#!/bin/bash
# Project: Brabus Recon Suite (BRS)
# Company: EasyProTech LLC (www.easypro.tech)
# Dev: Brabus
# Date: 2025-08-11 00:09:08 MSK
# This file was modified
# Telegram: https://t.me/easyprotech

# Brabus Recon Suite (BRS) - Vulnerability Scanner Module
# Comprehensive vulnerability assessment and security testing
# company: EasyProTech LLC (www.easypro.tech)
# repository: https://github.com/EPTLLC/brs
# contact: mail.easypro.tech@gmail.com
# telegram: https://t.me/easyprotech
# author: brabus
# version: 2.0

# ⚠️ CRITICAL LEGAL WARNING ⚠️
# UNAUTHORIZED USE IS ILLEGAL AND MAY RESULT IN CRIMINAL PROSECUTION
# 
# This module performs vulnerability assessments that can expose
# sensitive security information. Use ONLY on systems you own or have 
# explicit written authorization to test.
#
# Unauthorized use may result in:
# • Criminal charges under computer crime laws (CFAA, etc.)
# • Substantial fines (potentially millions of dollars)
# • Prison time (multiple years depending on jurisdiction)
# • Permanent criminal record
# • Civil lawsuits for damages
#
# BY USING THIS MODULE, YOU ACKNOWLEDGE:
# • You own the target systems OR have explicit written authorization
# • You understand applicable laws in your jurisdiction
# • You accept FULL RESPONSIBILITY for your actions
# • You will indemnify EasyProTech LLC from any claims
#
# IF YOU CANNOT MAKE THESE DECLARATIONS, EXIT NOW (Ctrl+C)

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
CYAN='\033[0;36m'
NC='\033[0m'

# Configuration
DEFAULT_TIMEOUT=300  # 5 minutes default timeout
HOST_TIMEOUT=60     # Timeout per host

# Signal handling for graceful interruption
cleanup() {
    echo -e "\n${YELLOW}⚠️ Scan interrupted by user${NC}"
    pkill -P $$ 2>/dev/null
    exit 130
}
trap cleanup SIGINT SIGTERM

# Show spinner for long operations
show_spinner() {
    local pid=$1
    local message=$2
    local start_time=$(date +%s)
    local spin_chars="⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
    local i=0
    
    while kill -0 $pid 2>/dev/null; do
        local elapsed=$(($(date +%s) - start_time))
        local mins=$((elapsed / 60))
        local secs=$((elapsed % 60))
        printf "\r\033[K${CYAN}${spin_chars:$i:1} %s ${YELLOW}[%02d:%02d] ${RED}(Ctrl+C to cancel)${NC}" "$message" $mins $secs
        i=$(( (i+1) % ${#spin_chars} ))
        sleep 0.1
    done
    printf "\r\033[K"  # Clear line
}

# Language support
# Get script directory
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BASE_DIR="$(dirname "$SCRIPT_DIR")"
LANGUAGES_DIR="$BASE_DIR/languages"
CONFIG_DIR="$BASE_DIR/configs"
LANGUAGE_CONFIG="$CONFIG_DIR/language.conf"

# Load language configuration
if [ -f "$LANGUAGE_CONFIG" ]; then
    source "$LANGUAGE_CONFIG"
else
    CURRENT_LANGUAGE="en"
fi

# Load language file
if [ -f "$LANGUAGES_DIR/$CURRENT_LANGUAGE.sh" ]; then
    source "$LANGUAGES_DIR/$CURRENT_LANGUAGE.sh"
else
    source "$LANGUAGES_DIR/en.sh"
fi

RESULTS_DIR="$BASE_DIR/results"
SCRIPTS_DIR="$BASE_DIR/scripts"
WORDLISTS_DIR="$BASE_DIR/wordlists"
mkdir -p "$RESULTS_DIR" "$WORDLISTS_DIR"

show_menu() {
    echo -e "${PURPLE}$VULN_SCANNER_TITLE${NC}"
    echo "========================="
    echo "1) $VULN_NSE_SCRIPTS"
    echo "2) $VULN_NIKTO_WEB"
    echo "3) $VULN_SQLMAP"
    echo "4) $VULN_SMB_SCAN"
    echo "5) $VULN_SSH_WEAK"
    echo "6) $VULN_FTP_WEAK"
    echo "7) $VULN_TELNET_WEAK"
    echo "8) $VULN_OPEN_SHARES"
    echo "9) $VULN_SSL_TLS"
    echo "10) $VULN_COMPREHENSIVE"
    echo "11) $VULN_AUTO_SCAN_ALL"
    echo "0) $SETTINGS_BACK"
    echo -n "$MENU_CHOOSE_OPTION: "
}

