main.go

package main

import (
	"bufio"
	"context"
	"flag"
	"fmt"
	"os"
	"os/signal"
	"strings"
	"sync"
	"syscall"
	"time"

	. "scriptlens/libs"
)

func main() {
	banner := `
  ___         _      _   _                
 / __| __ _ _(_)_ __| |_| |   ___ _ _  ___
 \__ \/ _| '_| | '_ \  _| |__/ -_) ' \(_-<
 |___/\__|_| |_| .__/\__|____\___|_||_/__/
               |_|          @ARMx64
`
	fmt.Println(banner)              
	urlFlag := flag.String("url", "", "Single target URL to scan")
	listFlag := flag.String("list", "", "File containing list of URLs to scan")
	depthFlag := flag.Int("depth", 3, "Maximum crawl depth")
	workersFlag := flag.Int("workers", 10, "Number of concurrent workers")
	outputFlag := flag.String("output", "scriptlens-report.json", "Output file for JSON report")
	timeoutFlag := flag.Int("timeout", 30, "HTTP request timeout in seconds")
	noVulnCheck := flag.Bool("no-vuln-check", false, "Skip vulnerability checking")
	silentFlag := flag.Bool("silent", false, "Suppress TUI output")
	jsOnly := flag.Bool("js-only", false, "Only collect JavaScript files and extract secrets")
	formsOnly := flag.Bool("forms-only", false, "Only find forms by crawling webpages")
	paramsOnly := flag.Bool("params-only", false, "Only collect parameters and construct full URLs")
	subdomainsEnum := flag.Bool("subdomains-enum", false, "Only enumerate subdomains from JS and webpages")
	urlCollection := flag.Bool("url-collection", false, "Only collect URLs from same domain and subdomains")
	limitFlag := flag.Int("limit", 0, "Maximum number of URLs to collect (0 = unlimited)")

	flag.Usage = func() {
		fmt.Fprintf(os.Stderr, "Usage:\n")
		fmt.Fprintf(os.Stderr, "  scriptlens -url <target-url> [options]\n")
		fmt.Fprintf(os.Stderr, "  scriptlens -list <urls-file> [options]\n\n")
		fmt.Fprintf(os.Stderr, "Options:\n")
		flag.PrintDefaults()
		fmt.Fprintf(os.Stderr, "\nExamples:\n")
		fmt.Fprintf(os.Stderr, "  scriptlens -url https://example.com -depth 2 -output report.json\n")
		fmt.Fprintf(os.Stderr, "  scriptlens -list targets.txt -workers 20 -depth 3\n")
	}

	flag.Parse()

	if *urlFlag == "" && *listFlag == "" {
		fmt.Fprintf(os.Stderr, "Error: Either -url or -list must be specified\n\n")
		flag.Usage()
		os.Exit(1)
	}

	targets := make([]string, 0)

	if *urlFlag != "" {
		targets = append(targets, *urlFlag)
	}

	if *listFlag != "" {
		urls, err := readURLsFromFile(*listFlag)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Error reading URL list: %v\n", err)
			os.Exit(1)
		}
		targets = append(targets, urls...)
	}

	if len(targets) == 0 {
		fmt.Fprintf(os.Stderr, "Error: No valid URLs to scan\n")
		os.Exit(1)
	}

	fmt.Printf("Starting ScriptLens scan on %d target(s)...\n\n", len(targets))

	var wg sync.WaitGroup
	type scanTask struct {
		target     string
		index      int
		outputFile string
	}

	tasks := make([]scanTask, len(targets))
	for i, target := range targets {
		outputFile := *outputFlag
		if len(targets) > 1 {
			outputFile = fmt.Sprintf("scriptlens-report-%d.json", i+1)
		}
		tasks[i] = scanTask{target: target, index: i + 1, outputFile: outputFile}
	}

	semaphore := make(chan struct{}, 3)

	for _, task := range tasks {
		wg.Add(1)
		go func(t scanTask) {
			defer wg.Done()
			semaphore <- struct{}{}
			defer func() { <-semaphore }()

			if len(targets) > 1 {
				fmt.Printf("\n[%d/%d] Scanning: %s\n", t.index, len(targets), t.target)
			}

			scanMode := determineScanMode(*jsOnly, *formsOnly, *paramsOnly, *subdomainsEnum, *urlCollection)
			err := scanTarget(t.target, *depthFlag, *workersFlag, t.outputFile,
				time.Duration(*timeoutFlag)*time.Second, *noVulnCheck, *silentFlag, scanMode, *limitFlag)

