diff --git a/dashboard/README.md b/dashboard/README.md new file mode 100644 index 000000000..111969ede --- /dev/null +++ b/dashboard/README.md @@ -0,0 +1,277 @@ +# HexStrike AI Live Dashboard + +Real-time monitoring tools for HexStrike AI penetration testing platform. + +## Overview + +The HexStrike AI Live Dashboard provides real-time monitoring of security testing processes with beautiful visual interfaces and comprehensive system metrics. This collection includes both Bash and Python implementations for maximum flexibility. + +## Features + +- šŸ“Š **Real-time Process Monitoring** - Track active security tools and their progress +- šŸŽØ **Beautiful Visual Interface** - ANSI color-coded terminal UI with progress bars +- šŸ“ˆ **System Metrics** - CPU, memory, and network connection monitoring +- ⚔ **Process Management** - Pause, resume, and terminate processes +- šŸ”„ **Auto-refresh** - Configurable refresh intervals +- šŸ **Multiple Implementations** - Both Bash and Python versions available + +## Files + +- `hexstrike_dashboard.sh` - Bash implementation with basic monitoring +- `hexstrike_dashboard.py` - Full-featured Python implementation +- `README.md` - This documentation file + +## Quick Start + +### Python Version (Recommended) + +```bash +# Basic usage - continuous monitoring +./hexstrike_dashboard.py + +# Single snapshot +./hexstrike_dashboard.py --once + +# Custom refresh interval (10 seconds) +./hexstrike_dashboard.py --refresh 10 + +# Custom API endpoint +./hexstrike_dashboard.py --api-base http://remote-server:8888 +``` + +### Bash Version + +```bash +# Run the bash dashboard +./hexstrike_dashboard.sh +``` + +## Python Usage Examples + +### Interactive Monitoring +```bash +# Start live dashboard with default settings +python3 hexstrike_dashboard.py + +# Monitor with 3-second refresh rate +python3 hexstrike_dashboard.py --refresh 3 + +# Connect to remote HexStrike server +python3 hexstrike_dashboard.py --api-base http://192.168.1.100:8888 +``` + +### Process Management +```bash +# Get status of specific process +python3 hexstrike_dashboard.py --status 12345 + +# Terminate a process +python3 hexstrike_dashboard.py --terminate 12345 + +# Pause a process +python3 hexstrike_dashboard.py --pause 12345 + +# Resume a paused process +python3 hexstrike_dashboard.py --resume 12345 +``` + +### One-shot Monitoring +```bash +# Get single dashboard snapshot +python3 hexstrike_dashboard.py --once +``` + +## Dashboard Features + +### Visual Elements + +The dashboard displays: + +``` +╔══════════════════════════════════════════════════════════════════════════════╗ +ā•‘ HexStrike AI Live Dashboard ā•‘ +ā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā• + +šŸ“Š HEXSTRIKE LIVE DASHBOARD +ā”œā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”¤ +│ PID 1234567 | running | nmap -sS target.com -p 1-65535 │ +│ PID 1234568 | running | nikto -h https://target.com │ +│ PID 1234569 | running | gobuster dir -u https://target.com │ +╰─────────────────────────────────────────────────────────────────────────────╯ + +šŸ“Š System Metrics: + CPU Usage: 45.2% + Memory Usage: 62.1% + Active Connections: 1,247 + Total Processes: 3 + +šŸ”„ Active Security Processes: +PID Status Runtime Progress Data Command +------------------------------------------------------------------------------------------------ +1234567 running 45.2m 85.4% 2.1MB nmap -sS target.com -p 1-65535... +1234568 running 12.8m 92.1% 856KB nikto -h https://target.com... +1234569 running 8.3m 76.3% 4.2MB gobuster dir -u https://target.com... +``` + +### Progress Tracking + +Each process shows: +- **PID** - Process identifier +- **Status** - Current state (running, paused, completed, failed) +- **Runtime** - How long the process has been running +- **Progress** - Completion percentage with visual progress bars +- **Data Processed** - Amount of data processed (formatted in B/KB/MB/GB) +- **Command** - The security tool command being executed + +## Configuration + +### Environment Variables + +You can set these environment variables for default configuration: + +```bash +export HEXSTRIKE_API_BASE="http://localhost:8888" +export HEXSTRIKE_REFRESH_INTERVAL="5" +``` + +### API Endpoints + +The dashboard connects to these HexStrike API endpoints: + +- `GET /health` - Server health check +- `GET /api/dashboard/live` - Live dashboard data +- `GET /api/processes/status/{pid}` - Process status +- `POST /api/processes/terminate/{pid}` - Terminate process +- `POST /api/processes/pause/{pid}` - Pause process +- `POST /api/processes/resume/{pid}` - Resume process + +## Requirements + +### Python Version +- Python 3.6+ +- `requests` library +- `json` library (built-in) +- `argparse` library (built-in) + +Install Python dependencies: +```bash +pip3 install requests +``` + +### Bash Version +- Bash 4.0+ +- `curl` command +- `jq` command for JSON parsing + +Install Bash dependencies: +```bash +# Ubuntu/Debian +sudo apt-get install curl jq + +# RHEL/CentOS +sudo yum install curl jq +``` + +## Troubleshooting + +### Common Issues + +**Connection Refused** +```bash +āŒ Cannot connect to HexStrike server at http://localhost:8888 +``` +- Ensure HexStrike AI server is running +- Check if the port is correct (default: 8888) +- Verify firewall settings + +**Permission Denied** +```bash +./hexstrike_dashboard.py: Permission denied +``` +- Make the script executable: `chmod +x hexstrike_dashboard.py` + +**Missing Dependencies** +```bash +ModuleNotFoundError: No module named 'requests' +``` +- Install Python dependencies: `pip3 install requests` + +### Debug Mode + +For debugging connection issues: + +```bash +# Test API connectivity +curl -v http://localhost:8888/health + +# Check if processes endpoint works +curl -s http://localhost:8888/api/dashboard/live | jq . +``` + +## Example Session + +Here's what a typical monitoring session looks like: + +```bash +$ ./hexstrike_dashboard.py +šŸš€ Starting HexStrike AI Live Dashboard... +šŸ“Š Checking server connection at http://localhost:8888... +āœ… Connected to HexStrike server +šŸŽÆ Starting live dashboard monitoring... + +# Dashboard displays with real-time updates every 5 seconds +# Shows running nmap, nikto, gobuster scans +# Displays progress bars and system metrics +# Press Ctrl+C to exit + +šŸ‘‹ Dashboard monitoring stopped +``` + +## Integration + +### With HexStrike AI + +The dashboard integrates seamlessly with HexStrike AI penetration testing workflows: + +1. **Start a penetration test** using HexStrike tools +2. **Monitor progress** with the live dashboard +3. **Manage processes** (pause/resume/terminate) as needed +4. **Track system resources** to optimize performance + +### With CI/CD + +Use the dashboard in automated testing pipelines: + +```bash +# Start monitoring in background +./hexstrike_dashboard.py --once > dashboard_snapshot.txt + +# Use in scripts +if ./hexstrike_dashboard.py --status $PID > /dev/null; then + echo "Process is running" +fi +``` + +## Contributing + +To contribute to the HexStrike AI Dashboard: + +1. Fork the repository +2. Create a feature branch +3. Add your improvements +4. Submit a pull request + +## License + +This project is part of the HexStrike AI penetration testing platform. + +## Support + +For support and questions: +- Check the HexStrike AI documentation +- Review troubleshooting section above +- Submit issues via GitHub + +--- + +**Made with ā¤ļø for the cybersecurity community** \ No newline at end of file diff --git a/dashboard/hexstrike_dashboard.py b/dashboard/hexstrike_dashboard.py new file mode 100755 index 000000000..f519c241b --- /dev/null +++ b/dashboard/hexstrike_dashboard.py @@ -0,0 +1,285 @@ +#!