#!/bin/bash
# Fase 1: Reconocimiento desde Internet (vía Cloudflare)
# ======================================================
# Simula lo que vería un atacante externo

source /workspace/targets.txt 2>/dev/null || {
    echo "[!] Edita targets.txt primero"
    exit 1
}

REPORT_DIR="/workspace/reports/01-recon-internet"
mkdir -p "$REPORT_DIR"
DATE=$(date +%Y%m%d_%H%M%S)

echo "=========================================="
echo " FASE 1: RECONOCIMIENTO DESDE INTERNET"
echo "=========================================="

# 1. Resolución DNS de todos los subdominios
echo "[*] Resolviendo subdominios..."
for domain in "${DOMAINS[@]}"; do
    echo -n "  $domain -> "
    dig +short "$domain" 2>/dev/null || echo "NO RESOLVES"
done | tee "$REPORT_DIR/dns-resolution-$DATE.txt"

# 2. WHOIS del dominio
echo -e "\n[*] WHOIS wahandri.com..."
whois wahandri.com 2>/dev/null | head -20 | tee "$REPORT_DIR/whois-$DATE.txt"

# 3. Nmap desde internet (solo 80/443 visibles)
echo -e "\n[*] Nmap a $SERVER_IP_LOCAL (puertos comunes)..."
nmap -sV -sC -p 80,443,22 "$SERVER_IP_LOCAL" \
    -oN "$REPORT_DIR/nmap-internet-$DATE.txt" 2>/dev/null

# 4. WhatWeb - identificar tecnologías por subdominio
echo -e "\n[*] WhatWeb - identificando tecnologías..."
for domain in "${DOMAINS[@]}"; do
    echo "  --- $domain ---"
    whatweb -a 3 "https://$domain" 2>/dev/null | tee -a "$REPORT_DIR/whatweb-$DATE.txt"
done

# 5. TLS/SSL test
echo -e "\n[*] Test SSL..."
for domain in "${DOMAINS[@]}"; do
    echo "  Probando $domain..."
    testssl.sh --quiet --parallel "https://$domain" 2>/dev/null \
        | tee -a "$REPORT_DIR/ssl-test-$DATE.txt" | head -10
done

# 6. WAF detection
echo -e "\n[*] Detectando WAF (Cloudflare)..."
wafw00f "https://$SERVER_DOMAIN" 2>/dev/null \
    | tee "$REPORT_DIR/waf-$DATE.txt"

echo -e "\n[+] Fase 1 completa. Reportes en: $REPORT_DIR"