#!/bin/bash
# Fase 2: Reconocimiento desde LAN local
# =======================================
# Simula un atacante en la misma red

source /workspace/targets.txt 2>/dev/null || {
    echo "[!] Edita targets.txt primero"
    exit 1
}

REPORT_DIR="/workspace/reports/02-recon-local"
mkdir -p "$REPORT_DIR"
DATE=$(date +%Y%m%d_%H%M%S)

echo "=========================================="
echo " FASE 2: RECONOCIMIENTO DESDE LAN LOCAL"
echo "=========================================="

# 1. Nmap completo a la IP del servidor
echo "[*] Nmap completo a $SERVER_IP_LOCAL..."
nmap -sT -sU -p- --min-rate=5000 -T4 "$SERVER_IP_LOCAL" \
    -oN "$REPORT_DIR/nmap-full-ports-$DATE.txt" 2>/dev/null

# 2. Escaneo de servicios con versiones (puertos TOP 1000)
echo -e "\n[*] Nmap servicios + scripts básicos..."
nmap -sT -sV -sC -p 22,80,443,445,139,3389,3306,5432,6379,8000,8001,8004,7681,11434,18765,18766,3000,3001,8081,7860 \
    "$SERVER_IP_LOCAL" -oN "$REPORT_DIR/nmap-services-$DATE.txt" 2>/dev/null

# 3. Escaneo UDP (servicios comunes)
echo -e "\n[*] Nmap UDP..."
nmap -sU -p 53,67,68,123,137,138,161,162,500,1194,4500 \
    "$SERVER_IP_LOCAL" -oN "$REPORT_DIR/nmap-udp-$DATE.txt" 2>/dev/null

# 4. Detectar SO
echo -e "\n[*] Detección de OS..."
nmap -O --osscan-guess "$SERVER_IP_LOCAL" \
    -oN "$REPORT_DIR/nmap-os-$DATE.txt" 2>/dev/null

# 5. Conexiones a servicios internos
echo -e "\n[*] Probando acceso a servicios internos..."
for port in 3306 5432 6379 8081 7681 11434; do
    timeout 3 bash -c "echo > /dev/tcp/$SERVER_IP_LOCAL/$port" 2>/dev/null \
        && echo "  Puerto $port: ABIERTO (accesible)" \
        || echo "  Puerto $port: cerrado/filtrado"
done | tee "$REPORT_DIR/internal-access-$DATE.txt"

# 6. Samba enumeration
echo -e "\n[*] Enumeración Samba..."
smbclient -L "//$SERVER_IP_LOCAL" -N 2>/dev/null \
    | tee "$REPORT_DIR/samba-shares-$DATE.txt"

# 7. Verificar si el servidor responde a ping
echo -e "\n[*] Ping check..."
ping -c 2 -W 2 "$SERVER_IP_LOCAL" 2>/dev/null \
    | tee "$REPORT_DIR/ping-$DATE.txt"

echo -e "\n[+] Fase 2 completa. Reportes en: $REPORT_DIR"