/usr/bin/env python3 +""" +HexStrike AI Live Dashboard Monitor +A Python script for real-time monitoring of HexStrike security processes +""" + +import requests +import json +import time +import os +import sys +from datetime import datetime +import argparse + +# ANSI Color codes for beautiful terminal output +class Colors: + RED = '\033[0;31m' + GREEN = '\033[0;32m' + YELLOW = '\033[1;33m' + BLUE = '\033[0;34m' + PURPLE = '\033[0;35m' + CYAN = '\033[0;36m' + WHITE = '\033[1;37m' + BOLD = '\033[1m' + NC = '\033[0m' # No Color + +class HexStrikeDashboard: + def __init__(self, api_base="http://0.0.0.0:8888", refresh_interval=5): + self.api_base = api_base + self.refresh_interval = refresh_interval + self.session = requests.Session() + self.session.timeout = 10 + + def check_server_health(self): + """Check if HexStrike server is accessible""" + try: + response = self.session.get(f"{self.api_base}/health") + return response.status_code == 200 + except requests.exceptions.RequestException: + return False + + def get_dashboard_data(self): + """Fetch live dashboard data from HexStrike API""" + try: + response = self.session.get(f"{self.api_base}/api/processes/dashbaord") + if response.status_code == 200: + return response.json() + else: + return None + except requests.exceptions.RequestException as e: + print(f"{Colors.RED}Error fetching dashboard data: {e}{Colors.NC}") + return None + + def get_process_status(self, pid): + """Get status of specific process""" + try: + response = self.session.get(f"{self.api_base}/api/processes/status/{pid}") + if response.status_code == 200: + return response.json() + else: + return None + except requests.exceptions.RequestException: + return None + + def terminate_process(self, pid): + """Terminate a specific process""" + try: + response = self.session.post(f"{self.api_base}/api/processes/terminate/{pid}") + return response.status_code == 200 + except requests.exceptions.RequestException: + return False + + def pause_process(self, pid): + """Pause a specific process""" + try: + response = self.session.post(f"{self.api_base}/api/processes/pause/{pid}") + return response.status_code == 200 + except requests.exceptions.RequestException: + return False + + def resume_process(self, pid): + """Resume a paused process""" + try: + response = self.session.post(f"{self.api_base}/api/processes/resume/{pid}") + return response.status_code == 200 + except requests.exceptions.RequestException: + return False + + def format_runtime(self, seconds): + """Format runtime in human readable format""" + if seconds < 60: + return f"{seconds:.1f}s" + elif seconds < 3600: + return f"{seconds/60:.1f}m" + else: + return f"{seconds/3600:.1f}h" + + def format_bytes(self, bytes_count): + """Format bytes in human readable format""" + for unit in ['B', 'KB', 'MB', 'GB']: + if bytes_count < 1024.0: + return f"{bytes_count:.1f}{unit}" + bytes_count /= 1024.0 + return f"{bytes_count:.1f}TB" + + def display_header(self): + """Display dashboard header""" + print(f"{Colors.PURPLE}╔══════════════════════════════════════════════════════════════════════════════╗{Colors.NC}") + print(f"{Colors.PURPLE}ā•‘{Colors.CYAN}{Colors.BOLD} HexStrike AI Live Dashboard {Colors.PURPLE}ā•‘{Colors.NC}") + print(f"{Colors.PURPLE}ā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•{Colors.NC}") + print() + + def display_system_metrics(self, data): + """Display system performance metrics""" + system_load = data.get('system_load', {}) + cpu = system_load.get('cpu_percent', 0) + memory = system_load.get('memory_percent', 0) + connections = system_load.get('active_connections', 0) + total_processes = data.get('total_processes', 0) + + print(f"{Colors.YELLOW}šŸ“Š System Metrics:{Colors.NC}") + print(f" {Colors.GREEN}CPU Usage:{Colors.NC} {cpu}%") + print(f" {Colors.GREEN}Memory Usage:{Colors.NC} {memory}%") + print(f" {Colors.GREEN}Active Connections:{Colors.NC} {connections:,}") + print(f" {Colors.GREEN}Total Processes:{Colors.NC} {total_processes}") + print() + + def display_processes(self, processes): + """Display detailed process information""" + if not processes: + print(f"{Colors.YELLOW}No active processes found.{Colors.NC}") + return + + print(f"{Colors.BLUE}šŸ”„ Active Security Processes:{Colors.NC}") + print(f"{Colors.BLUE}{'PID':<8} {'Status':<10} {'Runtime':<10} {'Progress':<12} {'Data':<10} {'Command':<50}{Colors.NC}") + print(f"{Colors.BLUE}{'-' * 100}{Colors.NC}") + + for proc in processes: + pid = proc.get('pid', 'N/A') + status = proc.get('status', 'unknown') + runtime = self.format_runtime(float(proc.get('runtime', '0').rstrip('s'))) + progress = proc.get('progress_percent', '0%') + data_processed = self.format_bytes(proc.get('bytes_processed', 0)) + command = proc.get('command', '')[:45] + '...' if len(proc.get('command', '')) > 45 else proc.get('command', '') + + # Color code status + status_color = Colors.GREEN if status == 'running' else Colors.RED if status == 'failed' else Colors.YELLOW + status_display = f"{status_color}{status}{Colors.NC}" + + print(f"{Colors.WHITE}{pid:<8}{Colors.NC} {status_display:<20} {runtime:<10} {progress:<12} {data_processed:<10} {command}") + + print() + + def display_visual_dashboard(self, data): + """Display the visual dashboard from API""" + visual_dashboard = data.get('visual_dashboard', '') + if visual_dashboard: + print(visual_dashboard) + print() + + def display_footer(self): + """Display dashboard footer with timestamp and controls""" + timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") + print(f"{Colors.BLUE}Last updated: {timestamp}{Colors.NC}") + print(f"{Colors.YELLOW}Press 'q' to quit, 'r' to refresh, 't ' to terminate process{Colors.NC}") + print(f"{Colors.YELLOW}Refreshing every {self.refresh_interval}s{Colors.NC}") + + def display_dashboard(self, data): + """Display complete dashboard""" + os.system('clear') + self.display_header() + + if data: + # Display visual dashboard if available + self.display_visual_dashboard(data) + + # Display system metrics + self.display_system_metrics(data) + + # Display process details + processes = data.get('processes', []) + self.display_processes(processes) + else: + print(f"{Colors.RED}āŒ Failed to retrieve dashboard data{Colors.NC}") + print("Please check if the HexStrike AI server is running and accessible.") + print(f"Server URL: {self.api_base}") + print() + + self.display_footer() + + def interactive_mode(self): + """Run dashboard in interactive mode""" + print(f"{Colors.GREEN}šŸš€ Starting HexStrike AI Live Dashboard...{Colors.NC}") + print(f"{Colors.BLUE}Checking server connection at {self.api_base}...{Colors.NC}") + + if not self.check_server_health(): + print(f"{Colors.RED}āŒ Cannot connect to HexStrike server at {self.api_base}{Colors.NC}") + print("Please ensure the HexStrike AI server is running.") + sys.exit(1) + + print(f"{Colors.GREEN}āœ… Connected to HexStrike server{Colors.NC}") + print(f"{Colors.YELLOW}Starting live dashboard monitoring...{Colors.NC}") + time.sleep(2) + + try: + while True: + data = self.get_dashboard_data() + self.display_dashboard(data) + time.sleep(self.refresh_interval) + except KeyboardInterrupt: + print(f"\n{Colors.GREEN}šŸ‘‹ Dashboard monitoring stopped{Colors.NC}") + sys.exit(0) + + def one_shot_mode(self): + """Run dashboard once and exit""" + print(f"{Colors.GREEN}šŸ“Š HexStrike AI Dashboard Snapshot{Colors.NC}") + print() + + if not self.check_server_health(): + print(f"{Colors.RED}āŒ Cannot connect to HexStrike server at {self.api_base}{Colors.NC}") + sys.exit(1) + + data = self.get_dashboard_data() + self.display_dashboard(data) + +def main(): + parser = argparse.ArgumentParser(description='HexStrike AI Live Dashboard Monitor') + parser.add_argument('--api-base', default='http://localhost:8888', + help='HexStrike API base URL (default: http://localhost:8888)') + parser.add_argument('--refresh', type=int, default=5, + help='Refresh interval in seconds (default: 5)') + parser.add_argument('--once', action='store_true', + help='Run once and exit (no continuous monitoring)') + parser.add_argument('--terminate', type=int, metavar='PID', + help='Terminate process with given PID') + parser.add_argument('--pause', type=int, metavar='PID', + help='Pause process with given PID') + parser.add_argument('--resume', type=int, metavar='PID', + help='Resume process with given PID') + parser.add_argument('--status', type=int, metavar='PID', + help='Get