" },
+    @{ Path="/admin/"; Risk="HIGH"; Desc="Admin panel" },
+    @{ Path="/wp-admin/"; Risk="HIGH"; Desc="WordPress admin" },
+    @{ Path="/administrator/"; Risk="HIGH"; Desc="Admin panel" },
+    @{ Path="/phpmyadmin/"; Risk="CRITICAL"; Desc="Database UI" },
+    @{ Path="/pma/"; Risk="CRITICAL"; Desc="phpMyAdmin alias" },
+    @{ Path="/debug/"; Risk="CRITICAL"; Desc="Debug mode enabled" },
+    @{ Path="/api/debug/"; Risk="CRITICAL"; Desc="API debug" },
+    @{ Path="/actuator/"; Risk="HIGH"; Desc="Spring Boot actuator" },
+    @{ Path="/actuator/env"; Risk="CRITICAL"; Desc="Environment variables" },
+    @{ Path="/actuator/heapdump"; Risk="CRITICAL"; Desc="Heap dump" },
+    @{ Path="/swagger-ui/"; Risk="MEDIUM"; Desc="API documentation" },
+    @{ Path="/swagger/"; Risk="MEDIUM"; Desc="Swagger UI" },
+    @{ Path="/graphiql/"; Risk="HIGH"; Desc="GraphQL IDE" },
+    @{ Path="/graphql"; Risk="MEDIUM"; Desc="GraphQL endpoint" },
+    @{ Path="/logs/"; Risk="HIGH"; Desc="Log directory" },
+    @{ Path="/error.log"; Risk="HIGH"; Desc="Error log" },
+    @{ Path="/access.log"; Risk="MEDIUM"; Desc="Access log" },
+    @{ Path="/robots.txt"; Risk="LOW"; Desc="Reveals paths" },
+    @{ Path="/sitemap.xml"; Risk="LOW"; Desc="Site structure" }
 )
-# ═══════════════════════════════════════════════════════════
-# SCAN FUNCTION
-# ═══════════════════════════════════════════════════════════
-Write-Host ""
-Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
-Write-Host "║  🔍 Exposed Files Scanner v1.0                    ║" -ForegroundColor Cyan
-Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
 Write-Host ""
-Write-Host "Target: $Target" -ForegroundColor White
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Exposed Files Scanner v2.0" -ForegroundColor Cyan
+Write-Host "  Target: $Domain" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
-$FoundIssues = @()
+$TrueIssues = @()
+$FalsePositives = @()
 $Scanned = 0
 foreach ($item in $ExposedPaths) {
     $Scanned++
     $Progress = [math]::Round(($Scanned / $ExposedPaths.Count) * 100)
-    Write-Progress -Activity "Scanning exposed files..." -Status "$Progress% complete" -PercentComplete $Progress
+    Write-Progress -Activity "Scanning..." -Status "$Progress% complete" -PercentComplete $Progress
     $URL = "$Target$($item.Path)"
@@ -147,187 +84,153 @@ foreach ($item in $ExposedPaths) {
         $Response = Invoke-WebRequest -Uri $URL -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
         if ($Response.StatusCode -ne 404 -and $Response.StatusCode -ne 403) {
-            $ContentType = $Response.Headers["Content-Type"] -join ", "
+            $ContentType = $Response.Headers["Content-Type"]
-            $Finding = [PSCustomObject]@{
-                Path = $item.Path
-                StatusCode = $Response.StatusCode
-                Risk = $item.Risk
-                Description = $item.Desc
-                ContentType = $ContentType
+            # Check for false positive (SPA routing)
+            $IsFalsePositive = $false
+            if ($item.Path -notmatch "\.(zip|sql|env|tar|gz|bak|backup)" -and
+                $ContentType -match "text/html|application/octet-stream") {
+                # Check if it's actually HTML content
+                try {
+                    $BodyResp = Invoke-WebRequest -Uri $URL -TimeoutSec 5 -ErrorAction SilentlyContinue
+                    $Body = $BodyResp.Content.Substring(0, [Math]::Min(500, $BodyResp.Content.Length))
+                    if ($Body -match "<html|<!doctype|<head|<body|root|<div" -and $Body.Length -lt 2000) {
+                        $IsFalsePositive = $true
+                    }
+                    # Check for actual sensitive content
+                    if ($Body -match "DB_HOST|DB_PASS|PASSWORD|SECRET|API_KEY|aws_key|database|backup") {
+                        $IsFalsePositive = $false
+                    }
+                } catch {}
             }
-            $FoundIssues += $Finding
-            $Color = switch ($item.Risk) {
-                "CRITICAL" { "Red" }
-                "HIGH" { "Yellow" }
-                "MEDIUM" { "Cyan" }
-                "LOW" { "Gray" }
+            if ($IsFalsePositive) {
+                $FalsePositives += $item
+                Write-Host "[FP] $($item.Path) (HTTP $($Response.StatusCode)) - Likely SPA" -ForegroundColor Gray
+            } else {
+                $TrueIssues += $item
+                $Color = switch ($item.Risk) {
+                    "CRITICAL" { "Red" }
+                    "HIGH" { "Yellow" }
