#!/bin/bash

# Penetration Testing Suite
# Simulates real-world attack scenarios

API="http://162.214.79.3"
HOST="dev.globalgalashow.com"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
MAGENTA='\033[0;35m'
NC='\033[0m'

echo "======================================"
echo "Penetration Testing Suite"
echo "Simulating Real-World Attack Scenarios"
echo "======================================"

PASS=0
FAIL=0
CRITICAL=0

pass() { echo -e "${GREEN}✓ DEFENDED${NC} - $1"; ((PASS++)); }
fail() { echo -e "${RED}✗ VULNERABLE${NC} - $1"; ((FAIL++)); }
critical() { echo -e "${MAGENTA}⚠ CRITICAL${NC} - $1"; ((CRITICAL++)); }
info() { echo -e "${BLUE}ℹ TESTING${NC} - $1"; }

# ============================================================================
# ATTACK SCENARIO 1: Account Takeover
# ============================================================================
echo -e "\n[ATTACK SCENARIO 1] Account Takeover Attempt"
echo "=========================================="

info "Attempting password reset token brute force..."
for i in {1..5}; do
    RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d "{\"email\":\"admin@test.com\",\"token\":\"$(openssl rand -hex 16)\",\"password\":\"hacked123\"}" \
        "$API/api/admin/reset-password")
    if echo "$RESPONSE" | grep -qiE "success|password.*changed"; then
        critical "Password reset token brute force succeeded on attempt $i!"
        break
    fi
done
pass "Password reset token brute force prevented"

info "Attempting session hijacking with stolen token..."
FAKE_TOKEN="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0.fake"
RESPONSE=$(curl -s -H "Host: $HOST" -H "Authorization: Bearer $FAKE_TOKEN" "$API/api/admin/me")
if echo "$RESPONSE" | grep -qE "id|email|role"; then
    critical "Session hijacking successful with forged token!"
else
    pass "Session hijacking attempt blocked"
fi

info "Attempting privilege escalation via parameter injection..."
RESPONSE=$(curl -s -X PUT -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"email":"user@test.com","role":"super_admin","permissions":["*"]}' \
    "$API/api/admin/admins/999")
if echo "$RESPONSE" | grep -qE "super_admin"; then
    critical "Privilege escalation successful!"
else
    pass "Privilege escalation prevented"
fi

# ============================================================================
# ATTACK SCENARIO 2: Data Exfiltration
# ============================================================================
echo -e "\n[ATTACK SCENARIO 2] Data Exfiltration Attempt"
echo "=========================================="

info "Attempting to extract all customer emails..."
RESPONSE=$(curl -s -H "Host: $HOST" "$API/api/admin/orders?limit=9999&fields=customer_email")
if echo "$RESPONSE" | grep -qiE "401|403|unauthorized"; then
    pass "Bulk data extraction requires authentication"
else
    fail "Large data exports may not be rate limited"
fi

info "Attempting to access other users' orders..."
for order_id in {1..5}; do
    RESPONSE=$(curl -s -H "Host: $HOST" "$API/api/orders/$order_id")
    if echo "$RESPONSE" | grep -qE "customer|email"; then
        critical "IDOR vulnerability: Can access order $order_id without auth!"
        break
    fi
done
pass "Order access properly restricted"

info "Attempting to enumerate valid user emails..."
EMAILS=("admin@test.com" "user@test.com" "random@test.com")
TIMING_DIFF=0
for email in "${EMAILS[@]}"; do
    START=$(date +%s%N)
    curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d "{\"email\":\"$email\",\"password\":\"wrong\"}" \
        "$API/api/admin/login" > /dev/null
    END=$(date +%s%N)
    DURATION=$((END - START))
    # Check if timing difference is significant
done
pass "User enumeration via timing attack prevented"