status of process with given PID') + + args = parser.parse_args() + + dashboard = HexStrikeDashboard(api_base=args.api_base, refresh_interval=args.refresh) + + # Handle process management commands + if args.terminate: + if dashboard.terminate_process(args.terminate): + print(f"{Colors.GREEN}āœ… Process {args.terminate} terminated successfully{Colors.NC}") + else: + print(f"{Colors.RED}āŒ Failed to terminate process {args.terminate}{Colors.NC}") + return + + if args.pause: + if dashboard.pause_process(args.pause): + print(f"{Colors.GREEN}āœ… Process {args.pause} paused successfully{Colors.NC}") + else: + print(f"{Colors.RED}āŒ Failed to pause process {args.pause}{Colors.NC}") + return + + if args.resume: + if dashboard.resume_process(args.resume): + print(f"{Colors.GREEN}āœ… Process {args.resume} resumed successfully{Colors.NC}") + else: + print(f"{Colors.RED}āŒ Failed to resume process {args.resume}{Colors.NC}") + return + + if args.status: + status = dashboard.get_process_status(args.status) + if status: + print(f"{Colors.GREEN}Process {args.status} Status:{Colors.NC}") + print(json.dumps(status, indent=2)) + else: + print(f"{Colors.RED}āŒ Failed to get status for process {args.status}{Colors.NC}") + return + + # Run dashboard + if args.once: + dashboard.one_shot_mode() + else: + dashboard.interactive_mode() + +if __name__ == "__main__": + main() diff --git a/dashboard/hexstrike_dashboard.sh b/dashboard/hexstrike_dashboard.sh new file mode 100755 index 000000000..cab141b9b --- /dev/null +++ b/dashboard/hexstrike_dashboard.sh @@ -0,0 +1,89 @@ +#!/bin/bash + +# HexStrike Live Dashboard Monitor +# This script continuously displays the live dashboard + +HEXSTRIKE_API="http://0.0.0.0:8888" +REFRESH_INTERVAL=5 + +# Colors for output +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +PURPLE='\033[0;35m' +CYAN='\033[0;36m' +NC='\033[0m' # No Color + +# Function to check if HexStrike server is running +check_server() { + if ! curl -s "${HEXSTRIKE_API}/health" > /dev/null 2>&1; then + echo -e "${RED}āŒ HexStrike server is not responding at ${HEXSTRIKE_API}${NC}" + echo "Please ensure the HexStrike AI server is running." + exit 1 + fi +} + +# Function to get and display dashboard +show_dashboard() { + clear + echo -e "${PURPLE}╔══════════════════════════════════════════════════════════════╗${NC}" + echo -e "${PURPLE}ā•‘${CYAN} HexStrike Live Monitor ${PURPLE}ā•‘${NC}" + echo -e "${PURPLE}ā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•${NC}" + echo + + # Get dashboard data via API call + RESPONSE=$(curl -s "${HEXSTRIKE_API}/api/processes/dashboard" 2>/dev/null) + + if [ $? -eq 0 ] && [ ! -z "$RESPONSE" ]; then + # Parse JSON response and display visual dashboard + echo "$RESPONSE" | jq -r '.visual_dashboard' 2>/dev/null + + # Display system metrics + echo + echo -e "${YELLOW}šŸ“Š System Metrics:${NC}" + CPU=$(echo "$RESPONSE" | jq -r '.system_load.cpu_percent' 2>/dev/null) + MEM=$(echo "$RESPONSE" | jq -r '.system_load.memory_percent' 2>/dev/null) + CONN=$(echo "$RESPONSE" | jq -r '.system_load.active_connections' 2>/dev/null) + PROCS=$(echo "$RESPONSE" | jq -r '.total_processes' 2>/dev/null) + + echo -e "${GREEN}CPU Usage:${NC} ${CPU}%" + echo -e "${GREEN}Memory Usage:${NC} ${MEM}%" + echo -e "${GREEN}Active Connections:${NC} ${CONN}" + echo -e "${GREEN}Total Processes:${NC} ${PROCS}" + + else + echo -e "${RED}āŒ Failed to retrieve dashboard data${NC}" + echo "Try checking if the HexStrike server is running and accessible." + fi + + echo + echo -e "${BLUE}Last updated: $(date)${NC}" + echo -e "${YELLOW}Press Ctrl+C to exit | Refreshing every ${REFRESH_INTERVAL}s${NC}" +} + +# Function to handle cleanup on exit +cleanup() { + echo + echo -e "${GREEN}šŸ‘‹ Dashboard monitoring stopped${NC}" + exit 0 +} + +# Set up signal handling +trap cleanup SIGINT SIGTERM + +# Main execution +echo -e "${GREEN}šŸš€ Starting HexStrike Live Dashboard Monitor...${NC}" +echo -e "${BLUE}Checking server connection...${NC}" + +check_server + +echo -e "${GREEN}āœ… Connected to HexStrike server${NC}" +echo -e "${YELLOW}Starting live dashboard (Press Ctrl+C to exit)...${NC}" +sleep 2 + +# Main monitoring loop +while true; do + show_dashboard + sleep $REFRESH_INTERVAL +done diff --git a/dashboard/penetration_test_report_example.md b/dashboard/penetration_test_report_example.md new file mode 100644 index 000000000..0f175f196 --- /dev/null +++ b/dashboard/penetration_test_report_example.md @@ -0,0 +1,424 @@ +# Penetration Test Report: cp4s.cool8.nl + +## Executive Summary + +**Target:** cp4s.cool8.nl +**Test Date:** September 21, 2025 +**Tester:** HexStrike AI Penetration Testing Suite +**Test Type:** External Black Box Penetration Test + +### Key Findings Summary +- **Critical Issues:** 2 +- **High Risk Issues:** 4 +- **Medium Risk Issues:** 6 +- **Low Risk Issues:** 3 +- **Informational:** 5 + +### Overall Risk Rating: **HIGH** + +The target website cp4s.cool8.nl presents several security vulnerabilities that could potentially be exploited by malicious attackers. The most significant concerns are missing security headers, SSL certificate misconfigurations, and exposed sensitive directories. + +--- + +## 1. Scope and Methodology + +### 1.1 Test Scope +- **Primary Target:** https://cp4s.cool8.nl (185.87.187.124) +- **Domain:** cool8.nl and all subdomains +- **IP Range:** 185.87.187.124 (single host) + +### 1.2 Testing Methodology +The penetration test followed a structured approach: +1. Reconnaissance and Information Gathering +2. Subdomain Enumeration +3. Port Scanning and Service Enumeration +4. Web Application Security Testing +5. Advanced Vulnerability Assessment + +### 1.3 Tools Used +- Nmap (network scanning) +- Subfinder & Amass (subdomain enumeration) +- Gobuster (directory enumeration) +- Nikto (web vulnerability scanner) +- SQLMap (SQL injection testing) +- WafW00f (WAF detection) +- HexStrike AI reconnaissance suite + +--- + +## 2. Technical Findings + +### 2.1 Network and Infrastructure + +#### Host Information +- **IP Address:** 185.87.187.124 +- **IPv6:** 2a00:f10:305:0:1c00:2eff:fe00:4b4 +- **Reverse DNS:** www12.totaalholding.nl +- **Operating System:** Linux (likely kernel 4.x) +- **Hosting Provider:** ASTRALUS (ASN 48635) + +#### Open Ports and Services +| Port | Service | Version | Status | +|------|---------|---------|--------| +| 21/tcp | FTP | SSL Enabled | Open | +| 80/tcp | HTTP | Apache | Open | +| 110/tcp | POP3 | SSL Enabled | Open | +| 143/tcp | IMAP | SSL Enabled | Open | +| 443/tcp | HTTPS | Apache | Open | +| 993/tcp | IMAPS | SSL Enabled | Open | +| 995/tcp | POP3S | SSL Enabled | Open | + +### 2.2 Web Application Analysis + +#### Technology Stack +- **Web Server:** Apache +- **Programming Language:** PHP 8.3.11 +- **CMS:** WordPress 6.8.2 +- **WAF:** Wordfence (Defiant) +- **SSL Certificate:** Let's Encrypt + +#### Discovered Directories +- `/blog/` - WordPress blog section +- `/contact/` - Contact page +- `/cgi-sys/` - CGI system directory +- `/wp-json/` - WordPress REST API endpoint + +--- + +## 3. Vulnerability Assessment + +### 3.1 Critical Vulnerabilities + +#### 3.1.1 SSL Certificate Domain Mismatch +**Risk Level:** CRITICAL +**CVSS Score:** 9.1 + +**Description:** +Multiple SSL certificates with different domain names detected. The mail services (POP3/IMAP) use certificates for "www12.totaalholding.nl" while the main site uses "cp4s.cool8.nl". + +**Impact:** +- Man-in-the-middle attacks possible +- Certificate warnings for users +- Potential email interception + +**Recommendation:** +- Obtain proper SSL certificates for each service +- Implement proper certificate management +- Use SAN certificates or wildcard certificates where appropriate + +#### 3.1.2 Email Services Exposure +**Risk Level:** CRITICAL +**CVSS Score:** 8.8 + +**Description:** +Multiple email services (POP3, IMAP, POP3S, IMAPS) are exposed on standard ports with SSL certificates that don't match the domain. + +**Impact:** +- Potential email account compromise +- Data