			if err != nil {
				fmt.Fprintf(os.Stderr, "Error scanning %s: %v\n", t.target, err)
			}
		}(task)
	}

	wg.Wait()
	fmt.Println("\nAll scans completed!")
}

type ScanMode int

const (
	ScanModeAll ScanMode = iota
	ScanModeJSOnly
	ScanModeFormsOnly
	ScanModeParamsOnly
	ScanModeSubdomainsEnum
	ScanModeURLCollection
)

func determineScanMode(jsOnly, formsOnly, paramsOnly, subdomainsEnum, urlCollection bool) ScanMode {
	if jsOnly {
		return ScanModeJSOnly
	}
	if formsOnly {
		return ScanModeFormsOnly
	}
	if paramsOnly {
		return ScanModeParamsOnly
	}
	if subdomainsEnum {
		return ScanModeSubdomainsEnum
	}
	if urlCollection {
		return ScanModeURLCollection
	}
	return ScanModeAll
}

func scanTarget(targetURL string, maxDepth, maxWorkers int, outputFile string, 
	timeout time.Duration, noVulnCheck bool, silent bool, scanMode ScanMode, limit int) error {
	
	startTime := time.Now()

	baseDomain, err := ExtractDomain(targetURL)
	if err != nil {
		return fmt.Errorf("invalid URL: %w", err)
	}

	state := NewCrawlState(targetURL, baseDomain, maxDepth)
	state.Limit = limit
	tui := NewTUI()
	crawler := NewCrawler(state, maxWorkers, timeout, tui, int(scanMode))
	
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	sigChan := make(chan os.Signal, 1)
	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
	defer signal.Stop(sigChan)

	if !silent {
		tui.UpdatePhase("INITIALIZATION")
		tui.Log("INFO", fmt.Sprintf("Target: %s", targetURL))
		tui.Log("INFO", fmt.Sprintf("Max Depth: %d", maxDepth))
		tui.Log("INFO", fmt.Sprintf("Workers: %d", maxWorkers))
		modeName := "Full Scan"
		switch scanMode {
		case ScanModeJSOnly:
			modeName = "JavaScript Only"
		case ScanModeFormsOnly:
			modeName = "Forms Only"
		case ScanModeParamsOnly:
			modeName = "Parameters Only"
		case ScanModeSubdomainsEnum:
			modeName = "Subdomains Enumeration"
		case ScanModeURLCollection:
			modeName = "URL Collection"
		}
		tui.Log("INFO", fmt.Sprintf("Scan Mode: %s", modeName))
		if limit > 0 {
			tui.Log("INFO", fmt.Sprintf("URL Limit: %d", limit))
		}
	}

	go func() {
		<-sigChan
		if !silent {
			tui.LogWarning("\nReceived interrupt signal. Shutting down gracefully...")
		}
		cancel()
		time.Sleep(500 * time.Millisecond)
		os.Exit(130)
	}()

	if !silent {
		tui.UpdatePhase("WEB CRAWLING")
	}

	if scanMode == ScanModeJSOnly {
		if !silent {
			tui.Log("INFO", "Crawling to discover JavaScript files...")
		}
	}

	crawlErr := crawler.Crawl(ctx, targetURL)
	if crawlErr != nil && crawlErr != context.Canceled {
		return crawlErr
	}

	select {
	case <-ctx.Done():
		return context.Canceled
	default:
	}

	if scanMode == ScanModeAll || scanMode == ScanModeJSOnly || scanMode == ScanModeParamsOnly || scanMode == ScanModeSubdomainsEnum {
		if !silent {
			tui.UpdatePhase("JAVASCRIPT ANALYSIS")
			tui.Log("INFO", fmt.Sprintf("Analyzing %d JavaScript files...", len(state.JSFiles)))
		}

		jsAnalyzer := NewJSAnalyzer(crawler.Client, state)
		jsAnalyses := jsAnalyzer.AnalyzeJSFiles(ctx)
	
