#!/bin/bash
# 通用 Loop 模板 v2 - 直接写文件, 不依赖 tee
set +e
TARGET="${1:?用法: $0 domain.com}"
TASK_ID="${2:-V-001}"
# 域名转文件名 (com.cn → com_cn, 避免路径混淆)
SAFE=$(echo "$TARGET" | tr '.' '_')
LOG="/e/hexstrike-ai/data/loop_target_${SAFE}.log"
> "$LOG"

# 写日志的辅助函数 - 用 here-doc 追加
log() {
    echo "$@" >> "$LOG"
}

log "=== Loop target: $TARGET (task_id=$TASK_ID) ==="
log "开始时间: $(date -Iseconds)"

log ""
log "===[1.1] DNS + HTTP headers ==="
log "$(dig +short $TARGET 2>&1 | head -5)"
log "--- $TARGET ---"
log "$(curl -sI "https://$TARGET" --max-time 10 2>&1 | head -10)"
log "--- www.$TARGET ---"
log "$(curl -sI "https://www.$TARGET" --max-time 10 2>&1 | head -10)"

log ""
log "===[1.2] 端口扫描 (top 100) ==="
mkdir -p "/root/pentest_reports/${TASK_ID}_${SAFE}"
log "$(nmap -sS -Pn --top-ports 100 -T4 --open -oN "/root/pentest_reports/${TASK_ID}_${SAFE}/nmap.txt" $TARGET 2>&1 | grep -E 'open|Not shown' | head -10)"

log ""
log "===[1.3] robots.txt ==="
log "$(curl -sk "https://www.$TARGET/robots.txt" --max-time 8 2>&1 | head -20)"

log ""
log "===[1.4] 敏感路径探针 ==="
for p in robots.txt sitemap.xml .git/config .env .DS_Store \
         admin login api swagger.json api-docs openapi.json \
         .well-known/security.txt server-status phpinfo.php \
         actuator actuator/env actuator/health graphql \
         api/v1 api/v2 v1 v2; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" "https://www.$TARGET/$p" --max-time 6 2>/dev/null)
    log "  [$code] /$p"
done

log ""
log "===[1.5] 安全头检查 ==="
log "$(curl -sI "https://www.$TARGET" --max-time 10 2>&1 | head -20)"

log ""
log "===[1.6] 首页外链/子域 ==="
log "$(curl -sL "https://www.$TARGET" --max-time 10 2>&1 | grep -ioE 'https?://[a-z0-9._/-]+\.(com|cn|net|io)[a-zA-Z0-9._/?=&-]*' | sort -u | head -30)"

log ""
log "===[1.7] 子域爆破 ==="
for sub in api cdn admin dev test static img passport login sso m pay brand store; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "https://$sub.$TARGET/" 2>/dev/null)
    [ "$code" != "000" ] && log "  https://$sub.$TARGET/  HTTP $code"
done

log ""
log "===[1.8] 首页 title + description ==="
log "$(curl -sL "https://www.$TARGET" --max-time 10 2>&1 | grep -oE '<title>[^<]*</title>|name=.description.[^>]*content=.[^.]*.')"

log ""
log "===[完成] ==="
log "结束时间: $(date -Iseconds)"
log "总行数: $(wc -l < "$LOG")"
log "log path: $LOG"