+                    "MEDIUM" { "Cyan" }
+                    "LOW" { "Gray" }
+                }
+                Write-Host "[!] FOUND: $($item.Path) ($($item.Risk))" -ForegroundColor $Color
             }
-            Write-Host "⚠️  FOUND [$($item.Risk)]: $($item.Path)" -ForegroundColor $Color
-            Write-Host "   Status: $($Response.StatusCode) | Type: $($ContentType.Substring(0, [Math]::Min(50, $ContentType.Length)))" -ForegroundColor Gray
         }
-    } catch {
-        # Connection error or timeout - not found
-    }
+    } catch {}
 }
 Write-Progress -Activity "Scanning" -Completed
-# ═══════════════════════════════════════════════════════════
-# SUMMARY
-# ═══════════════════════════════════════════════════════════
+$CriticalCount = ($TrueIssues | Where-Object { $_.Risk -eq "CRITICAL" }).Count
+$HighCount = ($TrueIssues | Where-Object { $_.Risk -eq "HIGH" }).Count
+$MediumCount = ($TrueIssues | Where-Object { $_.Risk -eq "MEDIUM" }).Count
+$LowCount = ($TrueIssues | Where-Object { $_.Risk -eq "LOW" }).Count
+$FPCount = $FalsePositives.Count
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "📊 SCAN SUMMARY" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  SCAN SUMMARY" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
-$CriticalCount = ($FoundIssues | Where-Object { $_.Risk -eq "CRITICAL" }).Count
-$HighCount = ($FoundIssues | Where-Object { $_.Risk -eq "HIGH" }).Count
-$MediumCount = ($FoundIssues | Where-Object { $_.Risk -eq "MEDIUM" }).Count
-$LowCount = ($FoundIssues | Where-Object { $_.Risk -eq "LOW" }).Count
 Write-Host "Files Scanned: $Scanned" -ForegroundColor White
-Write-Host "Issues Found: $($FoundIssues.Count)" -ForegroundColor Yellow
+Write-Host "True Issues:   $($TrueIssues.Count)" -ForegroundColor $(if($TrueIssues.Count -gt 0){"Red"}else{"Green"})
+Write-Host "False Positives: $FPCount" -ForegroundColor Gray
 Write-Host ""
-Write-Host "🔴 CRITICAL: $CriticalCount" -ForegroundColor Red
-Write-Host "🟠 HIGH:     $HighCount" -ForegroundColor Yellow
-Write-Host "🟡 MEDIUM:   $MediumCount" -ForegroundColor Cyan
-Write-Host "🟢 LOW:      $LowCount" -ForegroundColor Gray
-# ═══════════════════════════════════════════════════════════
-# GENERATE REPORT
-# ═══════════════════════════════════════════════════════════
+Write-Host "CRITICAL: $CriticalCount" -ForegroundColor Red
+Write-Host "HIGH:     $HighCount" -ForegroundColor Yellow
+Write-Host "MEDIUM:   $MediumCount" -ForegroundColor Cyan
+Write-Host "LOW:      $LowCount" -ForegroundColor Gray
+# Generate Report
+$TrueSection = if ($TrueIssues.Count -gt 0) {
+    $t = "| Path | Risk | Description |`n|------|------|-------------|`n"
+    foreach ($i in $TrueIssues) {
+        $t += "| $($i.Path) | $($i.Risk) | $($i.Desc) |`n"
+    }
+    $t
+} else {
+    "No sensitive files exposed."
+}
-if (-not (Test-Path $OutputDir)) {
-    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+$FPSection = if ($FalsePositives.Count -gt 0) {
+    $f = "These paths returned HTML/SPA content, not actual sensitive files:`n`n"
+    foreach ($i in $FalsePositives) {
+        $f += "- $($i.Path) - HTTP 200 (SPA routing)`n"
+    }
+    $f
+} else {
+    "None detected."
 }
+$Remediation = @()
+if ($CriticalCount -gt 0) { $Remediation += "1. **URGENT**: Remove or protect critical files" }
+if ($HighCount -gt 0) { $Remediation += "2. Add authentication to admin/debug panels" }
+if ($FPCount -gt 0) { $Remediation += "3. (Info) False positives detected - not real issues" }
 $Report = @"
-# 🔍 Exposed Files Report
+# Exposed Files Report
 **Target:** $Target
+**Domain:** $Domain
 **Date:** $Date
-**Scanner:** Exposed Files Scanner v1.0
+**Scanner:** Exposed Files Scanner v2.0
+**Author:** Rz (@soulofzephir)
 ---
-## 📋 Summary
+## Summary
 | Metric | Value |
 |--------|-------|
 | Files Scanned | $Scanned |
-| Issues Found | $($FoundIssues.Count) |
-| 🔴 CRITICAL | $CriticalCount |
-| 🟠 HIGH | $HighCount |
-| 🟡 MEDIUM | $MediumCount |
-| 🟢 LOW | $LowCount |
+| True Issues | $($TrueIssues.Count) |
+| False Positives | $FPCount |
+| CRITICAL | $CriticalCount |
+| HIGH | $HighCount |
+| MEDIUM | $MediumCount |
+| LOW | $LowCount |
 ---
-## 🚨 Critical Issues
-$(if ($CriticalCount -gt 0) {
-    $FoundIssues | Where-Object { $_.Risk -eq "CRITICAL" } | ForEach-Object {
-        @"
-### Found: $($_.Path)
-| Field | Value |
-|-------|-------|
-| Status Code | $($_.StatusCode) |
-| Risk Level | 🔴 $($_.Risk) |
-| Content Type | $($_.ContentType) |
-**Description:** $($_.Description)
+## True Security Issues
-**Recommendation:** Immediate action required. Remove or restrict access.