		if !silent {
			for _, analysis := range jsAnalyses {
				if (scanMode == ScanModeAll || scanMode == ScanModeParamsOnly) && len(analysis.Endpoints) > 0 {
					tui.Log("FOUND", fmt.Sprintf("Extracted %d endpoints from %s", len(analysis.Endpoints), analysis.URL))
				}
				if (scanMode == ScanModeAll || scanMode == ScanModeJSOnly) && len(analysis.SensitiveData) > 0 {
					for _, data := range analysis.SensitiveData {
						tui.LogSensitiveData(data.Type, data.Value, data.Pattern)
					}
				}
				if scanMode == ScanModeSubdomainsEnum && len(analysis.Subdomains) > 0 {
					for _, subdomain := range analysis.Subdomains {
						tui.Log("FOUND", fmt.Sprintf("Subdomain: %s", subdomain))
					}
				}
			}
		}
	}

	select {
	case <-ctx.Done():
		return context.Canceled
	default:
	}

	if scanMode == ScanModeAll {
		if !silent {
			tui.UpdatePhase("TECHNOLOGY DETECTION")
		}

		techDetector := NewTechDetector()
		pageData, err := crawler.FetchPage(targetURL)
		if err == nil {
			technologies := techDetector.DetectTechnologies(pageData.Body, pageData.Headers, []string{})
			
			for _, tech := range technologies {
				state.AddTechnology(tech)
				if !silent {
					version := tech.Version
					if version == "" {
						version = "unknown version"
					}
					tui.Log("FOUND", fmt.Sprintf("Technology: %s (%s)", tech.Name, version))
				}
			}

			if len(state.Results) > 0 {
				state.Results[0].Technologies = technologies
			}
		}
	}

	select {
	case <-ctx.Done():
		return context.Canceled
	default:
	}

	if !noVulnCheck && (scanMode == ScanModeAll || scanMode == ScanModeJSOnly) {
		if !silent {
			tui.UpdatePhase("VULNERABILITY SCANNING")
		}

		vulnChecker := NewVulnChecker()
		
		state.RLock()
		thirdPartyScripts := make([]ThirdPartyScript, len(state.ThirdPartyScripts))
		copy(thirdPartyScripts, state.ThirdPartyScripts)
		state.RUnlock()

		vulnerabilities := vulnChecker.CheckThirdPartyScripts(ctx, thirdPartyScripts)
		
		if !silent {
			for _, vuln := range vulnerabilities {
				tui.LogWarning(fmt.Sprintf("Vulnerability %s found in %s %s (Severity: %s)", vuln.ID, vuln.Package, vuln.Version, vuln.Severity))
			}
		}
		
		if len(vulnerabilities) > 0 && len(state.Results) > 0 {
			state.Results[0].Vulnerabilities = vulnerabilities
		}
	}

	if !silent {
		tui.UpdatePhase("GENERATING REPORT")
		tui.Log("INFO", "Compiling final report...")
	}

	outputGen := NewOutputGenerator(state)
	
	var saveErr error
	switch scanMode {
	case ScanModeJSOnly:
		report := outputGen.GenerateJSOnlyReport(startTime)
		saveErr = outputGen.SaveSpecializedReport(report, outputFile)
	case ScanModeFormsOnly:
		report := outputGen.GenerateFormsOnlyReport(startTime)
		saveErr = outputGen.SaveSpecializedReport(report, outputFile)
	case ScanModeParamsOnly:
		report := outputGen.GenerateParamsOnlyReport(startTime)
		saveErr = outputGen.SaveSpecializedReport(report, outputFile)
	case ScanModeSubdomainsEnum:
		report := outputGen.GenerateSubdomainsOnlyReport(startTime)
		saveErr = outputGen.SaveSpecializedReport(report, outputFile)
	case ScanModeURLCollection:
		report := outputGen.GenerateURLCollectionReport(startTime)
		saveErr = outputGen.SaveSpecializedReport(report, outputFile)
	default:
		report := outputGen.GenerateReport(startTime)
		saveErr = outputGen.SaveToFile(report, outputFile)
	}
	if saveErr != nil {
		return fmt.Errorf("failed to save report: %w", saveErr)
	}

	if !silent {
		tui.Log("INFO", fmt.Sprintf("Report saved to: %s", outputFile))
	}

	return nil
}


func readURLsFromFile(filename string) ([]string, error) {
	file, err := os.Open(filename)
	if err != nil {
		return nil, err
	}
	defer file.Close()

	urls := make([]string, 0)
	scanner := bufio.NewScanner(file)

	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())
		if line != "" && !strings.HasPrefix(line, "#") {
			urls = append(urls, line)
		}
	}

	if err := scanner.Err(); err != nil {
		return nil, err
	}

	return urls, nil
}