136 lines
3.8 KiB
Bash
Executable File
136 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The Analyzer - Ollama Brain
|
|
# Decision engine that picks attack vectors based on recon data
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../lib/utils.sh"
|
|
|
|
ollama_decide() {
|
|
local target="$1"
|
|
local domain=$(get_domain "$target")
|
|
local recon_file="$REPORTS_DIR/.${domain}_recon.txt"
|
|
|
|
print_brain "Consulting Ollama ($OLLAMA_MODEL) on attack strategy..."
|
|
|
|
if [ ! -f "$recon_file" ]; then
|
|
print_warn "No recon data found. Running blind."
|
|
RECON_SUMMARY="No reconnaissance data available."
|
|
else
|
|
RECON_SUMMARY=$(cat "$recon_file")
|
|
fi
|
|
|
|
# Available vectors metadata
|
|
local vector_list=""
|
|
for f in "$VECTORS_DIR"/*.sh; do
|
|
local name=$(basename "$f" .sh)
|
|
local num=$(echo "$name" | cut -d- -f1)
|
|
local desc=$(head -10 "$f" | grep "^# Desc:" | sed 's/^# Desc: //')
|
|
local detect=$(head -10 "$f" | grep "^# Detect:" | sed 's/^# Detect: //')
|
|
local severity=$(head -10 "$f" | grep "^# Severity:" | sed 's/^# Severity: //')
|
|
vector_list+="$num: ${name#?-} | $desc | Triggers: $detect | Severity: $severity\n"
|
|
done
|
|
|
|
# Write prompts to temp files to avoid heredoc parsing issues
|
|
local sys_file=$(mktemp)
|
|
local usr_file=$(mktemp)
|
|
|
|
cat > "$sys_file" << EOF
|
|
You are The Analyzer, an autonomous security testing engine for authorized bug bounty hunting.
|
|
You analyze reconnaissance data and select the most effective attack vectors.
|
|
|
|
RULES:
|
|
1. Only recommend vectors with CLEAR EVIDENCE they will work based on recon data
|
|
2. Prioritize HIGH and CRITICAL severity vectors
|
|
3. Recommend 5-10 vectors max
|
|
4. Order by likelihood of success, not just severity
|
|
5. Include a brief reason for each recommendation
|
|
6. NEVER recommend attacking systems without authorization
|
|
7. Focus on: SQLi, XSS, LFI, RCE, SSRF, IDOR, API abuse, auth bypass
|
|
|
|
Return your response as a numbered list in this EXACT format:
|
|
## DECISION
|
|
1. <vector_number>: <reason>
|
|
2. <vector_number>: <reason>
|
|
|
|
## SUMMARY
|
|
<brief strategy summary>
|
|
EOF
|
|
|
|
cat > "$usr_file" << EOF
|
|
TARGET: $target
|
|
DOMAIN: $domain
|
|
|
|
RECONNAISSANCE DATA:
|
|
$RECON_SUMMARY
|
|
|
|
AVAILABLE ATTACK VECTORS:
|
|
$vector_list
|
|
|
|
Analyze the recon data and select the best attack vectors to run. Return ONLY the numbered list of vectors to execute and a brief summary.
|
|
EOF
|
|
|
|
print_brain "Analyzing recon data and selecting vectors..."
|
|
|
|
local decision=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
|
|
|
|
rm -f "$sys_file" "$usr_file"
|
|
|
|
echo "$decision"
|
|
}
|
|
|
|
# Extract vector numbers from Ollama's decision
|
|
parse_decision() {
|
|
local decision="$1"
|
|
echo "$decision" | perl -nle 'print $1 if /^\d+\.\s*(\d+)/' | head -$MAX_VECTORS
|
|
}
|
|
|
|
# Rate a finding with Ollama
|
|
rate_finding() {
|
|
local finding="$1"
|
|
local target="$2"
|
|
|
|
local sys_file=$(mktemp)
|
|
local usr_file=$(mktemp)
|
|
|
|
cat > "$sys_file" << 'SYS'
|
|
You are a vulnerability severity assessor. Rate findings as CRITICAL, HIGH, MEDIUM, LOW, or INFO based on OWASP standards. Return only the severity level and a one-line justification.
|
|
SYS
|
|
|
|
cat > "$usr_file" << EOF
|
|
Target: $target
|
|
Finding: $finding
|
|
|
|
Rate this finding's severity:
|
|
EOF
|
|
|
|
local result=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
|
|
rm -f "$sys_file" "$usr_file"
|
|
echo "$result"
|
|
}
|
|
|
|
# Get exploitation guidance
|
|
get_exploit_advice() {
|
|
local target="$1"
|
|
local vector="$2"
|
|
local evidence="$3"
|
|
|
|
local sys_file=$(mktemp)
|
|
local usr_file=$(mktemp)
|
|
|
|
cat > "$sys_file" << 'SYS'
|
|
You are an expert penetration tester. Provide specific, actionable exploitation commands for authorized bug bounty testing. Include exact payloads, curl commands, or tool invocations.
|
|
SYS
|
|
|
|
cat > "$usr_file" << EOF
|
|
Target: $target
|
|
Vector: $vector
|
|
Evidence found: $evidence
|
|
|
|
Give me the exact commands/payloads to exploit this.
|
|
EOF
|
|
|
|
local result=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
|
|
rm -f "$sys_file" "$usr_file"
|
|
echo "$result"
|
|
}
|