get_target() {
    echo -n "$VULN_TARGET_PROMPT "
    read TARGET
    if [ -z "$TARGET" ]; then
        echo -e "${RED}$ATTACK_TARGET_NOT_SPECIFIED${NC}"
        return 1
    fi
    return 0
}

get_url() {
    echo -n "$VULN_URL_PROMPT "
    read URL
    if [ -z "$URL" ]; then
        echo -e "${RED}$ATTACK_URL_NOT_SPECIFIED${NC}"
        return 1
    fi
    return 0
}

nmap_vuln_scan() {
    get_target || return 1
    
    # Check basic connectivity first
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/80" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/443" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/22" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/21" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/23" 2>/dev/null; then
        echo -e "${RED}❌ Target seems unreachable or all common ports closed${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_REASONS${NC}"
        echo "   $CONNECTIVITY_PORT_CLOSED"
        echo "   $CONNECTIVITY_IP_BANNED"
        echo "   $CONNECTIVITY_FIREWALL"
        echo "   $CONNECTIVITY_SERVER_DOWN"
        echo -e "${CYAN}Continue anyway? (y/N):${NC}"
        read -r confirm
        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
            return 1
        fi
    else
        echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    fi
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_nmap_vuln_${TARGET//\//_}.txt"
    
    echo -e "${CYAN}$TIMEOUT_SCANNING_WITH 300s${NC}"
    
    # Comprehensive vulnerability scanning with NSE scripts with timeout
    timeout 300 nmap --script vuln -sV --host-timeout 30s -T4 "$TARGET" > "$OUTPUT_FILE" 2>&1 &
    scan_pid=$!
    
    show_spinner $scan_pid "NSE vulnerability scanning $TARGET"
    
    wait $scan_pid
    local exit_code=$?
    
    if [ $exit_code -eq 124 ]; then
        echo -e "${YELLOW}$TIMEOUT_TIMED_OUT_AFTER 300s${NC}"
        echo "$TIMEOUT_SCAN_TIMED_OUT" >> "$OUTPUT_FILE"
    elif [ $exit_code -ne 0 ]; then
        echo -e "${RED}$TIMEOUT_SCAN_FAILED${NC}"
    else
        echo -e "${GREEN}$TIMEOUT_SCAN_COMPLETED${NC}"
    fi
    
    cat "$OUTPUT_FILE"
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

nikto_scan() {
    get_url || return 1
    
    # Extract host and port from URL for connectivity check
    HTTP_HOST=$(echo "$URL" | sed -e 's|^[^/]*//||' -e 's|/.*$||' -e 's|:.*$||')
    HTTP_PORT=$(echo "$URL" | grep -o ':[0-9]*' | tr -d ':')
    if [[ "$URL" == https* ]]; then
        HTTP_PORT=${HTTP_PORT:-443}
    else
        HTTP_PORT=${HTTP_PORT:-80}
    fi
    
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$HTTP_HOST/$HTTP_PORT" 2>/dev/null; then
        echo -e "${RED}$CONNECTIVITY_HTTP_FAILED${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $HTTP_HOST:$HTTP_PORT${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_nikto_scan_${URL//\//_}.txt"
    
    
    # Require nikto to be installed by user/tools checker
    if ! command -v nikto &> /dev/null; then
        echo -e "${YELLOW}nikto is not installed. Please install via Settings → Check Tools or your package manager.${NC}"
        return 1
    fi
    
    nikto -h "$URL" | tee "$OUTPUT_FILE"
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

sqlmap_scan() {
    get_url || return 1
    
    # Extract host and port from URL for connectivity check
    HTTP_HOST=$(echo "$URL" | sed -e 's|^[^/]*//||' -e 's|/.*$||' -e 's|:.*$||')
    HTTP_PORT=$(echo "$URL" | grep -o ':[0-9]*' | tr -d ':')
    if [[ "$URL" == https* ]]; then
        HTTP_PORT=${HTTP_PORT:-443}
    else
        HTTP_PORT=${HTTP_PORT:-80}
    fi
    
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$HTTP_HOST/$HTTP_PORT" 2>/dev/null; then
        echo -e "${RED}$CONNECTIVITY_HTTP_FAILED${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $HTTP_HOST:$HTTP_PORT${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_sqlmap_scan_${URL//\//_}.txt"
    
