v2: real exploitation — discovery phase, nuclei CVE scanning, SQLi/XSS/LFI rebuild

- New discovery engine (engine/discovery.sh): crawls target for real
  URLs, forms, parameters, and API endpoints before attacking
- New nuclei vector (21): runs nuclei templates for real CVE detection
  (critical/high/medium severity)
- Rebuilt SQLi vector: tests discovered forms and URL params with
  error-based and time-based blind payloads, sqlmap injection
- Rebuilt XSS vector: multi-context payloads against discovered
  forms/params, confirms payload reflection
- Rebuilt LFI vector: tests all discovered and common file parameters
  with traversal payloads, confirms by reading /etc/passwd
- Updated main analyzer with 5-step pipeline: connectivity →
  discovery → recon → Ollama brain → exploitation

vectors/21-nuclei.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# Vector 21: Nuclei — Real CVE Detection
+# Desc: Runs nuclei templates against discovered endpoints to find real CVEs
+# Detect: Any target with reachable endpoints
+# Severity: CRITICAL
+# Tools: nuclei
+
+vector_nuclei() {
+  local target="$1"
+  local report="$2"
+  local domain=$(get_domain "$target")
+  local findings=0
+  
+  print_info "Running Nuclei — real CVE detection..."
+  
+  if ! command -v nuclei &>/dev/null; then
+    print_skip "nuclei not installed. Skipping CVE scanning."
+    return 0
+  fi
+  
+  # Check nuclei templates exist
+  if [ ! -d "$HOME/nuclei-templates" ] && [ ! -d "/root/nuclei-templates" ]; then
+    print_warn "Nuclei templates not found. Updating..."
+    nuclei -update-templates 2>/dev/null | tail -1
+  fi
+  
+  # Nuclei output file
+  local nuclei_out="$REPORTS_DIR/.${domain}_nuclei.json"
+  
+  print_sub "Scanning with nuclei (severity: critical, high, medium)..."
+  print_info "This may take 1-3 minutes..."
+  
+  # Run nuclei with focused templates
+  nuclei -u "$target" \
+    -severity critical,high,medium \
+    -json \
+    -o "$nuclei_out" \
+    -rate-limit 50 \
+    -concurrency 10 \
+    -timeout 8 \
+    -retries 1 \
+    -silent 2>/dev/null &
+  
+  local nuclei_pid=$!
+  
+  # Show spinner while waiting
+  local waited=0
+  while kill -0 $nuclei_pid 2>/dev/null; do
+    sleep 2
+    waited=$((waited + 2))
+    if [ $waited -ge 120 ]; then
+      print_warn "Nuclei timeout (2min), killing..."
+      kill $nuclei_pid 2>/dev/null
+      break
+    fi
+  done
+  
+  wait $nuclei_pid 2>/dev/null
+  
+  # Parse results
+  if [ -f "$nuclei_out" ] && [ -s "$nuclei_out" ]; then
+    local vuln_count=$(wc -l < "$nuclei_out" | tr -d ' ')
+    
+    if [ "$vuln_count" -gt 0 ]; then
+      print_find "Nuclei found $vuln_count vulnerabilities!"
+      
+      while IFS= read -r line; do
+        [ -z "$line" ] && continue
+        
+        local template=$(echo "$line" | jq -r '.templateID // "unknown"' 2>/dev/null)
+        local name=$(echo "$line" | jq -r '.info.name // "Unknown"' 2>/dev/null)
+        local severity=$(echo "$line" | jq -r '.info.severity // "unknown"' 2>/dev/null)
+        local matched=$(echo "$line" | jq -r '.matched // ""' 2>/dev/null)
+        local curl_cmd=$(echo "$line" | jq -r '.curl-command // ""' 2>/dev/null)
+        local extract=$(echo "$line" | jq -r '.extracted-results // [] | join(", ")' 2>/dev/null)
+        
+        local sev_upper=$(echo "$severity" | tr '[:lower:]' '[:upper:]')
+        
+        # Save finding
+        echo "SEVERITY: $sev_upper
+VECTOR: Nuclei - $template
+DETAIL: $name on $matched
+EVIDENCE: $extract
+EXPLOIT: $curl_cmd" > "$REPORTS_DIR/.finding_$(date +%s)_nuclei-${template}.txt"
+        
+        findings=$((findings + 1))
+        
+        # Print to screen
+        case "$severity" in
+          critical) echo -e "    ${BRIGHT_RED}🔴 [CRITICAL]${NC} $name" ;;
+          high)     echo -e "    ${RED}🟠 [HIGH]${NC} $name" ;;
+          medium)   echo -e "    ${YELLOW}🟡 [MEDIUM]${NC} $name" ;;
+          *)        echo -e "    ${BLUE}🔵 [$severity]${NC} $name" ;;
+        esac
+        [ -n "$matched" ] && echo -e "    ${DIM}     $matched${NC}"
+        
+      done < "$nuclei_out"
+    else
+      print_ok "Nuclei found no vulnerabilities"
+    fi
+  else
+    print_ok "Nuclei found no vulnerabilities"
+  fi
+  
+  return $findings
+}