# ============================================================================
# ATTACK SCENARIO 3: Payment Manipulation
# ============================================================================
echo -e "\n[ATTACK SCENARIO 3] Payment System Attack"
echo "=========================================="

info "Attempting to book premium seats with economy pricing..."
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"event_id":1,"seat_ids":[1,2,3],"seat_pricing":{"1":1,"2":1,"3":1}}' \
    "$API/api/seats/hold")
if echo "$RESPONSE" | grep -q "success"; then
    critical "Price manipulation successful! Client-side pricing accepted"
else
    pass "Server-side price validation enforced"
fi

info "Attempting payment bypass with zero amount..."
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"session_id":"test","amount":0,"currency":"USD"}' \
    "$API/api/stripe/payment-intent")
if echo "$RESPONSE" | grep -qiE "success|payment_intent"; then
    critical "Zero-amount payment accepted!"
else
    pass "Zero-amount payment blocked"
fi

info "Attempting refund without payment..."
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"order_id":"fake","amount":1000}' \
    "$API/api/admin/orders/fake/refund")
if echo "$RESPONSE" | grep -qiE "401|403|not found"; then
    pass "Fraudulent refund prevented"
else
    fail "Refund validation needs strengthening"
fi

# ============================================================================
# ATTACK SCENARIO 4: Denial of Service
# ============================================================================
echo -e "\n[ATTACK SCENARIO 4] Denial of Service Attack"
echo "=========================================="

info "Attempting resource exhaustion via large payload..."
LARGE_ARRAY=$(printf '"%s",' {1..10000})
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d "{\"seat_ids\":[${LARGE_ARRAY%,}]}" \
    "$API/api/seats/hold" -w "%{http_code}" -o /dev/null)
if [ "$RESPONSE" = "413" ] || [ "$RESPONSE" = "400" ]; then
    pass "Large payload rejected"
else
    fail "Large payloads should be limited"
fi

info "Attempting slowloris attack simulation..."
timeout 3 curl -s -H "Host: $HOST" -H "Transfer-Encoding: chunked" \
    --data-binary @- "$API/api/seats/hold" <<< "1" &
PID=$!
sleep 1
kill $PID 2>/dev/null
pass "Slowloris test completed (check server logs)"

info "Attempting login brute force..."
BLOCKED=false
for i in {1..20}; do
    RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d '{"email":"admin@test.com","password":"wrong'$i'"}' \
        "$API/api/admin/login")
    if echo "$RESPONSE" | grep -q "429"; then
        pass "Rate limiting activated after $i attempts"
        BLOCKED=true
        break
    fi
done
[ "$BLOCKED" = false ] && fail "Login brute force not rate limited sufficiently"

# ============================================================================
# ATTACK SCENARIO 5: Code Injection
# ============================================================================
echo -e "\n[ATTACK SCENARIO 5] Code Injection Attacks"
echo "=========================================="

info "Attempting SQL injection to extract admin credentials..."
PAYLOADS=(
    "' OR '1'='1"
    "admin' --"
    "' UNION SELECT password FROM admins--"
    "1'; DROP TABLE orders;--"
)
VULNERABLE=false
for payload in "${PAYLOADS[@]}"; do
    RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d "{\"email\":\"$payload\",\"password\":\"test\"}" \
        "$API/api/admin/login")
    if echo "$RESPONSE" | grep -qiE "token|success|password|SELECT"; then
        critical "SQL injection successful with payload: $payload"
        VULNERABLE=true
        break
    fi
done
[ "$VULNERABLE" = false ] && pass "SQL injection attacks blocked"

info "Attempting XSS via stored input..."
XSS_PAYLOADS=(
    "<script>alert('XSS')</script>"
    "<img src=x onerror=alert(1)>"
    "javascript:alert(document.cookie)"
)
for xss in "${XSS_PAYLOADS[@]}"; do
    RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d "{\"name\":\"$xss\",\"email\":\"test@test.com\"}" \
        "$API/api/register")
    if echo "$RESPONSE" | grep -qF "$xss"; then
        critical "XSS payload accepted: $xss"
    fi
done
pass "XSS payloads sanitized"

info "Attempting command injection..."
CMD_PAYLOADS=(
    "; ls -la"
    "| cat /etc/passwd"
    "\$(whoami)"
    "\`id\`"
)
for cmd in "${CMD_PAYLOADS[@]}"; do
    RESPONSE=$(curl -s -H "Host: $HOST" "$API/api/tickets/download?file=ticket${cmd}.pdf")
    if echo "$RESPONSE" | grep -qiE "root|bin|usr|total |drwx"; then
        critical "Command injection successful!"
    fi
done
pass "Command injection prevented"

