#!/bin/bash
# Stage 3: 目录/敏感文件爆破 + JS chunk 分析
set -e
OUT="/root/pentest_reports/oppo_V-001"
mkdir -p "$OUT"
TARGET="https://www.coloros.com"

echo "===[3.1] 敏感文件探针 (17 个常见泄露路径) ==="
for f in robots.txt sitemap.xml .git/config .env .DS_Store \
         admin admin.php login login.html api api.php \
         swagger.json api-docs openapi.json .well-known/security.txt \
         server-status phpinfo.php info.php; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" "$TARGET/$f" --max-time 10)
    size=$(curl -sk -o /dev/null -w "%{size_download}" "$TARGET/$f" --max-time 10)
    if [ "$code" != "404" ]; then
        echo "  [$code  ${size}B] $TARGET/$f"
    fi
done

echo ""
echo "===[3.2] 目录爆破 (ffuf common.txt, 200/301/302) ==="
ffuf -u "$TARGET/FUZZ" -w /usr/share/wordlists/dirb/common.txt -fc 404 -ac -mc 200,301,302 -s -o "$OUT/ffuf_coloros.json" --max-time 120 2>&1 | tail -20

echo ""
echo "===[3.3] 目录爆破 (带扩展名 .php .json .bak .xml) ==="
ffuf -u "$TARGET/FUZZ" -w /usr/share/wordlists/dirb/common.txt -e .php,.json,.bak,.xml -fc 404 -ac -mc 200,301,302 -s --max-time 120 2>&1 | tail -20

echo ""
echo "===[3.4] JS chunk 抓取 (前 3 个，看有没有 API 泄露) ==="
curl -s "$TARGET" --max-time 10 | grep -oE '/_nuxt/[a-f0-9]+\.js' | sort -u | head -3 | while read j; do
    echo "--- $j ---"
    curl -s "$TARGET$j" --max-time 10 | grep -oE 'https?://[a-zA-Z0-9._/-]+\.(com|cn|net|io|org)[a-zA-Z0-9._/?=&-]*' | sort -u | head -20
done

echo ""
echo "===[3.5] robots.txt 完整内容 ==="
curl -sk "$TARGET/robots.txt" --max-time 10 2>&1 | head -30

echo ""
echo "===[3.6] 安全头检查 (HSTS / CSP / X-Frame-Options / Referrer-Policy) ==="
curl -sI "$TARGET" --max-time 10 2>&1 | grep -iE "strict-transport|content-security|x-frame|referrer|x-content-type|x-xss|permissions-policy"

echo ""
echo "===[3.7] Server / X-Powered-By 泄露 ==="
curl -sI "$TARGET" --max-time 10 2>&1 | grep -iE "^server|^x-powered|^via"

echo ""
echo "===[3.8] API 子域爆破 (api.* admin.* cdn.* 常见) ==="
for sub in api cdn admin dev test staging beta static img upload download; do
    code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 8 "https://$sub.coloros.com/" 2>/dev/null)
    [ "$code" != "000" ] && echo "  https://$sub.coloros.com/  HTTP $code"
done

echo ""
echo "===[3.9] favicon + sitemap 探测 ==="
curl -sk -o /dev/null -w "  /favicon.ico  HTTP:%{http_code}  SIZE:%{size_download}B\n" "$TARGET/favicon.ico" --max-time 5
curl -sk -o /dev/null -w "  /sitemap.xml  HTTP:%{http_code}  SIZE:%{size_download}B\n" "$TARGET/sitemap.xml" --max-time 5