+$TrueSection
 ---
-"@
-    }
-} else {
-    "✅ No critical issues found"
-})
-## 🟠 High Risk Issues
-$(if ($HighCount -gt 0) {
-    $FoundIssues | Where-Object { $_.Risk -eq "HIGH" } | ForEach-Object {
-        @"
-- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
-"@
-    }
-} else {
-    "✅ No high-risk issues found"
-})
-## 🟡 Medium Risk Issues
-$(if ($MediumCount -gt 0) {
-    $FoundIssues | Where-Object { $_.Risk -eq "MEDIUM" } | ForEach-Object {
-        @"
-- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
-"@
-    }
-} else {
-    "✅ No medium-risk issues found"
-})
-## 🟢 Low Risk Issues
-$(if ($LowCount -gt 0) {
-    $FoundIssues | Where-Object { $_.Risk -eq "LOW" } | ForEach-Object {
-        @"
-- **$($_.Path)** - $($_.Description) (HTTP $($_.StatusCode))
-"@
-    }
-} else {
-    "✅ No low-risk issues found"
-})
----
-## 📝 All Findings
+## False Positives
-| Path | Status | Risk | Description |
-|------|--------|------|-------------|
-$(foreach ($issue in $FoundIssues) {
-    "| $($issue.Path) | $($issue.StatusCode) | $($issue.Risk) | $($issue.Description) |"
-})
+$FPSection
 ---
-## 🛡️ Remediation Checklist
+## Remediation
-- [ ] Block .env files in web server config
-- [ ] Disable .git directory listing
-- [ ] Remove backup files from web root
-- [ ] Protect admin panels with IP restriction
-- [ ] Disable debug mode in production
-- [ ] Secure Spring Boot actuator endpoints
-- [ ] Add authentication to API documentation
-- [ ] Disable directory listing
-- [ ] Remove test/debug files
+$(if ($Remediation.Count -gt 0) { $Remediation -join "`n" } else { "No immediate action required." })
 ---
-**Report Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
+**Generated:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
 "@
-# Save report
+if (-not (Test-Path $OutputDir)) {
+    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+}
 $Report | Out-File -FilePath $OutputFile -Encoding UTF8
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "✅ Scan Complete!" -ForegroundColor Green
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Green
+Write-Host "  Scan Complete!" -ForegroundColor Green
+Write-Host "========================================" -ForegroundColor Green
 Write-Host ""
-Write-Host "📄 Report: $OutputFile" -ForegroundColor White
+Write-Host "Report: $OutputFile" -ForegroundColor White
 Write-Host ""
 if ($CriticalCount -gt 0) {
-    Write-Host "⚠️  IMMEDIATE ACTION REQUIRED for critical findings!" -ForegroundColor Red
+    Write-Host "IMMEDIATE ACTION REQUIRED!" -ForegroundColor Red
 }

package/skills/pentesting/tools/full-scan.ps1 CHANGED Viewed

@@ -1,5 +1,5 @@
-# Full Security Scan - All-in-One v2.0
-# Comprehensive security scanner combining all tools
+# Full Security Scan - All-in-One v3.0
+# Comprehensive security scanner with detailed reporting
 param(
     [Parameter(Mandatory=$false)]
@@ -11,10 +11,6 @@ param(
 $ErrorActionPreference = "Continue"
-# ═══════════════════════════════════════════════════════════
-# CONFIGURATION
-# ═══════════════════════════════════════════════════════════
 $Date = Get-Date -Format "yyyy-MM-dd"
 if ($Target -match "https?://") {
@@ -32,164 +28,239 @@ if (-not (Test-Path $OutputDir)) {
     New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
 }
-# ═══════════════════════════════════════════════════════════
-# BANNER
-# ═══════════════════════════════════════════════════════════
 Write-Host ""
-Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
-Write-Host "║  🛡️ FULL SECURITY SCAN v2.0                     ║" -ForegroundColor Cyan
-Write-Host "║  Target: $Domain" -ForegroundColor Cyan
-Write-Host "║  Date: $Date" -ForegroundColor Cyan
-Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Full Security Scan v3.0" -ForegroundColor Cyan
+Write-Host "  Target: $Domain" -ForegroundColor Cyan
+Write-Host "  Date: $Date" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
-# ═══════════════════════════════════════════════════════════
-# PHASE 1: SECURITY HEADERS
-# ═══════════════════════════════════════════════════════════
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔒 PHASE 1: Security Headers" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
 $HeaderScore = 0
 $HeaderIssues = @()
+$HeaderGood = @()
+$ExposedFiles = @()
+$OpenPorts = @()
+$CORSIssues = @()
+$FalsePositives = @()
+$TechStack = @()
+# PHASE 1: Headers
+Write-Host "Phase 1: Security Headers" -ForegroundColor Yellow
 try {
     $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 15 -ErrorAction Stop
     $Headers = $Response.Headers
+    # Detect Server/Technology
+    $Server = $Headers["Server"]
+    $XPB = $Headers["X-Powered-By"]
+    $CFRay = $Response.Headers["CF-Ray"]
+    $CFCache = $Response.Headers["CF-Cache-Status"]
+    if ($Server) { $TechStack += "Server: $Server" }
+    if ($XPB) { $TechStack += "X-Powered-By: $XPB" }
+    if ($CFRay) { $TechStack += "CDN: Cloudflare" }
+    if ($CFCache) { $TechStack += "CDN Cache: Active" }
 } catch {
     try {
         $Response = Invoke-WebRequest -Uri ($Target -replace "^https", "http") -Method Head -TimeoutSec 15 -ErrorAction Stop
         $Headers = $Response.Headers
     } catch {
-        Write-Host "❌ Cannot connect to target" -ForegroundColor Red
+        Write-Host "Cannot connect to target" -ForegroundColor Red
         $Headers = @{}
     }
 }
-# HSTS
 $HSTS = $Headers["Strict-Transport-Security"]
 if ($HSTS) {
-    Write-Host "✅ HSTS: Present" -ForegroundColor Green
