#!/bin/bash
# V-001 OPPO 侦察 dry-run
# 目标候选：id-sso.xiniaoyun.com (SSO 认证系统) + coloros.com (主站)

set -e
TARGET_SSO="id-sso.xiniaoyun.com"
TARGET_WEB="coloros.com"
OUT="/root/pentest_reports/oppo_V-001_$(date +%Y%m%d_%H%M)"
mkdir -p "$OUT"

echo "===[1] DNS 解析 + HTTPS 证书检查==="
echo "命令: dig +short $TARGET_SSO"
echo "命令: dig +short $TARGET_WEB"
echo "命令: curl -sIv https://$TARGET_SSO -o /dev/null 2>&1 | head -20"
echo "命令: curl -sIv https://$TARGET_WEB -o /dev/null 2>&1 | head -20"

echo ""
echo "===[2] Nmap 端口扫描 (top 1000, 5 秒)==="
echo "命令: nmap -sS -Pn --top-ports 1000 -T4 --open -oA $OUT/nmap_top1k $TARGET_SSO"
echo "命令: nmap -sS -Pn --top-ports 1000 -T4 --open -oA $OUT/nmap_top1k_web $TARGET_WEB"

echo ""
echo "===[3] Nmap 版本探测 (80/443 重点)==="
echo "命令: nmap -sV -sC -O -p 80,443,8080,8443 -oA $OUT/nmap_ver $TARGET_SSO"
echo "命令: nmap -sV -sC -O -p 80,443,8080,8443 -oA $OUT/nmap_ver_web $TARGET_WEB"

echo ""
echo "===[4] Web 技术栈识别 (whatweb)==="
echo "命令: whatweb -v https://$TARGET_SSO | tee $OUT/whatweb_sso.txt"
echo "命令: whatweb -v https://$TARGET_WEB | tee $OUT/whatweb_web.txt"

echo ""
echo "===[5] 目录/文件爆破 (ffuf)==="
echo "命令: ffuf -u https://$TARGET_SSO/FUZZ -w /usr/share/wordlists/dirb/common.txt -fc 403,404 -ac -mc 200,301,302 -o $OUT/ffuf_sso.json"
echo "命令: ffuf -u https://$TARGET_WEB/FUZZ -w /usr/share/wordlists/dirb/common.txt -fc 403,404 -ac -mc 200,301,302 -o $OUT/ffuf_web.json"
echo "（带扩展名）命令: ffuf -u https://$TARGET_WEB/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.txt,.bak -fc 403,404 -ac -mc 200,301,302 -o $OUT/ffuf_web_ext.json"

echo ""
echo "===[6] 敏感文件探针 (常见泄露)==="
for f in robots.txt sitemap.xml .git/config .env .DS_Store \
         admin admin.php login.php login.html api api.php \
         swagger.json api-docs openapi.json .well-known/security.txt \
         server-status phpinfo.php info.php; do
    echo "  curl -sI https://$TARGET_WEB/$f | head -1"
done

echo ""
echo "===[7] 全套运行时间预估==="
echo "  DNS: 5s"
echo "  Nmap top1k: 60s × 2 = 2 min"
echo "  Nmap 版本: 30s × 2 = 1 min"
echo "  Whatweb: 10s × 2 = 20s"
echo "  ffuf: 60s × 3 = 3 min"
echo "  敏感文件: 30s"
echo "  合计: ~7 min"

echo ""
echo "输出目录: $OUT"
echo "完成后我会自动跑报告生成器"