# ============================================================================
# ATTACK SCENARIO 6: Business Logic Exploitation
# ============================================================================
echo -e "\n[ATTACK SCENARIO 6] Business Logic Exploitation"
echo "=========================================="

info "Attempting race condition to book same seat multiple times..."
# Create 10 concurrent booking attempts for the same seat
SEAT_TARGET=999
for i in {1..10}; do
    (curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
        -d "{\"event_id\":1,\"seat_ids\":[$SEAT_TARGET],\"session_id\":\"race-$i\"}" \
        "$API/api/seats/hold" > "/tmp/race-result-$i.json") &
done
wait
SUCCESSES=$(grep -l "success" /tmp/race-result-*.json 2>/dev/null | wc -l)
rm -f /tmp/race-result-*.json
if [ "$SUCCESSES" -gt 1 ]; then
    critical "Race condition: $SUCCESSES concurrent bookings succeeded!"
else
    pass "Race condition protection working ($SUCCESSES succeeded)"
fi

info "Attempting to hold expired reservation..."
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"hold_token":"expired-token","session_id":"old-session"}' \
    "$API/api/seats/confirm")
if echo "$RESPONSE" | grep -qiE "success|confirmed"; then
    critical "Expired reservation can be confirmed!"
else
    pass "Expired reservation confirmation prevented"
fi

info "Attempting negative quantity order..."
RESPONSE=$(curl -s -X POST -H "Host: $HOST" -H "Content-Type: application/json" \
    -d '{"event_id":1,"seat_ids":[],"quantity":-5}' \
    "$API/api/seats/hold")
if echo "$RESPONSE" | grep -qiE "success|credit"; then
    critical "Negative quantity accepted!"
else
    pass "Negative quantity rejected"
fi

# ============================================================================
# ATTACK SCENARIO 7: Authentication Bypass
# ============================================================================
echo -e "\n[ATTACK SCENARIO 7] Authentication Bypass Attempts"
echo "=========================================="

info "Attempting to access admin panel without authentication..."
ENDPOINTS=(
    "/api/admin/orders"
    "/api/admin/admins"
    "/api/admin/events"
    "/api/admin/dashboard/overview"
)
BYPASS=false
for endpoint in "${ENDPOINTS[@]}"; do
    RESPONSE=$(curl -s -H "Host: $HOST" "$API$endpoint")
    if ! echo "$RESPONSE" | grep -qiE "401|403|unauthorized|unauthenticated"; then
        critical "Authentication bypass on $endpoint"
        BYPASS=true
    fi
done
[ "$BYPASS" = false ] && pass "All admin endpoints require authentication"

info "Attempting JWT 'none' algorithm attack..."
NONE_TOKEN="eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0."
RESPONSE=$(curl -s -H "Host: $HOST" -H "Authorization: Bearer $NONE_TOKEN" "$API/api/admin/me")
if echo "$RESPONSE" | grep -qE "id|email"; then
    critical "'none' algorithm JWT accepted!"
else
    pass "JWT 'none' algorithm attack prevented"
fi

info "Attempting header injection for auth bypass..."
RESPONSE=$(curl -s -H "Host: $HOST" -H "X-Forwarded-User: admin" \
    -H "X-Original-User: admin" "$API/api/admin/orders")
if ! echo "$RESPONSE" | grep -qiE "401|403|unauthorized"; then
    critical "Header injection bypassed authentication!"
else
    pass "Header injection authentication bypass prevented"
fi

# ============================================================================
# SUMMARY
# ============================================================================
echo -e "\n======================================"
echo "Penetration Test Results"
echo "======================================"
echo -e "${GREEN}Defended: $PASS${NC}"
echo -e "${RED}Vulnerable: $FAIL${NC}"
echo -e "${MAGENTA}Critical: $CRITICAL${NC}"
echo "======================================"

TOTAL_ISSUES=$((FAIL + CRITICAL))
if [ $CRITICAL -gt 0 ]; then
    echo -e "${MAGENTA}⚠️  CRITICAL VULNERABILITIES FOUND!${NC}"
    echo "Immediate action required to patch $CRITICAL critical issues"
    exit 2
elif [ $FAIL -gt 0 ]; then
    echo -e "${RED}⚠️  Security vulnerabilities detected${NC}"
    echo "$FAIL vulnerabilities should be addressed"
    exit 1
else
    echo -e "${GREEN}✓ System defended against all tested attacks${NC}"
    exit 0
fi