-    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") { $HeaderScore += 15 } else { $HeaderScore += 8 }
+    $HeaderGood += "HSTS: Present"
+    Write-Host "  HSTS: Present" -ForegroundColor Green
+    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") {
+        $HeaderScore += 15
+        $HeaderGood += "HSTS: max-age >= 1 year"
+    } elseif ($HSTS -match "max-age=\d{5,6}") {
+        $HeaderScore += 8
+        $HeaderIssues += "HSTS max-age < 1 year (recommended: 31536000)"
+    }
 } else {
-    Write-Host "❌ HSTS: Missing" -ForegroundColor Red
+    Write-Host "  HSTS: Missing" -ForegroundColor Red
     $HeaderIssues += "HSTS not implemented"
 }
-# CSP
 $CSP = $Headers["Content-Security-Policy"]
 if ($CSP) {
-    Write-Host "✅ CSP: Present" -ForegroundColor Green
+    $HeaderGood += "CSP: Present"
+    Write-Host "  CSP: Present" -ForegroundColor Green
     $HeaderScore += 20
-    if ($CSP -match "unsafe-inline") { $HeaderIssues += "CSP contains unsafe-inline" }
+    if ($CSP -match "unsafe-inline") {
+        $HeaderIssues += "CSP contains 'unsafe-inline' (XSS risk)"
+        Write-Host "    Warning: Contains unsafe-inline" -ForegroundColor Yellow
+    }
+    if ($CSP -match "unsafe-eval") {
+        $HeaderIssues += "CSP contains 'unsafe-eval'"
+    }
 } else {
-    Write-Host "❌ CSP: Missing" -ForegroundColor Red
+    Write-Host "  CSP: Missing" -ForegroundColor Red
     $HeaderIssues += "CSP not implemented (XSS risk)"
 }
-# X-Content-Type-Options
 $XCTO = $Headers["X-Content-Type-Options"]
 if ($XCTO -eq "nosniff") {
-    Write-Host "✅ X-Content-Type-Options: nosniff" -ForegroundColor Green
+    $HeaderGood += "X-Content-Type-Options: nosniff"
+    Write-Host "  X-Content-Type-Options: nosniff" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "❌ X-Content-Type-Options: Missing" -ForegroundColor Red
+    Write-Host "  X-Content-Type-Options: Missing" -ForegroundColor Red
     $HeaderIssues += "X-Content-Type-Options not set"
 }
-# X-Frame-Options
 $XFO = $Headers["X-Frame-Options"]
 if ($XFO -eq "DENY" -or $XFO -eq "SAMEORIGIN") {
-    Write-Host "✅ X-Frame-Options: $XFO" -ForegroundColor Green
+    $HeaderGood += "X-Frame-Options: $XFO"
+    Write-Host "  X-Frame-Options: $XFO" -ForegroundColor Green
     $HeaderScore += if ($XFO -eq "DENY") { 10 } else { 8 }
 } else {
-    Write-Host "❌ X-Frame-Options: Missing" -ForegroundColor Red
+    Write-Host "  X-Frame-Options: Missing" -ForegroundColor Red
     $HeaderIssues += "X-Frame-Options not set (clickjacking risk)"
 }
-# Referrer-Policy
 $RP = $Headers["Referrer-Policy"]
 if ($RP) {
-    Write-Host "✅ Referrer-Policy: $RP" -ForegroundColor Green
+    $HeaderGood += "Referrer-Policy: $RP"
+    Write-Host "  Referrer-Policy: Present" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "⚠️  Referrer-Policy: Missing" -ForegroundColor Yellow
+    Write-Host "  Referrer-Policy: Missing" -ForegroundColor Yellow
     $HeaderScore += 5
 }
-# Cache-Control
-$CC = $Headers["Cache-Control"]
-if ($CC -match "no-store|no-cache") {
-    Write-Host "✅ Cache-Control: Secure" -ForegroundColor Green
+$PP = $Headers["Permissions-Policy"]
+if ($PP) {
+    $HeaderGood += "Permissions-Policy: Present"
+    Write-Host "  Permissions-Policy: Present" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "⚠️  Cache-Control: Check if sensitive data cached" -ForegroundColor Yellow
+    Write-Host "  Permissions-Policy: Missing" -ForegroundColor Yellow
     $HeaderScore += 5
 }
-# Server
-$Server = $Headers["Server"]
-if ($Server -match "/\d|Advanced") {
-    Write-Host "⚠️  Server: Leaks version - $Server" -ForegroundColor Yellow
-    $HeaderIssues += "Server header leaks version"
+$CC = $Headers["Cache-Control"]
+if ($CC -match "no-store|no-cache|private") {
+    $HeaderGood += "Cache-Control: $CC"
+    Write-Host "  Cache-Control: $CC" -ForegroundColor Green
+    $HeaderScore += 5
+} else {
+    Write-Host "  Cache-Control: Not optimal" -ForegroundColor Yellow
+    $HeaderScore += 2
+}
+# Check Server for version leaks
+if ($Server -match "/\d|Apache/[0-9]|nginx/[0-9]|Microsoft-IIS/[0-9]") {
+    Write-Host "  Server: Leaks version - $Server" -ForegroundColor Yellow
+    $HeaderIssues += "Server header leaks version: $Server"
+} elseif ($Server) {
+    Write-Host "  Server: $Server" -ForegroundColor Gray
 }
-# X-Powered-By
-$XPB = $Headers["X-Powered-By"]
 if ($XPB) {
-    Write-Host "⚠️  X-Powered-By: $XPB" -ForegroundColor Yellow
-    $HeaderIssues += "X-Powered-By leaks technology"
+    Write-Host "  X-Powered-By: $XPB" -ForegroundColor Yellow
+    $HeaderIssues += "X-Powered-By leaks technology: $XPB"
 }
+# Check CORS
 Write-Host ""
-Write-Host "📊 Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "Phase 1b: CORS Analysis" -ForegroundColor Yellow
+$ACAO = $Headers["Access-Control-Allow-Origin"]
+$ACAC = $Headers["Access-Control-Allow-Credentials"]
+$ACAM = $Headers["Access-Control-Allow-Methods"]
-# ═══════════════════════════════════════════════════════════
-# PHASE 2: EXPOSED FILES
-# ═══════════════════════════════════════════════════════════
+if ($ACAO) {
+    Write-Host "  CORS Origin: $ACAO" -ForegroundColor $(if($ACAO -eq "*"){"Yellow"}else{"Green"})
+    if ($ACAO -eq "*") {
+        $CORSIssues += "CORS allows all origins (Access-Control-Allow-Origin: *)"
+        Write-Host "    Warning: Allows all origins" -ForegroundColor Yellow
+    }
+}
+if ($ACAC -eq "true" -and $ACAO -eq "*") {