    
    # Require sqlmap to be installed by user/tools checker
    if ! command -v sqlmap &> /dev/null; then
        echo -e "${YELLOW}sqlmap is not installed. Please install via Settings → Check Tools or your package manager.${NC}"
        return 1
    fi
    
    echo "Select SQLmap mode:"
    echo "1) Basic scan"
    echo "2) Deep scan with risk level 3"
    echo "3) Custom parameters"
    read -r mode
    
    case $mode in
        1)
            sqlmap -u "$URL" --batch | tee "$OUTPUT_FILE"
            ;;
        2)
            sqlmap -u "$URL" --batch --level=5 --risk=3 | tee "$OUTPUT_FILE"
            ;;
        3)
            echo -n "Enter custom SQLmap parameters: "
            read CUSTOM_PARAMS
            sqlmap -u "$URL" $CUSTOM_PARAMS | tee "$OUTPUT_FILE"
            ;;
    esac
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

smb_vuln_scan() {
    get_target || return 1
    
    # Check SMB port availability
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/445" 2>/dev/null; then
        echo -e "${RED}❌ SMB port (445) unavailable or IP banned. Scan impossible.${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $TARGET:445${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_smb_vuln_${TARGET//\//_}.txt"
    
    
    echo -e "${CYAN}$TIMEOUT_SCANNING_WITH ${DEFAULT_TIMEOUT}s${NC}"
    
    # SMB vulnerability scanning including EternalBlue, MS08-067, etc.
    {
        echo "=== SMB VULNERABILITY ASSESSMENT ==="
        echo "Target: $TARGET"
        echo "Timestamp: $(date)"
        echo ""
        
        echo "--- SMB Version Detection ---"
        timeout 60 nmap -p445 --script smb-protocols --host-timeout 20s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SMB Vulnerabilities ---"
        timeout 120 nmap -p445 --script smb-vuln* --host-timeout 30s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SMB Enumeration ---"
        timeout 90 nmap -p445 --script smb-enum* --host-timeout 25s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SMB OS Discovery ---"
        timeout 60 nmap -p445 --script smb-os-discovery --host-timeout 20s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        
    } > "$OUTPUT_FILE" 2>&1 &
    
    scan_pid=$!
    show_spinner $scan_pid "SMB vulnerability scanning $TARGET"
    wait $scan_pid
    
    cat "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

ssh_weak_passwords() {
    get_target || return 1
    
    # Check SSH port availability
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/22" 2>/dev/null; then
        echo -e "${RED}$CONNECTIVITY_SSH_FAILED${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $TARGET:22${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_ssh_weak_pass_${TARGET//\//_}.txt"
    
    
    # Create weak password list if not exists
    if [ ! -f "$WORDLISTS_DIR/weak_passwords.txt" ]; then
        cat > "$WORDLISTS_DIR/weak_passwords.txt" << EOL
admin
password
123456
root
guest
test
user
pass
login
welcome
EOL
    fi
    
    # Install hydra if not available
    if ! command -v hydra &> /dev/null; then
        sudo apt install -y hydra
    fi
    
    hydra -L "$WORDLISTS_DIR/common_users.txt" -P "$WORDLISTS_DIR/weak_passwords.txt" -t 4 -f "$TARGET" ssh | tee "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

ftp_weak_passwords() {
    get_target || return 1
    
    # Check FTP port availability
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/21" 2>/dev/null; then
        echo -e "${RED}$CONNECTIVITY_FTP_FAILED${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $TARGET:21${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_ftp_weak_pass_${TARGET//\//_}.txt"
    
    
    hydra -L "$WORDLISTS_DIR/common_users.txt" -P "$WORDLISTS_DIR/weak_passwords.txt" -t 6 -f "$TARGET" ftp | tee "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

telnet_weak_passwords() {
    get_target || return 1
    
    # Check Telnet port availability
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/23" 2>/dev/null; then
        echo -e "${RED}$CONNECTIVITY_TELNET_FAILED${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $TARGET:23${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_telnet_weak_pass_${TARGET//\//_}.txt"
    
    
    hydra -L "$WORDLISTS_DIR/common_users.txt" -P "$WORDLISTS_DIR/weak_passwords.txt" -t 4 -f "$TARGET" telnet | tee "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

open_shares_scan() {
    get_target || return 1
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_open_shares_${TARGET//\//_}.txt"
    
    
    echo -e "${CYAN}$TIMEOUT_SCANNING_WITH ${DEFAULT_TIMEOUT}s${NC}"
    