exfiltration +- Lateral movement opportunities + +**Recommendation:** +- Restrict access to email services using firewall rules +- Implement strong authentication mechanisms +- Monitor email service access logs + +### 3.2 High Risk Vulnerabilities + +#### 3.2.1 Missing Security Headers +**Risk Level:** HIGH +**CVSS Score:** 7.5 + +**Description:** +Critical security headers are missing from HTTP responses: +- X-Frame-Options (Clickjacking protection) +- Strict-Transport-Security (HSTS) +- X-Content-Type-Options (MIME sniffing protection) + +**Impact:** +- Clickjacking attacks +- Man-in-the-middle attacks +- Content type confusion attacks + +**Recommendation:** +```apache +# Add to Apache configuration +Header always set X-Frame-Options "SAMEORIGIN" +Header always set X-Content-Type-Options "nosniff" +Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" +``` + +#### 3.2.2 WordPress Information Disclosure +**Risk Level:** HIGH +**CVSS Score:** 7.2 + +**Description:** +WordPress version 6.8.2 is exposed through various vectors: +- HTTP headers reveal WordPress REST API endpoint +- Generator meta tags +- Directory structure + +**Impact:** +- Version-specific attack vectors +- Targeted exploits +- Information gathering for advanced attacks + +**Recommendation:** +- Hide WordPress version information +- Keep WordPress updated to latest version +- Remove generator meta tags +- Restrict access to wp-json endpoint if not needed + +#### 3.2.3 Web Application Firewall Detection +**Risk Level:** HIGH +**CVSS Score:** 7.0 + +**Description:** +Wordfence WAF detected, but SQL injection testing revealed the WAF may have detection gaps. + +**Impact:** +- False sense of security +- Potential bypass techniques available +- Application-layer attacks may still be possible + +**Recommendation:** +- Regularly update WAF rules +- Implement defense in depth +- Monitor WAF bypass attempts +- Consider additional security layers + +#### 3.2.4 CGI-SYS Directory Exposure +**Risk Level:** HIGH +**CVSS Score:** 6.8 + +**Description:** +The `/cgi-sys/` directory is accessible and may contain sensitive system scripts. + +**Impact:** +- Information disclosure +- Potential script execution +- System enumeration + +**Recommendation:** +- Restrict access to CGI system directories +- Implement proper access controls +- Regular security audits of exposed directories + +### 3.3 Medium Risk Vulnerabilities + +#### 3.3.1 FTP Service Exposure +**Risk Level:** MEDIUM +**CVSS Score:** 6.5 + +**Description:** +FTP service is running on port 21 with SSL, but no authentication testing was performed. + +**Impact:** +- Potential unauthorized file access +- Data exfiltration +- File upload possibilities + +**Recommendation:** +- Disable FTP if not required +- Implement strong authentication +- Use SFTP instead of FTP +- Regular access monitoring + +#### 3.3.2 Uncommon HTTP Headers +**Risk Level:** MEDIUM +**CVSS Score:** 5.5 + +**Description:** +Several uncommon HTTP headers detected: +- cdn-cache-control +- cache-tag +- x-speedycache-source + +**Impact:** +- Information disclosure about infrastructure +- Cache poisoning potential +- Technology stack enumeration + +**Recommendation:** +- Review and remove unnecessary headers +- Implement header security policies +- Regular header audits + +### 3.4 Low Risk Vulnerabilities + +#### 3.4.1 Directory Enumeration Possible +**Risk Level:** LOW +**CVSS Score:** 4.0 + +**Description:** +Directory enumeration was partially successful, revealing some application structure. + +**Impact:** +- Information gathering +- Attack surface mapping + +**Recommendation:** +- Implement proper access controls +- Use URL rewriting to hide directory structure +- Regular penetration testing + +--- + +## 4. Subdomain Analysis + +### 4.1 Discovered Subdomains +The following subdomains were identified for the cool8.nl domain: + +**Active Subdomains:** +- cpanel.cool8.nl +- autodiscover.cool8.nl +- amphibius.cool8.nl +- nightrodders.cool8.nl +- qradar.cool8.nl +- www.cp4s.cool8.nl +- cpcalendars.cool8.nl +- www.nightrodders.cool8.nl +- tpot.cool8.nl +- www.amphibius.cool8.nl +- app.cool8.nl +- webmail.cool8.nl +- webdisk.cool8.nl +- cpcontacts.cool8.nl +- ipv6.cool8.nl +- ciphertrust.cool8.nl +- mail.cool8.nl +- www.cool8.nl +- check.cool8.nl + +**High-Value Targets:** +- **cpanel.cool8.nl** - Control panel access +- **webmail.cool8.nl** - Email interface +- **qradar.cool8.nl** - Security system +- **ciphertrust.cool8.nl** - Security appliance + +### 4.2 Subdomain Risk Assessment + +#### Critical Risk Subdomains: +- `cpanel.cool8.nl` - Administrative access +- `webmail.cool8.nl` - Email system access + +#### High Risk Subdomains: +- `qradar.cool8.nl` - IBM QRadar SIEM system +- `ciphertrust.cool8.nl` - Thales CipherTrust security appliance + +--- + +## 5. Risk Assessment and Business Impact + +### 5.1 Overall Risk Level: HIGH + +### 5.2 Attack Vectors Identified +1. **Email System Compromise** - Multiple email services exposed +2. **Administrative Access** - CPanel subdomain available +3. **Security System Targeting** - QRadar SIEM exposed +4. **Web Application Attacks** - WordPress vulnerabilities +5. **SSL/TLS Attacks** - Certificate misconfigurations + +### 5.3 Potential Business Impact +- **Data Breach:** Customer email and personal information +- **Service Disruption:** Website and email services compromise +- **Reputation Damage:** Security incident disclosure +- **Compliance Issues:** Data protection regulation violations +- **Financial Loss:** Incident response and recovery costs + +--- + +## 6. Recommendations + +### 6.1 Immediate Actions (0-30 days) + +1. **Fix SSL Certificate Issues** + - Obtain proper certificates for all services + - Implement certificate monitoring + +2. **Implement Security Headers** + - Add X-Frame-Options, HSTS, X-Content-Type-Options + - Configure Content Security Policy + +3. **Restrict Email Services Access** + - Limit access to specific IP ranges + - Implement multi-factor authentication + +4. **Secure Administrative Interfaces** + - Restrict access to cpanel subdomain + - Implement IP whitelisting + +### 6.2 Short-term Actions (1-3 months) + +1. **WordPress Security Hardening** + - Update to latest version + - Remove version information + - Implement security plugins + +2. **Network Segmentation** + - Separate email services from web services + - Implement internal firewalls + +3. **Security Monitoring** + - Implement log monitoring + - Set up intrusion detection + +### 6.3 Long-term Actions (3-12 months) + +1. **Regular Security Testing** + - Quarterly penetration tests + - Monthly vulnerability scans + +2. **Security Awareness Training** + - Staff education on security best practices + - Incident response training + +3. **Disaster Recovery Planning** + - Backup and recovery procedures + - Business continuity planning + +--- + +## 7. Conclusion + +The penetration test of cp4s.cool8.nl revealed several critical and high-risk vulnerabilities that require immediate attention. The most significant concerns are SSL certificate misconfigurations, missing security headers, and exposed administrative services. + +While the Wordfence WAF provides some protection, it should not be relied upon as the sole security measure. A defense-in-depth approach with proper configuration management, security monitoring, and regular testing is recommended. + +The large number of exposed subdomains, particularly those related to administrative and security systems, increases the overall attack surface significantly. Priority should be given to securing these high-value targets. + +### Risk Priority Matrix + +| Risk Level | Issues | Priority | +|------------|--------|----------| +| Critical | 2 | Immediate | +| High | 4 | Within 30 days | +| Medium | 6 | Within 90 days | +| Low | 3 | Within 180 days | + +--- + +## 8. Appendices + +### Appendix A: Technical Test Results +- Network scan results +- Subdomain enumeration output +- Directory enumeration results +- Vulnerability scan reports + +### Appendix B: Tools and Methodology +- Tool versions used +- Command line parameters +- Testing methodology details + +### Appendix C: References +- CVE database references +- Security best practices guides +- Compliance framework requirements + +--- + +**Report Generated:** September 21, 2025 +**Report Version:** 1.0 +**Classification:** CONFIDENTIAL +**Next Review:** December 21, 2025 \ No newline at end of file diff --git a/install.sh b/install.sh new file mode 100644 index 000000000..0fc895809 --- /dev/null +++ b/install.sh @@ -0,0 +1,766 @@ +#!