#!/bin/bash
# Stage 2: 端口扫描 + 服务版本探测
# 目标: coloros.com + yeahzee.com SSO 子域
set -e
OUT="/root/pentest_reports/oppo_V-001"
mkdir -p "$OUT"

echo "===[2.1] coloros.com 端口扫描 (top 1000) ==="
nmap -sS -Pn --top-ports 1000 -T4 --open -oA "$OUT/nmap_coloros_top1k" www.coloros.com 2>&1 | grep -E "Nmap scan|open|closed|Not shown" | head -30

echo ""
echo "===[2.2] sso-sa.yeahzee.com DNS + 端口 ==="
dig +short sso-sa.yeahzee.com
echo "---"
nmap -sS -Pn --top-ports 1000 -T4 --open -oA "$OUT/nmap_sso-sa" sso-sa.yeahzee.com 2>&1 | grep -E "Nmap scan|open|closed|Not shown" | head -10

echo ""
echo "===[2.3] sso-me.yeahzee.com DNS + 端口 ==="
dig +short sso-me.yeahzee.com
echo "---"
nmap -sS -Pn --top-ports 1000 -T4 --open -oA "$OUT/nmap_sso-me" sso-me.yeahzee.com 2>&1 | grep -E "Nmap scan|open|closed|Not shown" | head -10

echo ""
echo "===[2.4] id-sso.xiniaoyun.com 重试 (加 -Pn -n 不解析) ==="
nmap -sS -Pn -n -p 80,443 --open -oA "$OUT/nmap_id-sso" id-sso.xiniaoyun.com 2>&1 | grep -E "Nmap scan|open|closed" | head -10

echo ""
echo "===[2.5] subdomain 暴力枚举 (crt.sh) ==="
# crt.sh 免费证书透明度查询
curl -s "https://crt.sh/?q=%25.coloros.com&output=json" --max-time 30 2>&1 | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    subs = sorted(set(d.get('name_value','') for d in data))
    for s in subs[:30]: print(s)
except Exception as e:
    print(f'parse err: {e}', file=sys.stderr)
" 2>&1 | head -40