The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain
This commit is contained in:
drjones
121
engine/recon.sh
Executable file
121
engine/recon.sh
Executable file
@@ -0,0 +1,121 @@
|
||||
#!/usr/bin/env bash
|
||||
# The Analyzer - Reconnaissance Engine
|
||||
# Gathers target info for Ollama to make decisions
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
source "$SCRIPT_DIR/../lib/utils.sh"
|
||||
|
||||
recon_target() {
|
||||
local target="$1"
|
||||
local domain=$(get_domain "$target")
|
||||
local report="$2"
|
||||
|
||||
echo ""
|
||||
print_info "Gathering intelligence on $target..."
|
||||
separator
|
||||
|
||||
RECON_DATA="Target: $target\nDomain: $domain\n"
|
||||
|
||||
# 1. HTTP Status + Headers
|
||||
print_sub "Checking HTTP response..."
|
||||
local status=$(http_check "$target")
|
||||
local headers=$(get_headers "$target")
|
||||
local server=$(echo "$headers" | grep -i '^server:' | sed 's/[Ss]erver: //' | tr -d '\r')
|
||||
local ctype=$(echo "$headers" | grep -i '^content-type:' | sed 's/[Cc]ontent-[Tt]ype: //' | tr -d '\r')
|
||||
local powered=$(echo "$headers" | grep -i '^x-powered-by:' | sed 's/[Xx]-[Pp]owered-[Bb]y: //' | tr -d '\r')
|
||||
local cf_ray=$(echo "$headers" | grep -i '^cf-ray' | head -1)
|
||||
local akamai=$(echo "$headers" | grep -i 'x-akamai' | head -1)
|
||||
|
||||
RECON_DATA+="Status: $status\n"
|
||||
[ -n "$server" ] && RECON_DATA+="Server: $server\n" && print_info "Server: $server"
|
||||
[ -n "$powered" ] && RECON_DATA+="X-Powered-By: $powered\n" && print_info "Powered by: $powered"
|
||||
[ -n "$cf_ray" ] && RECON_DATA+="Cloudflare: true\n" && print_warn "Cloudflare detected"
|
||||
[ -n "$akamai" ] && RECON_DATA+="Akamai: true\n" && print_warn "Akamai detected"
|
||||
|
||||
# 2. Title
|
||||
local title=$(get_title "$target")
|
||||
[ -n "$title" ] && RECON_DATA+="Page Title: $title\n" && print_info "Title: $title"
|
||||
|
||||
# 3. Technologies (basic)
|
||||
print_sub "Detecting technologies..."
|
||||
local techs=""
|
||||
echo "$headers" | grep -qi 'php' && techs+="PHP, " && RECON_DATA+="Tech: PHP\n"
|
||||
echo "$headers" | grep -qi 'asp\.net\|x-aspnet' && techs+="ASP.NET, " && RECON_DATA+="Tech: ASP.NET\n"
|
||||
echo "$headers" | grep -qi 'nginx' && techs+="Nginx, " && RECON_DATA+="Tech: Nginx\n"
|
||||
echo "$headers" | grep -qi 'apache' && techs+="Apache, " && RECON_DATA+="Tech: Apache\n"
|
||||
echo "$headers" | grep -qi 'express' && techs+="Express, " && RECON_DATA+="Tech: Express/Node\n"
|
||||
echo "$headers" | grep -qi 'django\|python' && techs+="Python/Django, " && RECON_DATA+="Tech: Python/Django\n"
|
||||
echo "$headers" | grep -qi 'rails\|ruby' && techs+="Ruby/Rails, " && RECON_DATA+="Tech: Ruby/Rails\n"
|
||||
echo "$headers" | grep -qi 'java\|tomcat\|jboss' && techs+="Java, " && RECON_DATA+="Tech: Java\n"
|
||||
echo "$headers" | grep -qi 'wordpress' && techs+="WordPress, " && RECON_DATA+="Tech: WordPress\n"
|
||||
echo "$headers" | grep -qi 'cloudflare' && techs+="Cloudflare, "
|
||||
echo "$headers" | grep -qi 'set-cookie.*session' && RECON_DATA+="Has Session Cookies: true\n"
|
||||
|
||||
[ -n "$techs" ] && print_info "Tech: ${techs%, }"
|
||||
|
||||
# 4. Check for common paths
|
||||
print_sub "Checking common endpoints..."
|
||||
local common_paths=("robots.txt" "sitemap.xml" ".git/HEAD" ".env" "admin" "api" "wp-admin" "login" "graphql")
|
||||
local found_paths=""
|
||||
|
||||
for path in "${common_paths[@]}"; do
|
||||
local code=$(http_check "$target/$path" 2>/dev/null)
|
||||
if [[ "$code" =~ ^[23] ]]; then
|
||||
found_paths+="$path($code), "
|
||||
RECON_DATA+="Endpoint Found: /$path (HTTP $code)\n"
|
||||
print_find "Found: /$path (HTTP $code)"
|
||||
fi
|
||||
done
|
||||
|
||||
# 5. Page content samples (first 5KB)
|
||||
print_sub "Sampling page content..."
|
||||
local page_content=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | head -c 5000)
|
||||
|
||||
# Detect forms
|
||||
if echo "$page_content" | grep -qi '<form\|<input.*type="\(text\|password\|email\|search\)"\|method="\(get\|post\)"'; then
|
||||
RECON_DATA+="Has Forms: true\n"
|
||||
print_info "Forms detected on page"
|
||||
fi
|
||||
|
||||
# Detect login
|
||||
if echo "$page_content" | grep -qi 'login\|signin\|password\|type="password"'; then
|
||||
RECON_DATA+="Has Login: true\n"
|
||||
print_info "Login form detected"
|
||||
fi
|
||||
|
||||
# Detect search
|
||||
if echo "$page_content" | grep -qi 'search\|type="search"\|name="q"\|\bapi\b'; then
|
||||
RECON_DATA+="Has Search: true\n"
|
||||
print_info "Search functionality detected"
|
||||
fi
|
||||
|
||||
# Detect file upload
|
||||
if echo "$page_content" | grep -qi 'type="file"\|multipart/form-data\|upload'; then
|
||||
RECON_DATA+="Has File Upload: true\n"
|
||||
print_info "File upload detected"
|
||||
fi
|
||||
|
||||
# Detect JS frameworks / SPAs
|
||||
if echo "$page_content" | grep -qi 'react\|vue\|angular\|next.js\|nuxt'; then
|
||||
RECON_DATA+="SPA Framework: true\n"
|
||||
print_info "SPA framework detected"
|
||||
fi
|
||||
|
||||
# Detect API endpoints
|
||||
if echo "$page_content" | grep -qi 'api\.\|/v1/\|/v2/\|/api/\|graphql\|rest\|endpoint'; then
|
||||
RECON_DATA+="Has API References: true\n"
|
||||
print_info "API references found in page"
|
||||
fi
|
||||
|
||||
# Detect JWT
|
||||
if echo "$page_content" | grep -qi 'eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*'; then
|
||||
RECON_DATA+="JWT Tokens Found: true\n"
|
||||
print_find "JWT tokens detected in page!"
|
||||
fi
|
||||
|
||||
# Save recon data for the brain
|
||||
echo "$RECON_DATA" > "$REPORTS_DIR/.${domain}_recon.txt"
|
||||
|
||||
print_ok "Recon complete for $domain"
|
||||
return 0
|
||||
}
|
||||
Reference in New Issue
Block a user