    {
        echo "=== OPEN SHARES ENUMERATION ==="
        echo "Target: $TARGET"
        echo "Timestamp: $(date)"
        echo ""
        
        echo "--- SMB Shares ---"
        timeout 60 nmap -p445 --script smb-enum-shares --host-timeout 20s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- NFS Shares ---"
        timeout 60 nmap -p111 --script nfs-ls,nfs-showmount --host-timeout 20s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- Anonymous FTP ---"
        timeout 30 nmap -p21 --script ftp-anon --host-timeout 15s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        # Try smbclient if available
        if command -v smbclient &> /dev/null; then
            echo "--- SMB Client Enumeration ---"
            timeout 30 smbclient -L "$TARGET" -N 2>/dev/null || echo "SMB enumeration failed"
        fi
        
    } > "$OUTPUT_FILE" 2>&1 &
    
    scan_pid=$!
    show_spinner $scan_pid "Open shares scanning $TARGET"
    wait $scan_pid
    
    cat "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

ssl_tls_scan() {
    get_target || return 1
    
    # Check HTTPS port availability
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/443" 2>/dev/null; then
        echo -e "${RED}❌ HTTPS port (443) unavailable or IP banned. SSL scan impossible.${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_CHECK_AVAILABILITY $TARGET:443${NC}"
        return 1
    fi
    echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_ssl_tls_${TARGET//\//_}.txt"
    
    
    echo -e "${CYAN}$TIMEOUT_SCANNING_WITH ${DEFAULT_TIMEOUT}s${NC}"
    
    {
        echo "=== SSL/TLS VULNERABILITY ASSESSMENT ==="
        echo "Target: $TARGET"
        echo "Timestamp: $(date)"
        echo ""
        
        echo "--- SSL/TLS Cipher Suites ---"
        timeout 120 nmap --script ssl-enum-ciphers --host-timeout 30s -p443 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SSL/TLS Vulnerabilities ---"
        timeout 180 nmap --script ssl-cert,ssl-date,ssl-heartbleed,ssl-poodle,ssl-ccs-injection --host-timeout 30s -p443 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SSL Certificate Information ---"
        timeout 60 nmap --script ssl-cert --host-timeout 20s -p443 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        
    } > "$OUTPUT_FILE" 2>&1 &
    
    scan_pid=$!
    show_spinner $scan_pid "SSL/TLS vulnerability scanning $TARGET"
    wait $scan_pid
    
    cat "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
}

comprehensive_scan() {
    get_target || return 1
    
    # Check basic connectivity first
    if ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/80" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/443" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/22" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/21" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/23" 2>/dev/null && \
       ! timeout 3 bash -c "cat < /dev/null > /dev/tcp/$TARGET/445" 2>/dev/null; then
        echo -e "${RED}❌ Target seems unreachable or all common ports closed${NC}"
        echo -e "${YELLOW}$CONNECTIVITY_REASONS${NC}"
        echo "   $CONNECTIVITY_PORT_CLOSED"
        echo "   $CONNECTIVITY_IP_BANNED"
        echo "   $CONNECTIVITY_FIREWALL"
        echo "   $CONNECTIVITY_SERVER_DOWN"
        echo -e "${CYAN}Continue anyway? (y/N):${NC}"
        read -r confirm
        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
            return 1
        fi
    else
        echo -e "${GREEN}$CONNECTIVITY_SUCCESS${NC}"
    fi
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_comprehensive_vuln_${TARGET//\//_}.txt"
    
    
    echo -e "${CYAN}$TIMEOUT_SCANNING_WITH ${DEFAULT_TIMEOUT}s${NC}"
    
    {
        echo "=== COMPREHENSIVE VULNERABILITY ASSESSMENT ==="
        echo "Target: $TARGET"
        echo "Timestamp: $(date)"
        echo ""
        
        echo "--- Port Scan ---"
        timeout 180 nmap -sS -sV --host-timeout 30s -T4 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- Vulnerability Scripts ---"
        timeout 300 nmap --script vuln -sV --host-timeout 30s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- SMB Vulnerabilities ---"
        timeout 120 nmap -p445 --script smb-vuln* --host-timeout 25s "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- Web Vulnerabilities (if HTTP detected) ---"
        if timeout 60 nmap -p80,443,8080,8443 --host-timeout 15s "$TARGET" 2>/dev/null | grep -q "open"; then
            timeout 240 nmap --script http-vuln* --host-timeout 30s -p80,443,8080,8443 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        fi
        echo ""
        
        echo "--- SSL/TLS Check ---"
        timeout 120 nmap --script ssl-enum-ciphers,ssl-heartbleed,ssl-poodle --host-timeout 25s -p443 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        echo ""
        
        echo "--- DNS Enumeration ---"
        timeout 90 nmap --script dns-brute,dns-zone-transfer --host-timeout 20s -p53 "$TARGET" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
        