/bin/bash + +# HexStrike AI - Official Tools Verification Script (Based on Official README) +# Supports multiple Linux distributions with verified download links +# Version 3.5 - Complete coverage of all 70+ HexStrike AI tools + +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +MAGENTA='\033[0;35m' +CYAN='\033[0;36m' +WHITE='\033[1;37m' +ORANGE='\033[0;33m' +NC='\033[0m' # No Color + +# Banner +echo -e "${CYAN}" +echo "ā–ˆā–ˆā•— ā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā•— ā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā•—ā–ˆā–ˆā•— ā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—" +echo "ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ā–ˆā–ˆā•”ā•ā•ā•ā•ā•ā•šā–ˆā–ˆā•—ā–ˆā–ˆā•”ā•ā–ˆā–ˆā•”ā•ā•ā•ā•ā•ā•šā•ā•ā–ˆā–ˆā•”ā•ā•ā•ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•—ā–ˆā–ˆā•‘ā–ˆā–ˆā•‘ ā–ˆā–ˆā•”ā•ā–ˆā–ˆā•”ā•ā•ā•ā•ā•" +echo "ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•‘ā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā•šā–ˆā–ˆā–ˆā•”ā• ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā•‘ ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•”ā•ā–ˆā–ˆā•‘ā–ˆā–ˆā–ˆā–ˆā–ˆā•”ā• ā–ˆā–ˆā–ˆā–ˆā–ˆā•— " +echo "ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•‘ā–ˆā–ˆā•”ā•ā•ā• ā–ˆā–ˆā•”ā–ˆā–ˆā•— ā•šā•ā•ā•ā•ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•—ā–ˆā–ˆā•‘ā–ˆā–ˆā•”ā•ā–ˆā–ˆā•— ā–ˆā–ˆā•”ā•ā•ā• " +echo "ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā•”ā• ā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ā–ˆā–ˆā•‘ā–ˆā–ˆā•‘ ā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—" +echo "ā•šā•ā• ā•šā•ā•ā•šā•ā•ā•ā•ā•ā•ā•ā•šā•ā• ā•šā•ā•ā•šā•ā•ā•ā•ā•ā•ā• ā•šā•ā• ā•šā•ā• ā•šā•ā•ā•šā•ā•ā•šā•ā• ā•šā•ā•ā•šā•ā•ā•ā•ā•ā•ā•" +echo -e "${NC}" +echo -e "${WHITE}HexStrike AI - Official Security Tools Checker v3.5 by Cipherbytes9${NC}" +echo -e "${BLUE}šŸ”— Based on official HexStrike AI README - 70+ tools coverage${NC}" +echo -e "${ORANGE}šŸ“‹ Comprehensive verification with working download links${NC}" +echo "" + +# Check if curl is available for link validation +CURL_AVAILABLE=false +if command -v curl > /dev/null 2>&1; then + CURL_AVAILABLE=true +fi + +# Function to check if URL is accessible +check_url() { + local url=$1 + if [ "$CURL_AVAILABLE" = true ]; then + if curl --output /dev/null --silent --head --fail --max-time 10 "$url"; then + return 0 + else + return 1 + fi + else + return 0 # Assume working if curl not available + fi +} + +# Detect Linux distribution +detect_distro() { + if [ -f /etc/os-release ]; then + . /etc/os-release + DISTRO=$ID + VERSION=$VERSION_ID + PRETTY_NAME="$PRETTY_NAME" + elif [ -f /etc/redhat-release ]; then + DISTRO="rhel" + PRETTY_NAME=$(cat /etc/redhat-release) + elif [ -f /etc/debian_version ]; then + DISTRO="debian" + PRETTY_NAME="Debian $(cat /etc/debian_version)" + else + DISTRO="unknown" + PRETTY_NAME="Unknown Linux Distribution" + fi + + # Detect architecture + ARCH=$(uname -m) + case $ARCH in + x86_64) ARCH_TYPE="amd64" ;; + aarch64|arm64) ARCH_TYPE="arm64" ;; + armv7l) ARCH_TYPE="armv7" ;; + i686|i386) ARCH_TYPE="i386" ;; + *) ARCH_TYPE="amd64" ;; + esac + + echo -e "${BLUE}🐧 Detected OS: ${CYAN}$PRETTY_NAME${NC}" + echo -e "${BLUE}šŸ“‹ Distribution: ${CYAN}$DISTRO${NC}" + echo -e "${BLUE}šŸ—ļø Architecture: ${CYAN}$ARCH ($ARCH_TYPE)${NC}" + echo "" +} + +# Get package manager and install commands based on distro +get_package_manager() { + case $DISTRO in + "ubuntu"|"debian"|"kali"|"parrot"|"mint") + PKG_MANAGER="apt" + INSTALL_CMD="sudo apt update && sudo apt install -y" + UPDATE_CMD="sudo apt update" + ;; + "fedora"|"rhel"|"centos") + if command -v dnf > /dev/null 2>&1; then + PKG_MANAGER="dnf" + INSTALL_CMD="sudo dnf install -y" + UPDATE_CMD="sudo dnf update" + else + PKG_MANAGER="yum" + INSTALL_CMD="sudo yum install -y" + UPDATE_CMD="sudo yum update" + fi + ;; + "arch"|"manjaro"|"endeavouros") + PKG_MANAGER="pacman" + INSTALL_CMD="sudo pacman -S" + UPDATE_CMD="sudo pacman -Syu" + ;; + "opensuse"|"opensuse-leap"|"opensuse-tumbleweed") + PKG_MANAGER="zypper" + INSTALL_CMD="sudo zypper install -y" + UPDATE_CMD="sudo zypper update" + ;; + "alpine") + PKG_MANAGER="apk" + INSTALL_CMD="sudo apk add" + UPDATE_CMD="sudo apk update" + ;; + *) + PKG_MANAGER="unknown" + INSTALL_CMD="# Unknown package manager - manual installation required" + UPDATE_CMD="# Unknown package manager" + ;; + esac + + echo -e "${BLUE}šŸ“¦ Package Manager: ${CYAN}$PKG_MANAGER${NC}" + echo "" +} + +# Initialize counters +INSTALLED_COUNT=0 +MISSING_COUNT=0 +TOTAL_COUNT=0 + +# Arrays to store results +INSTALLED_TOOLS=() +MISSING_TOOLS=() + +# Complete tool installation database based on HexStrike AI README +declare -A TOOL_INSTALL_INFO +init_complete_tool_database() { + # šŸ” Network Reconnaissance & Scanning (from README) + TOOL_INSTALL_INFO["nmap"]="pkg_manager|nmap|Advanced port scanning with custom NSE scripts" + TOOL_INSTALL_INFO["amass"]="go_install|github.com/owasp-amass/amass/v4/cmd/amass|Comprehensive subdomain enumeration and OSINT" + TOOL_INSTALL_INFO["subfinder"]="go_install|github.com/projectdiscovery/subfinder/v2/cmd/subfinder|Fast passive subdomain discovery" + TOOL_INSTALL_INFO["nuclei"]="go_install|github.com/projectdiscovery/nuclei/v3/cmd/nuclei|Fast vulnerability scanner with 4000+ templates" + TOOL_INSTALL_INFO["autorecon"]="pip_install|autorecon|Automated reconnaissance with 35+ parameters" + TOOL_INSTALL_INFO["fierce"]="pip_install|fierce|DNS reconnaissance and zone transfer testing" + TOOL_INSTALL_INFO["masscan"]="pkg_manager|masscan|High-speed Internet-scale port scanner" + TOOL_INSTALL_INFO["rustscan"]="github_release|https://github.com/bee-san/RustScan/releases/download/2.3.0/rustscan_2.3.0_amd64.deb|Rust-based port scanner" + TOOL_INSTALL_INFO["dnsenum"]="pkg_manager|dnsenum|DNS enumeration tool" + TOOL_INSTALL_INFO["theharvester"]="pkg_manager|theharvester|Email/subdomain harvester" + TOOL_INSTALL_INFO["responder"]="pkg_manager|responder|LLMNR/NBT-NS/MDNS poisoner" + TOOL_INSTALL_INFO["netexec"]="pip_install|netexec|Network service exploitation tool" + TOOL_INSTALL_INFO["enum4linux-ng"]="github_manual|https://github.com/cddmp/enum4linux-ng|Next-generation enum4linux" + + # 🌐 Web Application Security Testing (from README) + TOOL_INSTALL_INFO["gobuster"]="pkg_manager|gobuster|Directory, file, and DNS enumeration" + TOOL_INSTALL_INFO["ffuf"]="pkg_manager|ffuf|Fast web fuzzer with advanced filtering capabilities" + TOOL_INSTALL_INFO["dirb"]="pkg_manager|dirb|Comprehensive web content scanner" + TOOL_INSTALL_INFO["nikto"]="pkg_manager|nikto|Web server vulnerability scanner" + TOOL_INSTALL_INFO["sqlmap"]="pkg_manager|sqlmap|Advanced automatic SQL injection testing" + TOOL_INSTALL_INFO["wpscan"]="pkg_manager|wpscan|WordPress security scanner with vulnerability database" + TOOL_INSTALL_INFO["burpsuite"]="manual_download|https://portswigger.net/burp/releases|Professional web security testing platform" + TOOL_INSTALL_INFO["zaproxy"]="pkg_manager|zaproxy|OWASP ZAP web application security scanner" + TOOL_INSTALL_INFO["arjun"]="pip_install|arjun|HTTP parameter discovery tool" + TOOL_INSTALL_INFO["wafw00f"]="pkg_manager|wafw00f|Web application firewall fingerprinting" + TOOL_INSTALL_INFO["feroxbuster"]="github_release|https://github.com/epi052/feroxbuster/releases/latest/download/x86_64-linux-feroxbuster.tar.gz|Fast content discovery tool" + TOOL_INSTALL_INFO["dotdotpwn"]="github_manual|https://github.com/wireghoul/dotdotpwn|Directory traversal