+    $CORSIssues += "CORS: Wildcard with credentials (invalid but misconfigured)"
+    Write-Host "    CRITICAL: Wildcard with credentials!" -ForegroundColor Red
+}
+if ($ACAM) {
+    Write-Host "  CORS Methods: $ACAM" -ForegroundColor Gray
+}
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔍 PHASE 2: Exposed Files Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "  Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+# PHASE 2: Exposed Files
+Write-Host ""
+Write-Host "Phase 2: Exposed Files" -ForegroundColor Yellow
-$ExposedFiles = @()
 $CriticalPaths = @(
-    "/.env", "/.git/config", "/.git/HEAD", "/.git/",
-    "/wp-config.php", "/config.php", "/settings.py",
-    "/backup.zip", "/database.sql", "/db.sql",
-    "/admin/", "/debug/", "/phpmyadmin/", "/pma/",
-    "/actuator/env", "/actuator/heapdump",
-    "/swagger-ui/", "/graphiql/"
+    @{ Path="/.env"; Risk="CRITICAL"; Desc="Environment variables" },
+    @{ Path="/.git/config"; Risk="CRITICAL"; Desc="Git repository" },
+    @{ Path="/.git/"; Risk="CRITICAL"; Desc="Git directory" },
+    @{ Path="/config.php"; Risk="HIGH"; Desc="PHP configuration" },
+    @{ Path="/settings.py"; Risk="HIGH"; Desc="Python settings" },
+    @{ Path="/backup.zip"; Risk="CRITICAL"; Desc="Backup archive" },
+    @{ Path="/database.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/db.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/admin/"; Risk="HIGH"; Desc="Admin panel" },
+    @{ Path="/debug/"; Risk="HIGH"; Desc="Debug endpoint" },
+    @{ Path="/phpmyadmin/"; Risk="CRITICAL"; Desc="Database UI" },
+    @{ Path="/actuator/env"; Risk="CRITICAL"; Desc="Spring Boot env" }
 )
-foreach ($path in $CriticalPaths) {
+$TrueExposedFiles = @()
+$FalsePositiveFiles = @()
+foreach ($item in $CriticalPaths) {
     try {
-        $resp = Invoke-WebRequest -Uri "$Target$path" -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
-        if ($resp.StatusCode -ne 404) {
-            Write-Host "⚠️  FOUND: $path (HTTP $($resp.StatusCode))" -ForegroundColor Red
-            $ExposedFiles += $path
+        $resp = Invoke-WebRequest -Uri "$Target$($item.Path)" -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
+        if ($resp.StatusCode -ne 404 -and $resp.StatusCode -ne 403) {
+            $ContentType = $resp.Headers["Content-Type"]
+            $BodyPreview = ""
+            # Check if it's a real sensitive file or SPA
+            if ($ContentType -match "text/html|application/octet-stream" -and $item.Path -notmatch "\.zip|\.sql|\.env|\.git") {
+                # Check body content
+                try {
+                    $bodyResp = Invoke-WebRequest -Uri "$Target$($item.Path)" -TimeoutSec 5 -ErrorAction SilentlyContinue
+                    $BodyPreview = $bodyResp.Content.Substring(0, [Math]::Min(200, $bodyResp.Content.Length))
+                } catch {}
+                if ($BodyPreview -match "root|div|html|<!" -and $BodyPreview.Length -lt 1000) {
+                    # Likely SPA false positive
+                    $FalsePositiveFiles += $item
+                    Write-Host "  [FP] $($item.Path) - HTTP $($resp.StatusCode) (likely SPA)" -ForegroundColor Gray
+                } else {
+                    # Real exposed file
+                    $TrueExposedFiles += $item
+                    Write-Host "  FOUND: $($item.Path) (HTTP $($resp.StatusCode))" -ForegroundColor Red
+                }
+            } else {
+                # Real file
+                $TrueExposedFiles += $item
+                Write-Host "  FOUND: $($item.Path) (HTTP $($resp.StatusCode))" -ForegroundColor Red
+            }
         }
     } catch {}
 }
-if ($ExposedFiles.Count -eq 0) {
-    Write-Host "✅ No critical files exposed" -ForegroundColor Green
+if ($TrueExposedFiles.Count -eq 0) {
+    Write-Host "  No sensitive files exposed" -ForegroundColor Green
 }
-# ═══════════════════════════════════════════════════════════
-# PHASE 3: PORT CHECK
-# ═══════════════════════════════════════════════════════════
+# PHASE 3: Port Check
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔌 PHASE 3: Quick Port Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "Phase 3: Port Check" -ForegroundColor Yellow
 $Ports = @(80, 443, 8080, 3306, 5432, 6379, 27017, 22)
-$OpenPorts = @()
 foreach ($Port in $Ports) {
     try {
@@ -198,311 +269,202 @@ foreach ($Port in $Ports) {
         $Wait = $Result.AsyncWaitHandle.WaitOne(500)
         if ($Wait -and $TCP.Connected) {
-            $Service = switch ($Port) {
-                80 { "HTTP" }
-                443 { "HTTPS" }
-                8080 { "HTTP-Alt" }
-                3306 { "MySQL" }
-                5432 { "PostgreSQL" }
-                6379 { "Redis" }
-                27017 { "MongoDB" }
-                22 { "SSH" }
-            }
-            $Risk = if ($Port -in @(3306, 5432, 6379, 27017)) { "HIGH" } else { "INFO" }
-            Write-Host "⚠️  Port $Port ($Service) - OPEN" -ForegroundColor $(if($Risk -eq "HIGH"){"Red"}else{"Yellow"})
-            $OpenPorts += [PSCustomObject]@{ Port = $Port; Service = $Service; Risk = $Risk }
+            $Service = switch ($Port) { 80{"HTTP"} 443{"HTTPS"} 8080{"HTTP-Alt"} 3306{"MySQL"} 5432{"PostgreSQL"} 6379{"Redis"} 27017{"MongoDB"} 22{"SSH"} }
+            $Risk = if ($Port -in @(3306,5432,6379,27017)) { "HIGH" } else { "INFO" }
+            Write-Host "  Port $Port ($Service) - OPEN" -ForegroundColor $(if($Risk -eq "HIGH"){"Red"}else{"Gray"})