    } > "$OUTPUT_FILE" 2>&1 &
    
    scan_pid=$!
    show_spinner $scan_pid "Comprehensive vulnerability scanning $TARGET"
    wait $scan_pid
    
    cat "$OUTPUT_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
    
    # Generate summary
    echo -e "\n${YELLOW}Vulnerability Summary:${NC}"
    echo "Open ports: $(grep -c "open" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
    echo "Potential vulnerabilities: $(grep -c -i "vulnerable\|vuln\|exploit" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
    echo "SSL/TLS issues: $(grep -c -i "ssl\|tls\|cipher" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
}

auto_scan_all() {
    
    # Find latest hosts file
    LATEST_HOSTS_FILE=$(ls -t "$RESULTS_DIR"/*_live_hosts.txt 2>/dev/null | head -1)
    
    if [ -z "$LATEST_HOSTS_FILE" ] || [ ! -f "$LATEST_HOSTS_FILE" ]; then
        echo -e "${RED}$PORT_NO_HOSTS_FILE${NC}"
        return 1
    fi
    
    echo -e "${GREEN}Using hosts file: $LATEST_HOSTS_FILE${NC}"
    
    TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
    OUTPUT_FILE="$RESULTS_DIR/${TIMESTAMP}_auto_vuln_scan.txt"
    
    {
        echo "=== AUTOMATED VULNERABILITY SCAN REPORT ==="
        echo "Timestamp: $(date)"
        echo "Hosts file: $LATEST_HOSTS_FILE"
        echo "Total hosts: $(wc -l < "$LATEST_HOSTS_FILE")"
        echo ""
    } > "$OUTPUT_FILE"
    
    while read -r host; do
        if [ ! -z "$host" ]; then
            {
                echo "=== VULNERABILITY SCAN: $host ==="
                echo "Timestamp: $(date)"
                echo ""
                
                echo "--- Basic Vulnerability Scan ---"
                timeout 180 nmap --script vuln -sV --host-timeout 25s -T4 "$host" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
                echo ""
                
                echo "--- SMB Vulnerabilities ---"
                timeout 90 nmap -p445 --script smb-vuln* --host-timeout 20s "$host" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
                echo ""
                
                echo "--- Web Vulnerabilities ---"
                timeout 120 nmap --script http-vuln* --host-timeout 25s -p80,443,8080,8443 "$host" 2>/dev/null || echo "$TIMEOUT_SCAN_TIMED_OUT"
                echo ""
                
            } >> "$OUTPUT_FILE"
        fi
    done < "$LATEST_HOSTS_FILE"
    
    echo -e "${GREEN}$ATTACK_RESULTS_SAVED $OUTPUT_FILE${NC}"
    
    # Generate summary
    echo -e "\n${YELLOW}Auto-scan Summary:${NC}"
    echo "Hosts scanned: $(wc -l < "$LATEST_HOSTS_FILE")"
    echo "Total vulnerabilities found: $(grep -c -i "vulnerable\|vuln\|exploit" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
    echo "SMB vulnerabilities: $(grep -c -i "smb.*vuln" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
    echo "Web vulnerabilities: $(grep -c -i "http.*vuln" "$OUTPUT_FILE" 2>/dev/null || echo "0")"
}

# Ensure wordlists exist
if [ ! -f "$WORDLISTS_DIR/common_users.txt" ]; then
    mkdir -p "$WORDLISTS_DIR"
    cat > "$WORDLISTS_DIR/common_users.txt" << EOL
admin
administrator
root
user
guest
test
operator
service
daemon
www
ftp
mail
nobody
EOL
fi

# Main loop
while true; do
    show_menu
    read choice
    
    case $choice in
        1) nmap_vuln_scan ;;
        2) nikto_scan ;;
        3) sqlmap_scan ;;
        4) smb_vuln_scan ;;
        5) ssh_weak_passwords ;;
        6) ftp_weak_passwords ;;
        7) telnet_weak_passwords ;;
        8) open_shares_scan ;;
        9) ssl_tls_scan ;;
        10) comprehensive_scan ;;
        11) auto_scan_all ;;
        0) echo -e "${GREEN}$ATTACK_GOODBYE${NC}"; break ;;
        *) echo -e "${RED}$ATTACK_INVALID_CHOICE${NC}" ;;
    esac
    

done
