#!/bin/bash
# Fase 3: Escaneo de Aplicaciones Web (OWASP Top 10)
# ===================================================
# Pruebas contra servicios web expuestos

source /workspace/targets.txt 2>/dev/null || {
    echo "[!] Edita targets.txt primero"
    exit 1
}

REPORT_DIR="/workspace/reports/03-web-scan"
mkdir -p "$REPORT_DIR"
DATE=$(date +%Y%m%d_%H%M%S)

echo "=========================================="
echo " FASE 3: WEB APPLICATION SCANNING"
echo "=========================================="

# --- SUBFASE A: Headers de seguridad ---
echo "=== A. Headers de Seguridad ==="
for domain in "${DOMAINS[@]}"; do
    echo "  [$domain]"
    curl -s -I "https://$domain" 2>/dev/null | grep -iE 'strict-transport|content-security|x-frame|x-content|x-permitted|referrer-policy|cache-control' \
        | tee -a "$REPORT_DIR/security-headers-$DATE.txt"
    echo "---"
done

# --- SUBFASE B: Nikto scan (rápido) ---
echo -e "\n=== B. Nikto Scan ==="
for domain in "${DOMAINS[@]}"; do
    echo "  Escaneando $domain..."
    nikto -h "https://$domain" -ssl -timeout 10 -nointeractive \
        2>/dev/null | tee -a "$REPORT_DIR/nikto-$DATE.txt"
done

# --- SUBFASE C: Nuclei scan ---
echo -e "\n=== C. Nuclei Scan ==="
for domain in "${DOMAINS[@]}"; do
    echo "  Escaneando $domain..."
    nuclei -u "https://$domain" -severity low,medium,high,critical \
        -o "$REPORT_DIR/nuclei-$domain-$DATE.txt" \
        -silent 2>/dev/null
done

# --- SUBFASE D: Directory fuzzing con gobuster ---
echo -e "\n=== D. Directory Fuzzing ==="
# Usar wordlist pequeña por defecto, o la de SecLists si existe
WORDLIST="/workspace/wordlists/common.txt"
if [ ! -f "$WORDLIST" ]; then
    echo "  [!] No hay wordlist, creando lista básica..."
    mkdir -p /workspace/wordlists
    cat > "$WORDLIST" << 'EOF'
admin
login
api
dashboard
health
docs
swagger
graphql
wp-admin
backup
config
.env
.git
db
debug
test
beta
v1
v2
internal
private
secret
panel
manager
console
phpmyadmin
phpinfo
server-status
metrics
prometheus
EOF
fi

for domain in "${DOMAINS[@]}"; do
    echo "  Fuzzeando $domain..."
    gobuster dir -u "https://$domain" \
        -w "$WORDLIST" \
        -t 20 \
        -q 2>/dev/null | tee -a "$REPORT_DIR/gobuster-$domain-$DATE.txt"
done

# --- SUBFASE E: WhatWeb detallado ---
echo -e "\n=== E. WhatWeb Detallado ==="
for domain in "${DOMAINS[@]}"; do
    whatweb -a 3 "https://$domain" 2>/dev/null \
        | tee -a "$REPORT_DIR/whatweb-detailed-$DATE.txt"
done

# --- SUBFASE F: Pruebas de Autenticación ---
echo -e "\n=== F. Pruebas de Autenticación ==="

# Probar endpoints conocidos sin auth
echo "  Probando acceso sin auth a rutas protegidas..."
for domain in "${DOMAINS[@]}"; do
    for path in /health /api /api/v1 /docs /openapi.json /admin /system /config; do
        status=$(curl -s -o /dev/null -w "%{http_code}" "https://$domain$path" 2>/dev/null)
        if [ "$status" != "401" ] && [ "$status" != "403" ] && [ "$status" != "404" ]; then
            echo "  [!] $domain$path -> $status (posible acceso sin auth)"
        fi
        done | tee -a "$REPORT_DIR/auth-bypass-$DATE.txt"
done

# --- SUBFASE G: SQL Injection básico ---
echo -e "\n=== G. SQL Injection Test (básico) ==="
for domain in "${DOMAINS[@]}"; do
    echo "  Probando $domain..."
    sqlmap -u "https://$domain/api" --batch --level 1 --risk 1 \
        --flush-session --output-dir="$REPORT_DIR/sqlmap-$DATE" 2>/dev/null \
        | grep -E 'CRITICAL|WARNING|Parameter|Type:|Payload|vulnerable' | head -20
done

echo -e "\n[+] Fase 3 completa. Reportes en: $REPORT_DIR"
echo "  Revisa manualmente los archivos en $REPORT_DIR para ver resultados."