+            $OpenPorts += [PSCustomObject]@{ Port=$Port; Service=$Service; Risk=$Risk }
         }
         $TCP.Close()
     } catch {}
 }
-if ($OpenPorts.Count -eq 0) {
-    Write-Host "✅ No common ports detected" -ForegroundColor Green
-}
-# ═══════════════════════════════════════════════════════════
-# PHASE 4: BASIC INJECTION TEST
-# ═══════════════════════════════════════════════════════════
+# PHASE 4: Injection Tests
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "💉 PHASE 4: Basic Injection Tests" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "Phase 4: Injection Tests" -ForegroundColor Yellow
-# XSS Test
-Write-Host "Testing XSS..." -ForegroundColor Gray
 $XSSPayload = "<script>alert(1)</script>"
 try {
     $Response = Invoke-WebRequest -Uri "$Target/search?q=$XSSPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
     if ($Response.Content -match [regex]::Escape($XSSPayload)) {
-        Write-Host "⚠️  Possible XSS reflection detected" -ForegroundColor Yellow
+        Write-Host "  XSS: Possible reflection detected" -ForegroundColor Yellow
     } else {
-        Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
+        Write-Host "  XSS: No obvious reflection" -ForegroundColor Green
     }
-} catch {
-    Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
-}
+} catch { Write-Host "  XSS: No obvious reflection" -ForegroundColor Green }
-# SQLi Test
-Write-Host "Testing SQL Injection..." -ForegroundColor Gray
 $SQLPayload = "' OR '1'='1"
 try {
     $Response = Invoke-WebRequest -Uri "$Target/?id=$SQLPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
-    $SQLErrors = @("SQL syntax", "MySQL", "PostgreSQL", "sqlite", "Microsoft SQL", "Warning: mysql", "error in your SQL")
+    $SQLErrors = @("SQL syntax","MySQL","PostgreSQL","sqlite","Microsoft SQL","Warning: mysql")
     $Found = $SQLErrors | Where-Object { $Response.Content -match $_ }
     if ($Found) {
-        Write-Host "⚠️  SQL error detected in response" -ForegroundColor Yellow
+        Write-Host "  SQLi: Error detected" -ForegroundColor Yellow
     } else {
-        Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
+        Write-Host "  SQLi: No obvious errors" -ForegroundColor Green
     }
-} catch {
-    Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
-}
-# ═══════════════════════════════════════════════════════════
-# PHASE 5: SSL/TLS CHECK
-# ═══════════════════════════════════════════════════════════
+} catch { Write-Host "  SQLi: No obvious errors" -ForegroundColor Green }
+# PHASE 5: SSL Check
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔐 PHASE 5: SSL/TLS Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-$SSLIssues = @()
+Write-Host "Phase 5: SSL/TLS Check" -ForegroundColor Yellow
 if ($Scheme -eq "https") {
-    Write-Host "✅ HTTPS enabled" -ForegroundColor Green
-    # Check HSTS
-    if ($HSTS -notmatch "max-age=([3-9]\d{5,}|\d{7,})") {
-        Write-Host "⚠️  HSTS max-age should be at least 1 year" -ForegroundColor Yellow
-        $SSLIssues += "HSTS max-age too short"
-    }
-    Write-Host "📝 For full SSL analysis: https://ssllabs.com/ssltest/analyze.html?d=$Domain" -ForegroundColor Cyan
+    Write-Host "  HTTPS: Enabled" -ForegroundColor Green
 } else {
-    Write-Host "❌ HTTPS not enforced" -ForegroundColor Red
-    $SSLIssues += "HTTPS not enabled"
+    Write-Host "  HTTPS: NOT enforced" -ForegroundColor Red
 }
-# ═══════════════════════════════════════════════════════════
 # SUMMARY
-# ═══════════════════════════════════════════════════════════
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "📊 SCAN SUMMARY" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  SCAN SUMMARY" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
+Write-Host "Header Score:  $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "True Exposed:  $($TrueExposedFiles.Count)" -ForegroundColor $(if($TrueExposedFiles.Count -gt 0){"Red"}else{"Green"})
+Write-Host "False Positives: $($FalsePositiveFiles.Count)" -ForegroundColor Gray
+Write-Host "Open Ports:    $($OpenPorts.Count)" -ForegroundColor $(if(($OpenPorts | Where-Object{$_.Risk -eq "HIGH"}).Count -gt 0){"Red"}else{"Green"})
+# Determine Overall Risk
+$CriticalPorts = ($OpenPorts | Where-Object { $_.Risk -eq "HIGH" }).Count
+$OverallRisk = if ($TrueExposedFiles.Count -gt 0 -or $CriticalPorts -gt 2 -or $HeaderScore -lt 40) { "HIGH" }
+              elseif ($TrueExposedFiles.Count -gt 0 -or $CriticalPorts -gt 0 -or $CORSIssues.Count -gt 0) { "MEDIUM" }
+              elseif ($HeaderScore -lt 70 -or $FalsePositiveFiles.Count -gt 0) { "LOW" }
+              else { "LOW" }
+# Generate Report
+$HeaderGrade = if ($HeaderScore -ge 90) { "A - Excellent" }
+               elseif ($HeaderScore -ge 80) { "B - Good" }
+               elseif ($HeaderScore -ge 70) { "B - Good" }
+               elseif ($HeaderScore -ge 50) { "C - Needs Improvement" }
+               else { "D/F - Poor" }
+$IssuesSection = if ($HeaderIssues.Count -gt 0) { "- " + ($HeaderIssues -join "`n- ") } else { "None" }
+$ExposedSection = ""
+if ($TrueExposedFiles.Count -gt 0) {
+    $ExposedSection = "| Path | Status | Risk | Description |`n"
+    $ExposedSection += "|------|--------|------|-------------|`n"
+    foreach ($f in $TrueExposedFiles) {
+        $ExposedSection += "| $($f.Path) | OPEN | $($f.Risk) | $($f.Desc) |`n"
+    }
+} else {
+    $ExposedSection = "No sensitive files actually exposed."
