v2: real exploitation — discovery phase, nuclei CVE scanning, SQLi/XSS/LFI rebuild

- New discovery engine (engine/discovery.sh): crawls target for real
  URLs, forms, parameters, and API endpoints before attacking
- New nuclei vector (21): runs nuclei templates for real CVE detection
  (critical/high/medium severity)
- Rebuilt SQLi vector: tests discovered forms and URL params with
  error-based and time-based blind payloads, sqlmap injection
- Rebuilt XSS vector: multi-context payloads against discovered
  forms/params, confirms payload reflection
- Rebuilt LFI vector: tests all discovered and common file parameters
  with traversal payloads, confirms by reading /etc/passwd
- Updated main analyzer with 5-step pipeline: connectivity →
  discovery → recon → Ollama brain → exploitation

vectors/12-jwt.sh

@@ -1,11 +1,11 @@
-1|#!/usr/bin/env bash
-2|# Vector 12: JWT Attacks
-3|# Desc: JWT token manipulation (none alg, weak keys, etc.)
-4|# Detect: JWT tokens in cookies, headers, or params
-5|# Severity: HIGH
-6|# Tools: curl, jq
-7|
-8|vector_jwt() {
+#!/usr/bin/env bash
+# Vector 12: JWT Attacks
+# Desc: JWT token manipulation (none alg, weak keys, etc.)
+# Detect: JWT tokens in cookies, headers, or params
+# Severity: HIGH
+# Tools: curl, jq
+
+vector_jwt() {
  local target="$1"
  local report="$2"
  local findings=0
@@ -46,23 +46,22 @@
    if echo "$response" | grep -qi "admin\|dashboard\|profile\|200\|success"; then
      print_find "JWT 'none' algorithm bypass!" "Token accepted without signature"
      echo "SEVERITY: CRITICAL
-49|VECTOR: JWT Algorithm Confusion (none)
-50|DETAIL: Server accepts 'alg:none' JWT token on $target
-51|EVIDENCE: Token with 'none' alg accepted by server
-52|EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
+VECTOR: JWT Algorithm Confusion (none)
+DETAIL: Server accepts 'alg:none' JWT token on $target
+EVIDENCE: Token with 'none' alg accepted by server
+EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
      findings=$((findings + 1))
    fi
    
    # Save JWT info for report
    echo "SEVERITY: INFO
-58|VECTOR: JWT Token Discovery
-59|DETAIL: JWT token found on $target
-60|EVIDENCE: Token: ${jwt:0:80}...
-61|EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
+VECTOR: JWT Token Discovery
+DETAIL: JWT token found on $target
+EVIDENCE: Token: ${jwt:0:80}...
+EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
  else
    print_skip "No JWT tokens found"
  fi
  
  return $findings
-67|}
-68|
+}