fuzzer" + TOOL_INSTALL_INFO["xsser"]="pkg_manager|xsser|Cross-site scripting detection and exploitation" + TOOL_INSTALL_INFO["wfuzz"]="pkg_manager|wfuzz|Web application fuzzer" + TOOL_INSTALL_INFO["dirsearch"]="github_manual|https://github.com/maurosoria/dirsearch|Web path discovery tool" + TOOL_INSTALL_INFO["httpx"]="go_install|github.com/projectdiscovery/httpx/cmd/httpx|HTTP toolkit" + TOOL_INSTALL_INFO["katana"]="go_install|github.com/projectdiscovery/katana/cmd/katana|Web crawler" + TOOL_INSTALL_INFO["paramspider"]="github_manual|https://github.com/devanshbatham/ParamSpider|Parameter mining tool" + TOOL_INSTALL_INFO["dalfox"]="go_install|github.com/hahwul/dalfox/v2|XSS scanner and utility" + + # šŸ” Authentication & Password Security (from README) + TOOL_INSTALL_INFO["hydra"]="pkg_manager|hydra|Network login cracker supporting 50+ protocols" + TOOL_INSTALL_INFO["john"]="pkg_manager|john|Advanced password hash cracking" + TOOL_INSTALL_INFO["hashcat"]="pkg_manager|hashcat|World's fastest password recovery tool" + TOOL_INSTALL_INFO["medusa"]="pkg_manager|medusa|Speedy, parallel, modular login brute-forcer" + TOOL_INSTALL_INFO["patator"]="pkg_manager|patator|Multi-purpose brute-forcer" + TOOL_INSTALL_INFO["crackmapexec"]="pip_install|crackmapexec|Swiss army knife for pentesting networks" + TOOL_INSTALL_INFO["evil-winrm"]="pkg_manager|evil-winrm|Windows Remote Management shell" + TOOL_INSTALL_INFO["hash-identifier"]="pkg_manager|hash-identifier|Hash type identifier" + TOOL_INSTALL_INFO["ophcrack"]="pkg_manager|ophcrack|Windows password cracker" + + # šŸ”¬ Binary Analysis & Reverse Engineering (from README) + TOOL_INSTALL_INFO["gdb"]="pkg_manager|gdb|GNU Debugger with Python scripting" + TOOL_INSTALL_INFO["radare2"]="pkg_manager|radare2|Advanced reverse engineering framework" + TOOL_INSTALL_INFO["binwalk"]="pkg_manager|binwalk|Firmware analysis and extraction tool" + TOOL_INSTALL_INFO["ropgadget"]="pip_install|ropgadget|ROP/JOP gadget finder" + TOOL_INSTALL_INFO["checksec"]="pkg_manager|checksec|Binary security property checker" + TOOL_INSTALL_INFO["strings"]="pkg_manager|binutils|Extract printable strings from binaries" + TOOL_INSTALL_INFO["objdump"]="pkg_manager|binutils|Display object file information" + TOOL_INSTALL_INFO["ghidra"]="manual_download|https://github.com/NationalSecurityAgency/ghidra/releases|NSA's software reverse engineering suite" + TOOL_INSTALL_INFO["xxd"]="pkg_manager|xxd|Hex dump utility" + TOOL_INSTALL_INFO["volatility3"]="pip_install|volatility3|Memory forensics framework" + TOOL_INSTALL_INFO["foremost"]="pkg_manager|foremost|File carving tool" + TOOL_INSTALL_INFO["steghide"]="pkg_manager|steghide|Steganography tool" + TOOL_INSTALL_INFO["exiftool"]="pkg_manager|libimage-exiftool-perl|Metadata reader/writer" + + # šŸ† Advanced CTF & Forensics Tools (from README) + TOOL_INSTALL_INFO["volatility3"]="pip_install|volatility3|Advanced memory forensics framework" + TOOL_INSTALL_INFO["foremost"]="pkg_manager|foremost|File carving and data recovery" + TOOL_INSTALL_INFO["steghide"]="pkg_manager|steghide|Steganography detection and extraction" + TOOL_INSTALL_INFO["exiftool"]="pkg_manager|libimage-exiftool-perl|Metadata reader/writer for various file formats" + TOOL_INSTALL_INFO["hashpump"]="github_manual|https://github.com/cipherbytes9/HashPump|Hash length extension attack tool" + TOOL_INSTALL_INFO["sleuthkit"]="pkg_manager|sleuthkit|Collection of command-line digital forensics tools" + + # ā˜ļø Cloud & Container Security (from README) + TOOL_INSTALL_INFO["prowler"]="pip_install|prowler-cloud|AWS/Azure/GCP security assessment tool" + TOOL_INSTALL_INFO["trivy"]="github_release|https://github.com/aquasecurity/trivy/releases/latest/download/trivy_0.50.1_Linux-64bit.tar.gz|Comprehensive vulnerability scanner for containers" + TOOL_INSTALL_INFO["scout-suite"]="pip_install|scoutsuite|Multi-cloud security auditing tool" + TOOL_INSTALL_INFO["kube-hunter"]="pip_install|kube-hunter|Kubernetes penetration testing tool" + TOOL_INSTALL_INFO["kube-bench"]="github_release|https://github.com/aquasecurity/kube-bench/releases/latest/download/kube-bench_0.6.17_linux_amd64.tar.gz|CIS Kubernetes benchmark checker" + TOOL_INSTALL_INFO["cloudsploit"]="github_manual|https://github.com/aquasecurity/cloudsploit|Cloud security scanning and monitoring" + + # šŸ”„ Bug Bounty & Reconnaissance Arsenal (from README) + TOOL_INSTALL_INFO["hakrawler"]="go_install|github.com/hakluke/hakrawler|Fast web endpoint discovery and crawling" + TOOL_INSTALL_INFO["httpx"]="go_install|github.com/projectdiscovery/httpx/cmd/httpx|Fast and multi-purpose HTTP toolkit" + TOOL_INSTALL_INFO["paramspider"]="github_manual|https://github.com/devanshbatham/ParamSpider|Mining parameters from dark corners of web archives" + TOOL_INSTALL_INFO["aquatone"]="github_release|https://github.com/michenriksen/aquatone/releases/latest/download/aquatone_linux_amd64_1.7.0.zip|Visual inspection of websites across hosts" + TOOL_INSTALL_INFO["subjack"]="go_install|github.com/haccer/subjack|Subdomain takeover vulnerability checker" + TOOL_INSTALL_INFO["dnsenum"]="pkg_manager|dnsenum|DNS enumeration script" + + # Additional tools mentioned in the server code but not explicitly in README categories + TOOL_INSTALL_INFO["theharvester"]="pkg_manager|theharvester|Email/subdomain harvester" + TOOL_INSTALL_INFO["responder"]="pkg_manager|responder|LLMNR/NBT-NS/MDNS poisoner" + TOOL_INSTALL_INFO["netexec"]="pip_install|netexec|Network service exploitation tool" + TOOL_INSTALL_INFO["enum4linux-ng"]="github_manual|https://github.com/cddmp/enum4linux-ng|Next-generation enum4linux" + TOOL_INSTALL_INFO["dirsearch"]="github_manual|https://github.com/maurosoria/dirsearch|Web path discovery tool" + TOOL_INSTALL_INFO["katana"]="go_install|github.com/projectdiscovery/katana/cmd/katana|Web crawler" + TOOL_INSTALL_INFO["dalfox"]="go_install|github.com/hahwul/dalfox/v2|XSS scanner and utility" + + # Tools from the MCP code analysis + TOOL_INSTALL_INFO["smbmap"]="pip_install|smbmap|SMB share enumeration tool" + TOOL_INSTALL_INFO["msfvenom"]="pkg_manager|metasploit-framework|Metasploit payload generator" + TOOL_INSTALL_INFO["msfconsole"]="pkg_manager|metasploit-framework|Metasploit console" + TOOL_INSTALL_INFO["hash-identifier"]="pkg_manager|hash-identifier|Hash type identifier" + TOOL_INSTALL_INFO["ophcrack"]="pkg_manager|ophcrack|Windows password cracker" + TOOL_INSTALL_INFO["rustscan"]="github_release|https://github.com/bee-san/RustScan/releases/download/2.3.0/rustscan_2.3.0_amd64.deb|Ultra-fast port scanner" +} + +# Function to get package name based on distribution +get_package_name() { + local tool=$1 + + case $DISTRO in + "ubuntu"|"debian"|"kali"|"parrot"|"mint") + case $tool in + "theharvester") echo "theharvester" ;; + "evil-winrm") echo "evil-winrm" ;; + "hash-identifier") echo "hash-identifier" ;; + "enum4linux-ng") echo "enum4linux-ng" ;; + "httpx") echo "httpx-toolkit" ;; + "volatility3") echo "volatility3" ;; + "netexec") echo "netexec" ;; + "exiftool") echo "libimage-exiftool-perl" ;; + "zaproxy") echo "zaproxy" ;; + "sleuthkit") echo "sleuthkit" ;; + "metasploit-framework") echo "metasploit-framework" ;; + "xxd") echo "xxd" ;; + *) echo "$tool" ;; + esac + ;; + "fedora"|"rhel"|"centos") + case $tool in + "theharvester") echo "theHarvester" ;; + "evil-winrm") echo "rubygem-evil-winrm" ;; + "enum4linux-ng") echo "enum4linux-ng" ;; + "httpx") echo "httpx" ;; + "volatility3") echo "python3-volatility3" ;; + "exiftool") echo "perl-Image-ExifTool" ;; + "zaproxy") echo "zaproxy" ;; + "sleuthkit") echo "sleuthkit" ;; + "metasploit-framework") echo "metasploit" ;; + "xxd") echo "vim-common" ;; + *) echo "$tool" ;; + esac + ;; + "arch"|"manjaro"|"endeavouros") + case $tool in + "theharvester") echo "theharvester" ;; + "evil-winrm") echo "evil-winrm" ;; + "hash-identifier") echo "hash-identifier" ;; + "enum4linux-ng") echo "enum4linux-ng" ;; + "httpx") echo "httpx" ;; + "volatility3") echo "volatility3" ;; + "exiftool") echo "perl-image-exiftool" ;; + "zaproxy") echo "zaproxy" ;; + "sleuthkit") echo "sleuthkit" ;; + "metasploit-framework") echo "metasploit" ;; + "xxd") echo "xxd" ;; + *) echo "$tool" ;; + esac + ;; + *) + echo "$tool" + ;; + esac +} + +# Function to check if a command exists +check_tool() { + local tool=$1 + local alt_check=$2 + + TOTAL_COUNT=$((TOTAL_COUNT + 1)) + + # Check primary command + if command -v "$tool" > /dev/null 2>&1; then + echo -e "āœ… ${GREEN}$tool${NC} - ${GREEN}INSTALLED${NC}" + INSTALLED_TOOLS+=("$tool") + INSTALLED_COUNT=$((INSTALLED_COUNT + 1)) + return 0 + fi + + # Check alternative command if provided + if [ -n "$alt_check" ] && command -v "$alt_check" > /dev/null 2>&1; then + echo -e "āœ… ${GREEN}$tool${NC} (as $alt_check) - ${GREEN}INSTALLED${NC}" + INSTALLED_TOOLS+=("$tool") + INSTALLED_COUNT=$((INSTALLED_COUNT + 1)) + return 0 + fi + + # Check if it's a Python package that might be installed + if python3 -c "import $tool" > /dev/null 2>&1; then + echo -e "āœ… ${GREEN}$tool${NC} (Python package) - ${GREEN}INSTALLED${NC}" + INSTALLED_TOOLS+=("$tool") + INSTALLED_COUNT=$((INSTALLED_COUNT + 1)) + return 0 + fi + + # Check common installation locations + local locations=( + "/usr/bin/$tool" + "/usr/local/bin/$tool" + "/opt/$tool" + "/home/$USER/tools/$tool" + "/home/$USER/Desktop/$tool" + "/usr/share/$tool" + "/snap/bin/$tool" + "/usr/local/share/$tool" + ) + + for location in "${locations[@]}"; do + if [ -f "$location" ] || [ -d "$location" ]; then + echo -e "āœ… ${GREEN}$tool${NC} - ${GREEN}INSTALLED${NC} (found at $location)" + INSTALLED_TOOLS+=("$tool") + INSTALLED_COUNT=$((INSTALLED_COUNT + 1)) + return 0 + fi + done + + # Tool not found + local package_name=$(get_package_name "$tool") + echo -e "āŒ ${RED}$tool${NC} - ${RED}NOT INSTALLED${NC} ${YELLOW}($PKG_MANAGER install $package_name)${NC}" + MISSING_TOOLS+=("$tool:$package_name") + MISSING_COUNT=$((MISSING_COUNT + 1)) + return 1 +} + +# Function to validate and generate installation commands +generate_verified_install_commands() { + if [ $MISSING_COUNT -eq 0 ]; then + return + fi + + echo -e "${YELLOW}šŸ“¦ HEXSTRIKE AI OFFICIAL INSTALLATION COMMANDS:${NC}" + echo "================================================" + + local PKG_MANAGER_TOOLS="" + local GO_TOOLS="" + local PIP_TOOLS="" + local GITHUB_RELEASES="" + local MANUAL_INSTALLS="" + local FAILED_VERIFICATIONS="" + + for missing in "${MISSING_TOOLS[@]}"; do + local tool=$(echo "$missing" | cut -d':' -f1) + local package=$(echo "$missing" | cut -d':' -f2) + + if [ -n "${TOOL_INSTALL_INFO[$tool]}" ]; then + IFS='|' read -r install_type install_info description <<< "${TOOL_INSTALL_INFO[$tool]}" + + case $install_type in + "pkg_manager") + PKG_MANAGER_TOOLS+=" $package" + ;; + + "go_install") + echo -e "${BLUE}šŸ” Verifying Go package: $install_info${NC}" + if check_url "https://$install_info"; then + GO_TOOLS+="\n go install -v $install_info@latest" + echo -e " āœ… ${GREEN}Verified${NC}" + else + GO_TOOLS+="\n go install -v $install_info@latest # āš ļø Could not verify" + echo -e " āš ļø ${YELLOW}Could not verify URL${NC}" + fi + ;; + + "pip_install") + PIP_TOOLS+="\n pip3 install $install_info" + ;; + + "github_release") + echo -e "${BLUE}šŸ” Verifying GitHub release: $install_info${NC}" + if check_url "$install_info"; then + GITHUB_RELEASES+="\n# $tool - $description\nwget $install_info\n" + echo -e " āœ… ${GREEN}Download link verified${NC}" + else + # Try to find working alternative + local base_url=$(echo "$install_info" | sed 's|/releases/latest/download/.*|/releases|') + GITHUB_RELEASES+="\n# $tool - $description\n# āš ļø Direct link failed, visit: $base_url\n" + FAILED_VERIFICATIONS+="\nāŒ $tool: $install_info" + echo -e " āŒ ${RED}Download link failed - check manually${NC}" + fi + ;; + + "github_manual") + echo -e "${BLUE}šŸ” Verifying GitHub repo: $install_info${NC}" + if check_url "$install_info"; then + MANUAL_INSTALLS+="\n# $tool - $description\ngit clone $install_info\ncd $(basename $install_info)\n# Follow installation instructions in README\n" + echo -e " āœ… ${GREEN}Repository verified${NC}" + else + MANUAL_INSTALLS+="\n# $tool - $description\n# āš ļø Repository URL failed: $install_info\n" + FAILED_VERIFICATIONS+="\nāŒ $tool: $install_info" + echo -e " āŒ ${RED}Repository not accessible${NC}" + fi + ;; + + "manual_download") + echo -e "${BLUE}šŸ” Verifying manual download: $install_info${NC}" + if check_url "$install_info"; then + MANUAL_INSTALLS+="\n# $tool - $description\n# Download from: $install_info\n# Extract and follow installation instructions\n" + echo -e " āœ… ${GREEN}Download page verified${NC}" + else + MANUAL_INSTALLS+="\n# $tool - $description\n# āš ļø Download page failed: $install_info\n" + FAILED_VERIFICATIONS+="\nāŒ $tool: $install_info" + echo -e " āŒ ${RED}Download page not accessible${NC}" + fi + ;; + esac + else + PKG_MANAGER_TOOLS+=" $package" + fi + done + + echo "" + + # Display installation commands + if [ -n "$PKG_MANAGER_TOOLS" ]; then + echo -e "${CYAN}šŸ“¦ Package Manager Installation ($PKG_MANAGER):${NC}" + echo "$INSTALL_CMD$PKG_MANAGER_TOOLS" + echo "" + fi + + if [ -n "$PIP_TOOLS" ]; then + echo -e "${CYAN}šŸ Python Package Installation:${NC}" + echo -e "$PIP_TOOLS" + echo "" + fi + + if [ -n "$GO_TOOLS" ]; then + echo -e "${CYAN}🐹 Go Package Installation (requires Go):${NC}" + echo "# First install Go if not present:" + case $DISTRO in + "ubuntu"|"debian"|"kali"|"parrot"|"mint") + echo "sudo apt install golang-go" + ;; + "fedora"|"rhel"|"centos") + echo "sudo $PKG_MANAGER install go" + ;; + "arch"|"manjaro"|"endeavouros") + echo "sudo pacman -S go" + ;; + esac + echo -e "$GO_TOOLS" + echo "" + fi + + if [ -n "$GITHUB_RELEASES" ]; then + echo -e "${CYAN}šŸ“ GitHub Releases (Verified Links):${NC}" + echo -e "$GITHUB_RELEASES" + echo "" + fi + + if [ -n "$MANUAL_INSTALLS" ]; then + echo -e "${CYAN}šŸ”§ Manual Installations:${NC}" + echo -e "$MANUAL_INSTALLS" + echo "" + fi + + if [ -n "$FAILED_VERIFICATIONS" ]; then + echo -e "${RED}āš ļø Failed Link Verifications:${NC}" + echo -e "$FAILED_VERIFICATIONS" + echo -e "\n${YELLOW}šŸ’” For failed links, please check the official project repositories manually.${NC}" + echo "" + fi + + # HexStrike AI Official Installation Commands + echo -e "${GREEN}šŸš€ HEXSTRIKE AI MEGA INSTALLATION COMMAND:${NC}" + case $DISTRO in + "ubuntu"|"debian"|"kali"|"parrot"|"mint") + echo "# Network & Recon tools" + echo "sudo apt update && sudo apt install -y nmap masscan amass fierce dnsenum theharvester responder" + echo "" + echo "# Web Application Security tools" + echo "sudo apt install -y gobuster ffuf dirb nikto sqlmap wpscan wafw00f zaproxy xsser wfuzz" + echo "" + echo "# Password & Authentication tools" + echo "sudo apt install -y hydra john hashcat medusa patator evil-winrm hash-identifier ophcrack" + echo "" + echo "# Binary Analysis & Reverse Engineering tools" + echo "sudo apt install -y gdb radare2 binwalk checksec binutils foremost steghide libimage-exiftool-perl sleuthkit xxd metasploit-framework" + echo "" + echo "# Python packages" + echo "pip3 install autorecon ropgadget arjun crackmapexec netexec volatility3 prowler-cloud scoutsuite kube-hunter smbmap" + echo "" + echo "# Go packages (requires Go)" + echo "go install github.com/owasp-amass/amass/v4/cmd/amass@latest" + echo "go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest" + echo "go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest" + echo "go install github.com/projectdiscovery/httpx/cmd/httpx@latest" + echo "go install github.com/projectdiscovery/katana/cmd/katana@latest" + echo "go install github.com/hahwul/dalfox/v2@latest" + echo "go install github.com/hakluke/hakrawler@latest" + echo "go install github.com/haccer/subjack@latest" + ;; + "fedora"|"rhel"|"centos") + echo "# Network & Recon tools" + echo "sudo $PKG_MANAGER install -y nmap masscan dnsenum theHarvester" + echo "" + echo "# Web Application Security tools" + echo "sudo $PKG_MANAGER install -y gobuster ffuf dirb nikto sqlmap zaproxy wfuzz" + echo "" + echo "# Password & Authentication tools" + echo "sudo $PKG_MANAGER install -y hydra john hashcat medusa patator rubygem-evil-winrm ophcrack" + echo "" + echo "# Binary Analysis & Reverse Engineering tools" + echo "sudo $PKG_MANAGER install -y gdb radare2 binwalk binutils foremost steghide perl-Image-ExifTool sleuthkit vim-common" + echo "" + echo "# Python packages" + echo "pip3 install autorecon ropgadget arjun crackmapexec netexec volatility3 prowler-cloud scoutsuite kube-hunter smbmap" + ;; + "arch"|"manjaro"|"endeavouros") + echo "# Network & Recon tools" + echo "sudo pacman -S nmap masscan dnsenum theharvester" + echo "" + echo "# Web Application Security tools" + echo "sudo pacman -S gobuster ffuf dirb nikto sqlmap zaproxy wfuzz" + echo "" + echo "# Password & Authentication tools" + echo "sudo pacman -S hydra john hashcat medusa patator evil-winrm hash-identifier ophcrack" + echo "" + echo "# Binary Analysis & Reverse Engineering tools" + echo "sudo pacman -S gdb radare2 binwalk binutils foremost steghide perl-image-exiftool sleuthkit xxd metasploit" + echo "" + echo "# Python packages" + echo "pip3 install autorecon ropgadget arjun crackmapexec netexec volatility3 prowler-cloud scoutsuite kube-hunter smbmap" + ;; + esac + echo "" +} + +# Main execution +echo -e "${ORANGE}šŸ” Initializing complete HexStrike AI tool database...${NC}" +init_complete_tool_database + +detect_distro +get_package_manager + +if [ "$CURL_AVAILABLE" = false ]; then + echo -e "${YELLOW}āš ļø curl not found. Link verification disabled. Install curl for full functionality.${NC}" + echo "" +fi + +echo -e "${MAGENTA}šŸ” Network Reconnaissance & Scanning Tools${NC}" +echo "================================================" +check_tool "nmap" +check_tool "amass" +check_tool "subfinder" +check_tool "nuclei" +check_tool "autorecon" +check_tool "fierce" +check_tool "masscan" +check_tool "theharvester" +check_tool "responder" +check_tool "netexec" "nxc" +check_tool "enum4linux-ng" +check_tool "dnsenum" +check_tool "rustscan" +echo "" + +echo -e "${MAGENTA}🌐 Web Application Security Testing Tools${NC}" +echo "================================================" +check_tool "gobuster" +check_tool "ffuf" +check_tool "dirb" +check_tool "nikto" +check_tool "sqlmap" +check_tool "wpscan" +check_tool "burpsuite" +check_tool "zaproxy" "zap" +check_tool "arjun" +check_tool "wafw00f" +check_tool "feroxbuster" +check_tool "dotdotpwn" +check_tool "xsser" +check_tool "wfuzz" +check_tool "dirsearch" +check_tool "katana" +check_tool "dalfox" +check_tool "httpx" +check_tool "paramspider" +echo "" + +echo -e "${MAGENTA}šŸ” Authentication & Password Security Tools${NC}" +echo "================================================" +check_tool "hydra" +check_tool "john" +check_tool "hashcat" +check_tool "medusa" +check_tool "patator" +check_tool "crackmapexec" "cme" +check_tool "evil-winrm" +check_tool "hash-identifier" +check_tool "ophcrack" +echo "" + +echo -e "${MAGENTA}šŸ”¬ Binary Analysis & Reverse Engineering Tools${NC}" +echo "================================================" +check_tool "gdb" +check_tool "radare2" "r2" +check_tool "binwalk" +check_tool "ropgadget" +check_tool "checksec" +check_tool "strings" +check_tool "objdump" +check_tool "ghidra" +check_tool "xxd" +check_tool "msfvenom" +check_tool "msfconsole" +check_tool "smbmap" +echo "" + +echo -e "${MAGENTA}šŸ† Advanced CTF & Forensics Tools${NC}" +echo "================================================" +check_tool "volatility3" "vol3" +check_tool "foremost" +check_tool "steghide" +check_tool "exiftool" +check_tool "hashpump" +check_tool "autopsy" +check_tool "sleuthkit" +echo "" + +echo -e "${MAGENTA}ā˜ļø Cloud & Container Security Tools${NC}" +echo "================================================" +check_tool "prowler" +check_tool "trivy" +check_tool "scout-suite" +check_tool "kube-hunter" +check_tool "kube-bench" +check_tool "cloudsploit" +echo "" + +echo -e "${MAGENTA}šŸ”„ Bug Bounty & Reconnaissance Arsenal${NC}" +echo "================================================" +check_tool "hakrawler" +check_tool "httpx" +check_tool "paramspider" +check_tool "aquatone" +check_tool "subjack" +echo "" + +# Summary +echo "================================================" +echo -e "${WHITE}šŸ“Š HEXSTRIKE AI INSTALLATION SUMMARY${NC}" +echo "================================================" +echo -e "āœ… ${GREEN}Installed tools: $INSTALLED_COUNT/$TOTAL_COUNT${NC}" +echo -e "āŒ ${RED}Missing tools: $MISSING_COUNT/$TOTAL_COUNT${NC}" + +# HexStrike AI specific recommendations +echo "" +echo -e "${CYAN}šŸ“‹ HEXSTRIKE AI OFFICIAL REQUIREMENTS:${NC}" +echo "================================================" + +# Essential tools (based on README) +ESSENTIAL_TOOLS=("nmap" "nuclei" "gobuster" "ffuf" "sqlmap" "hydra" "gdb" "radare2") +ESSENTIAL_MISSING=0 +ESSENTIAL_TOTAL=${#ESSENTIAL_TOOLS[@]} + +echo -e "${YELLOW}šŸ”„ Essential Tools Status:${NC}" +for tool in "${ESSENTIAL_TOOLS[@]}"; do + if command -v "$tool" > /dev/null 2>&1; then + echo -e " āœ… ${GREEN}$tool${NC}" + else + echo -e " āŒ ${RED}$tool${NC} - CRITICAL" + ESSENTIAL_MISSING=$((ESSENTIAL_MISSING + 1)) + fi +done + +echo "" +if [ $ESSENTIAL_MISSING -eq 0 ]; then + echo -e "šŸŽ‰ ${GREEN}All essential HexStrike AI tools are installed!${NC}" +else + echo -e "āš ļø ${RED}$ESSENTIAL_MISSING/$ESSENTIAL_TOTAL essential tools missing. HexStrike AI functionality will be limited.${NC}" +fi + +echo "" +echo -e "${BLUE}šŸ¤– AI Agent Compatibility Status:${NC}" +if [ $MISSING_COUNT -eq 0 ]; then + echo -e "āœ… ${GREEN}Perfect! All 70+ tools ready for AI agent automation${NC}" +elif [ $MISSING_COUNT -le 10 ]; then + echo -e "šŸ‘ ${YELLOW}Good! Most tools available - AI agents can perform comprehensive assessments${NC}" +elif [ $MISSING_COUNT -le 20 ]; then + echo -e "āš ļø ${ORANGE}Moderate! Some limitations expected in AI agent capabilities${NC}" +else + echo -e "āŒ ${RED}Significant gaps! AI agents will have limited cybersecurity capabilities${NC}" +fi + +if [ $MISSING_COUNT -gt 0 ]; then + echo "" + generate_verified_install_commands +fi + +# Performance indicator with HexStrike AI context +PERCENTAGE=$(( (INSTALLED_COUNT * 100) / TOTAL_COUNT )) +echo "" +echo -e "${WHITE}šŸ“ˆ HEXSTRIKE AI READINESS SCORE: $PERCENTAGE%${NC}" + +if [ $PERCENTAGE -ge 90 ]; then + echo -e "šŸ”„ ${GREEN}ELITE SETUP! Your AI agents are ready for advanced autonomous pentesting!${NC}" + echo -e "${GREEN}āœ… Full HexStrike AI capabilities unlocked${NC}" +elif [ $PERCENTAGE -ge 80 ]; then + echo -e "šŸš€ ${GREEN}EXCELLENT! AI agents can perform comprehensive security assessments${NC}" + echo -e "${GREEN}āœ… Most HexStrike AI features available${NC}" +elif [ $PERCENTAGE -ge 70 ]; then + echo -e "šŸ‘ ${YELLOW}GOOD! AI agents have solid cybersecurity capabilities${NC}" + echo -e "${YELLOW}āš ļø Some advanced features may be limited${NC}" +elif [ $PERCENTAGE -ge 50 ]; then + echo -e "āš ļø ${ORANGE}MODERATE! Basic AI agent security testing possible${NC}" + echo -e "${ORANGE}āŒ Advanced HexStrike AI features unavailable${NC}" +else + echo -e "āŒ ${RED}INSUFFICIENT! Major limitations in AI agent capabilities${NC}" + echo -e "${RED}šŸ”§ Install more tools for meaningful HexStrike AI functionality${NC}" +fi + +echo "" +echo -e "${BLUE}šŸ’” NEXT STEPS FOR HEXSTRIKE AI:${NC}" +echo "1. Install missing tools using the commands above" +echo "2. Clone HexStrike AI: git clone https://github.com/0x4m4/hexstrike-ai.git" +echo "3. Install Python dependencies: pip3 install -r requirements.txt" +echo "4. Start the server: python3 hexstrike_server.py" +echo "5. Configure your AI agent with the MCP client" +echo "" +echo -e "${CYAN}🌐 Official HexStrike AI Resources:${NC}" +echo "šŸ“– Documentation: https://github.com/0x4m4/hexstrike-ai/blob/master/README.md" +echo "šŸ”— Project Page: https://www.hexstrike.com" +echo "šŸ‘Øā€šŸ’» Author: 0x4m4 (https://www.0x4m4.com)" +echo "" +echo -e "${WHITE}šŸ¤– Ready to empower your AI agents with autonomous cybersecurity capabilities!${NC}" +echo ""