v2: real exploitation — discovery phase, nuclei CVE scanning, SQLi/XSS/LFI rebuild

- New discovery engine (engine/discovery.sh): crawls target for real
  URLs, forms, parameters, and API endpoints before attacking
- New nuclei vector (21): runs nuclei templates for real CVE detection
  (critical/high/medium severity)
- Rebuilt SQLi vector: tests discovered forms and URL params with
  error-based and time-based blind payloads, sqlmap injection
- Rebuilt XSS vector: multi-context payloads against discovered
  forms/params, confirms payload reflection
- Rebuilt LFI vector: tests all discovered and common file parameters
  with traversal payloads, confirms by reading /etc/passwd
- Updated main analyzer with 5-step pipeline: connectivity →
  discovery → recon → Ollama brain → exploitation

analyzer

@@ -26,6 +26,7 @@ export REPORTS_DIR="$ANALYZER_DIR/reports"
 # Source core
 source "$LIB_DIR/colors.sh"
 source "$LIB_DIR/utils.sh"
+source "$ENGINE_DIR/discovery.sh"
 source "$ENGINE_DIR/recon.sh"
 source "$ENGINE_DIR/ollama-brain.sh"
 source "$ENGINE_DIR/reporter.sh"
@@ -58,7 +59,7 @@ interactive_mode() {
   echo -e "  ${GREEN}1${NC}. Quick Scan  — Fast recon + auto-vector selection"
   echo -e "  ${GREEN}2${NC}. Deep Scan   — Full recon, all vectors, exhaustive"
   echo -e "  ${GREEN}3${NC}. Custom Scan — Pick your own vectors"
-  echo -e "  ${GREEN}4${NC}. List Vectors — Show all 20 attack vectors"
+  echo -e "  ${GREEN}4${NC}. List Vectors — Show all 21 attack vectors"
   echo -e "  ${GREEN}5${NC}. View Reports — Browse past results"
   echo -e "  ${DIM}q${NC}. Quit"
   echo ''
@@ -102,19 +103,23 @@ quick_scan() {
   echo -e "\n${BRIGHT_CYAN}${BOLD}═══ QUICK SCAN MODE ═══${NC}\n"
   
   # Step 1: Check connectivity
-  print_step 1 4 "Checking target..."
+  print_step 1 5 "Checking target..."
   if ! target_alive "$target"; then
     print_error "Target unreachable!"
     exit 1
   fi
   print_ok "Target is alive"
   
-  # Step 2: Recon
-  print_step 2 4 "Reconnaissance"
+  # Step 2: Discovery — find real URLs, forms, params to attack
+  print_step 2 5 "Discovering attack surface"
+  discover_target "$target"
+  
+  # Step 3: Recon
+  print_step 3 5 "Reconnaissance"
   recon_target "$target" "$report"
   
-  # Step 3: Ollama decides
-  print_step 3 4 "Ollama brain selecting vectors"
+  # Step 4: Ollama decides
+  print_step 4 5 "Ollama brain selecting vectors"
   local decision=$(ollama_decide "$target")
   echo ''
   echo -e "${MAGENTA}${ICON_BRAIN} Ollama's Strategy:${NC}"
@@ -123,16 +128,16 @@ quick_scan() {
   local selected=$(parse_decision "$decision")
   
   if [ -z "$selected" ]; then
-    print_warn "Ollama didn't pick specific vectors. Running top 5."
-    selected="1 2 3 4 5"
+    print_warn "Ollama didn't pick specific vectors. Running default set."
+    selected="21 1 2 3 4"  # nuclei + sqli + xss + lfi + cmdi
   fi
   
   echo ''
   print_info "Running vectors: $(echo $selected | tr '\n' ' ')"
   echo ''
   
-  # Step 4: Run vectors
-  print_step 4 4 "Executing attack vectors"
+  # Step 5: Run vectors
+  print_step 5 5 "Executing attack vectors"
   run_vectors "$target" "$report" $selected
   
   # Generate final report
@@ -164,8 +169,8 @@ deep_scan() {
   recon_target "$target" "$report"
   
   # Step 3: Run ALL vectors
-  print_step 3 3 "Running all 20 attack vectors"
-  local all_vectors=$(seq 1 20 | tr '\n' ' ')
+  print_step 3 3 "Running all 21 attack vectors"
+  local all_vectors=$(seq 1 21 | tr '\n' ' ')
   run_vectors "$target" "$report" $all_vectors
   
   # Generate report
@@ -257,9 +262,9 @@ run_vectors() {
     
     # Map vector names to function names
     case $num in
-      1) func_name="vector_sqli" ;;
-      2) func_name="vector_xss" ;;
-      3) func_name="vector_lfi" ;;
+      1) func_name="vector_sqli_v2" ;;
+      2) func_name="vector_xss_v2" ;;
+      3) func_name="vector_lfi_v2" ;;
       4) func_name="vector_cmdi" ;;
       5) func_name="vector_ssrf" ;;
       6) func_name="vector_oredir" ;;
@@ -277,6 +282,7 @@ run_vectors() {
       18) func_name="vector_cors" ;;
       19) func_name="vector_race" ;;
       20) func_name="vector_nosqli" ;;
+      21) func_name="vector_nuclei" ;;
     esac
     
     if declare -f "$func_name" >/dev/null; then