+}
-Write-Host "🔒 Header Score:  $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
-Write-Host "🔍 Exposed Files: $($ExposedFiles.Count)" -ForegroundColor $(if($ExposedFiles.Count -gt 0){"Yellow"}else{"Green"})
-Write-Host "🔌 Open Ports:    $($OpenPorts.Count)" -ForegroundColor $(if(($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0){"Red"}else{"Green"})
-Write-Host "💉 Injection:     Basic tests completed" -ForegroundColor Green
-Write-Host "🔐 SSL/TLS:       HTTPS $($SSLIssues.Count -eq 0 ? 'OK' : 'Issues')" -ForegroundColor $(if($SSLIssues.Count -eq 0){"Green"}else{"Yellow"})
+$FalsePOSection = ""
+if ($FalsePositiveFiles.Count -gt 0) {
+    $FalsePOSection = "### False Positives (Not Real Issues)`n`n"
+    $FalsePOSection += "These paths returned HTML/SPA content, not actual sensitive files:`n`n"
+    foreach ($f in $FalsePositiveFiles) {
+        $FalsePOSection += "- $($f.Path) - HTTP 200 (SPA routing)`n"
+    }
+    $FalsePOSection += "`n"
+}
-# ═══════════════════════════════════════════════════════════
-# GENERATE REPORT
-# ═══════════════════════════════════════════════════════════
+$CORSSection = ""
+if ($CORSIssues.Count -gt 0) {
+    $CORSSection = "### CORS Issues`n`n"
+    foreach ($c in $CORSIssues) {
+        $CORSSection += "- $c`n"
+    }
+    $CORSSection += "`n"
+}
-Write-Host ""
-Write-Host "📝 Generating detailed report..." -ForegroundColor Yellow
+$PortSection = ""
+if ($OpenPorts.Count -gt 0) {
+    $PortSection = "| Port | Service | Risk |`n|------|---------|------|`n"
+    foreach ($p in $OpenPorts) {
+        $PortSection += "| $($p.Port) | $($p.Service) | $($p.Risk) |`n"
+    }
+} else {
+    $PortSection = "No common ports detected.`n"
+}
+$Remediation = @()
+if ($TrueExposedFiles.Count -gt 0) { $Remediation += "1. **URGENT: Remove exposed sensitive files**" }
+if ($CORSIssues.Count -gt 0) { $Remediation += "2. Review CORS policy" }
+if ($HeaderIssues -match "unsafe-inline") { $Remediation += "3. Consider removing unsafe-inline from CSP" }
+if ($HeaderScore -lt 70) { $Remediation += "4. Improve security headers" }
+if ($Remediation.Count -eq 0) { $Remediation += "1. Continue monitoring security" }
+$TechSection = if ($TechStack.Count -gt 0) { "- " + ($TechStack -join "`n- ") } else { "Not detected" }
 $Report = @"
-# 🛡️ Full Security Audit Report
+# Security Audit Report
 **Target:** $Target
 **Domain:** $Domain
 **Date:** $Date
-**Scanner:** Full Security Scan v2.0
+**Scanner:** Full Security Scan v3.0
+**Author:** Rz (@soulofzephir)
 ---
-## 📋 Executive Summary
+## Executive Summary
 | Metric | Value |
 |--------|-------|
-| Target | $Target |
-| Scan Date | $Date |
-| Header Score | $HeaderScore/100 |
-| Exposed Files | $($ExposedFiles.Count) |
+| Header Score | $HeaderScore/100 ($HeaderGrade) |
+| True Exposed Files | $($TrueExposedFiles.Count) |
+| False Positives | $($FalsePositiveFiles.Count) |
 | Open Ports | $($OpenPorts.Count) |
-| SSL Issues | $($SSLIssues.Count) |
-### Overall Risk Assessment
-$(if ($HeaderScore -lt 50 -or $ExposedFiles.Count -gt 0 -or ($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
-    "🔴 **HIGH RISK** - Issues found requiring immediate attention"
-} elseif ($HeaderScore -lt 70 -or $ExposedFiles.Count -gt 0) {
-    "🟠 **MEDIUM RISK** - Some security improvements recommended"
-} else {
-    "🟢 **LOW RISK** - Minor issues to address"
-})
+| **Overall Risk** | **$OverallRisk** |
 ---
-## 🔒 1. Security Headers Analysis
+## Security Headers
-### Header Score: $HeaderScore/100
+### Score: $HeaderScore/100 ($HeaderGrade)
-$(if ($HeaderScore -ge 90) { "✅ **Grade A - Excellent**" }
-elseif ($HeaderScore -ge 70) { "✅ **Grade B - Good**" }
-elseif ($HeaderScore -ge 50) { "⚠️ **Grade C - Needs Improvement**" }
-else { "❌ **Grade D/F - Poor**" })
+#### Good Headers
+$($HeaderGood -join "`n")
-| Header | Status |
-|--------|--------|
-| HSTS | $(if ($HSTS) { "✅ Present" } else { "❌ Missing" }) |
-| CSP | $(if ($CSP) { "✅ Present" } else { "❌ Missing" }) |
-| X-Content-Type-Options | $(if ($XCTO -eq "nosniff") { "✅ nosniff" } else { "❌ Missing" }) |
-| X-Frame-Options | $(if ($XFO) { "✅ $XFO" } else { "❌ Missing" }) |
-| Referrer-Policy | $(if ($RP) { "✅ Present" } else { "⚠️ Missing" }) |
-| Cache-Control | $(if ($CC) { "✅ Present" } else { "⚠️ Missing" }) |
-| Server | $(if ($Server) { "⚠️ $Server" } else { "✅ Hidden" }) |
-| X-Powered-By | $(if ($XPB) { "⚠️ $XPB" } else { "✅ Hidden" }) |
-### Issues Found
-$(if ($HeaderIssues.Count -gt 0) {
-    foreach ($issue in $HeaderIssues) {
-        "- ⚠️  $issue"
-    }
-} else {
-    "✅ No major header issues"
-})
+#### Issues Found
+$IssuesSection
 ---
-## 🔍 2. Exposed Files Check
+## Exposed Files
-$(if ($ExposedFiles.Count -gt 0) {
-    "### 🚨 Found $($ExposedFiles.Count) Exposed Files"
-} else {
-    "### ✅ No Critical Files Exposed"
-})
-| Path | Risk |
-|------|------|
-$(foreach ($file in $ExposedFiles) {
-    "| $file | 🔴 CRITICAL |"
-})
-**Recommendation:** Remove or protect these files from public access.
