#!/bin/bash
# Loop 目标 1/13: V-001 OPPO heytap.com (DNS 用 8.8.8.8 规避 VMware 网关 DNS 故障)
set -e
TARGET="heytap.com"
LOG="/e/hexstrike-ai/data/loop_target_01_heytap.log"
DNS="@8.8.8.8"
mkdir -p /e/hexstrike-ai/data /root/pentest_reports/oppo_V-001_heytap
exec > >(tee "$LOG") 2>&1

echo "===[1.1] DNS + HTTP headers ==="
dig +short $DNS $TARGET
echo "---"
curl -sI "https://$TARGET" --max-time 10 2>&1 | head -15
echo ""
curl -sI "https://www.$TARGET" --max-time 10 2>&1 | head -15

echo ""
echo "===[1.2] 端口扫描 ==="
nmap -sS -Pn --top-ports 100 -T4 --open --dns-servers 8.8.8.8 -oN /root/pentest_reports/oppo_V-001_heytap/nmap.txt $TARGET 2>&1 | grep -E "open|Not shown"

echo ""
echo "===[1.3] robots.txt ==="
curl -sk "https://www.$TARGET/robots.txt" --max-time 8 2>&1 | head -20

echo ""
echo "===[1.4] 敏感路径探针 ==="
for p in robots.txt sitemap.xml .git/config .env .DS_Store \
         admin login api swagger.json api-docs openapi.json \
         .well-known/security.txt server-status phpinfo.php \
         actuator actuator/env actuator/health graphql; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" "https://www.$TARGET/$p" --max-time 6)
    echo "  [$code] /$p"
done

echo ""
echo "===[1.5] 安全头检查 ==="
curl -sI "https://www.$TARGET" --max-time 10 2>&1 | head -20

echo ""
echo "===[1.6] 首页外链/子域 ==="
curl -sL "https://www.$TARGET" --max-time 10 2>&1 | grep -ioE 'https?://[a-z0-9._/-]+\.(com|cn|net|io)[a-zA-Z0-9._/?=&-]*' | sort -u | head -30

echo ""
echo "===[1.7] 子域爆破 ==="
for sub in api cdn admin dev test static img passport login sso m pay brand store; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "https://$sub.$TARGET/" 2>/dev/null)
    echo "  https://$sub.$TARGET/  HTTP $code"
done

echo ""
echo "===[1.8] 首页 title + description ==="
curl -sL "https://www.$TARGET" --max-time 10 2>&1 | grep -oE '<title>[^<]*</title>|name="description"[^>]*content="[^"]*"' | head -3

echo ""
echo "===[完成] log: $LOG ==="