#!/bin/bash
# Loop 目标 1/13: V-001 OPPO heytap.com
# 应用商店/账号生态 - 区别于 coloros.com 系统站
set -e
TARGET="heytap.com"
OUT_DIR="/e/hexstrike-ai/scripts/loop-2026-07-26"
LOG_DIR="/root/pentest_reports/oppo_V-001_heytap"
mkdir -p "$LOG_DIR"
mkdir -p "$OUT_DIR"

echo "===[1.1] DNS 解析 + HTTP headers ==="
echo "dig +short $TARGET:"
dig +short $TARGET | head -5
echo ""
echo "curl -sI https://$TARGET:"
curl -sI "https://$TARGET" --max-time 10 2>&1 | head -15

echo ""
echo "===[1.2] 端口扫描 (top 100) ==="
nmap -sS -Pn --top-ports 100 -T4 --open -oA "$LOG_DIR/nmap_$TARGET" "$TARGET" 2>&1 | grep -E "Nmap scan|open|Not shown" | head -10

echo ""
echo "===[1.3] robots.txt ==="
curl -sk "https://$TARGET/robots.txt" --max-time 8 2>&1 | head -20

echo ""
echo "===[1.4] 敏感路径探针 (HTTP 状态码) ==="
for p in robots.txt sitemap.xml .git/config .env .DS_Store \
         admin login api swagger.json api-docs openapi.json \
         .well-known/security.txt server-status phpinfo.php \
         actuator actuator/env actuator/health graphql; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/$p" --max-time 6)
    [ "$code" != "404" ] && echo "  [$code] /$p"
done

echo ""
echo "===[1.5] 安全响应头检查 ==="
curl -sI "https://$TARGET" --max-time 10 2>&1 | grep -iE "^server|^x-powered|^strict|^content-security|^x-frame|^referrer|^x-content|^permissions" | head -10
echo "缺失项 = 漏洞"

echo ""
echo "===[1.6] 首页 meta/JS 硬编码信息 ==="
curl -sL "https://$TARGET" --max-time 10 2>&1 | grep -ioE 'https?://[a-z0-9._/-]+\.(com|cn|net|io|org)[a-zA-Z0-9._/?=&-]*' | sort -u | head -20

echo ""
echo "===[1.7] 子域爆破 (api/admin/cdn/...) ==="
for sub in api cdn admin dev test staging static img upload download passport login sso m pay wallet; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "https://$sub.$TARGET/" 2>/dev/null)
    [ "$code" != "000" ] && [ "$code" != "404" ] && echo "  https://$sub.$TARGET/  HTTP $code"
done

echo ""
echo "===[1.8] 首页 title + 描述 ==="
curl -sL "https://$TARGET" --max-time 10 2>&1 | grep -oE '<title>[^<]*</title>|<meta[^>]*name="description"[^>]*>' | head -3

echo ""
echo "===[1.X] 完成, 日志路径: $LOG_DIR/ ==="