+### True Exposures
+$ExposedSection
+$FalsePOSection
+## CORS Analysis
+$CORSSection
+## Port Scan Results
+$PortSection
+## Technology Stack
+$TechSection
 ---
-## 🔌 3. Port Scan Results
-$(if (($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
-    "### 🚨 High-Risk Ports Open"
-} else {
-    "### ✅ No High-Risk Ports Detected"
-})
-| Port | Service | Risk |
-|------|---------|------|
-$(foreach ($p in $OpenPorts) {
-    "| $($p.Port) | $($p.Service) | $(if($p.Risk -eq "HIGH"){"🔴 HIGH"}else{"🟢 INFO"}) |"
-})
+## Remediation
-**Recommendation:** Database ports (3306, 5432, 6379, 27017) should never be exposed to the internet.
+$(if ($Remediation.Count -gt 0) { $Remediation -join "`n" })
 ---
-## 💉 4. Injection Tests
-Basic automated tests completed.
+## Quick Links
-| Test | Status |
-|------|--------|
-| XSS Reflection | ⚠️ Review manually |
-| SQL Injection | ⚠️ Review manually |
-**Note:** For comprehensive injection testing, use:
-- SQLMap: \`sqlmap -u "$Target"\`
-- Dalfox: \`dalfox url "$Target"\`
+- Security Headers: https://securityheaders.com/?q=$Domain
+- SSL Labs: https://ssllabs.com/ssltest/analyze.html?d=$Domain
 ---
-## 🔐 5. SSL/TLS
-$(if ($Scheme -eq "https") {
-    "✅ HTTPS is enabled"
-} else {
-    "❌ HTTPS is NOT enabled"
-})
-$(if ($SSLIssues.Count -gt 0) {
-    "### ⚠️ SSL Issues:"
-    foreach ($issue in $SSLIssues) {
-        "- $issue"
-    }
-})
-**Full SSL Analysis:** https://ssllabs.com/ssltest/analyze.html?d=$Domain
----
-## 🛡️ Remediation Priority
-### Immediate (Critical)
-1. Implement missing security headers
-2. Remove/block exposed sensitive files (.env, .git/, backups)
-3. Close database ports from public access
-### Short-term
-1. Enable HSTS with long max-age
-2. Configure Content-Security-Policy
-3. Set up proper Cache-Control
-4. Hide server information
-### Long-term
-1. Regular security scanning
-2. Implement OWASP Top 10 controls
-3. Set up monitoring and alerting
-4. Security headers automated testing
----
-## 🔗 Recommended Tools for Deeper Analysis
-| Tool | Purpose |
-|------|---------|
-| Nuclei | Vulnerability scanning |
-| SQLMap | SQL injection testing |
-| Dalfox | XSS scanning |
-| Nmap | Full port scan |
-| testssl.sh | SSL/TLS audit |
-| Burp Suite | Web vulnerability testing |
----
-## 📄 Report Location
-**File:** \`$OutputFile\`
-**Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
-**Author:** Rz (@soulofzephir)
----
-**⚠️ Disclaimer:** This is an automated scan. Manual testing recommended for comprehensive security assessment.
+**Generated:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
 "@
 $Report | Out-File -FilePath $OutputFile -Encoding UTF8
-# ═══════════════════════════════════════════════════════════
-# COMPLETE
-# ═══════════════════════════════════════════════════════════
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
-Write-Host "✅ FULL SCAN COMPLETE!" -ForegroundColor Green
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
+Write-Host "========================================" -ForegroundColor Green
+Write-Host "  Scan Complete!" -ForegroundColor Green
+Write-Host "========================================" -ForegroundColor Green
 Write-Host ""
-Write-Host "📄 Report: $OutputFile" -ForegroundColor White
+Write-Host "Report: $OutputFile" -ForegroundColor White
 Write-Host ""
-Write-Host "🔗 Quick Links:" -ForegroundColor Cyan
-Write-Host "   Headers: https://securityheaders.com/?q=$Domain"
-Write-Host "   SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
+Write-Host "Quick Links:" -ForegroundColor Cyan
+Write-Host "  Headers: https://securityheaders.com/?q=$Domain"
+Write-Host "  SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
 Write-Host ""

package/soulofzephir-pi-skill-pentesting-1.0.3.tgz ADDED Viewed

Binary file

package/soulofzephir-pi-skill-pentesting-1.0.4.tgz ADDED Viewed

Binary file