feat: Integrate gospider as a new module, add Cloudflare Tunnel checks, and introduce new gobot commands for SSRF bypass, fuzzing, and AI.

Author: h0tak88r

README.md

@@ -21,6 +21,7 @@ import (
 	"github.com/h0tak88r/AutoAR/internal/modules/depconfusion"
 	"github.com/h0tak88r/AutoAR/internal/modules/db"
 	"github.com/h0tak88r/AutoAR/internal/modules/dns"
+	cf1016mod "github.com/h0tak88r/AutoAR/internal/modules/cf1016"
 	domainmod "github.com/h0tak88r/AutoAR/internal/modules/domain"
 	"github.com/h0tak88r/AutoAR/internal/modules/fastlook"
 	subdomainmod "github.com/h0tak88r/AutoAR/internal/modules/subdomain"
@@ -3144,6 +3145,20 @@ func handleDNSCommand(args []string) error {
 		return dns.DNSReaper(domain)
 	case "dangling-ip":
 		return dns.DanglingIP(domain)
+	case "cf1016", "cloudflare-1016":
+		result, err := cf1016mod.Run(cf1016mod.Options{
+			Domain:  domain,
+			Threads: 100,
+		})
+		if err != nil {
+			return err
+		}
+		if len(result.Findings) == 0 {
+			fmt.Printf("[cf1016] No Cloudflare 1016 dangling records found for %s\n", domain)
+		} else {
+			fmt.Printf("[cf1016] Found %d dangling record(s). Results: %s\n", len(result.Findings), result.Output)
+		}
+		return nil
 	default:
 		return fmt.Errorf("unknown dns action: %s", sub)
 	}

Wordlists

@@ -0,0 +1,147 @@
+package main
+
+import (
+	"database/sql"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+func esc(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", "''") + "'"
+}
+
+func main() {
+	sqliteDB, err := sql.Open("sqlite", "./bughunt.db?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)")
+	if err != nil {
+		log.Fatalf("Failed to open SQLite: %v", err)
+	}
+	defer sqliteDB.Close()
+
+	f, err := os.Create("supabase_import.sql")
+	if err != nil {
+		log.Fatalf("Failed to create output file: %v", err)
+	}
+	defer f.Close()
+
+	w := func(s string) { f.WriteString(s + "\n") }
+
+	w("-- AutoAR Database Export for Supabase")
+	w(fmt.Sprintf("-- Generated at: %s", time.Now().Format(time.RFC3339)))
+	w("-- Instructions: Paste this into the Supabase SQL Editor and run it.")
+	w("")
+	w("-- Disable triggers for fast import")
+	w("SET session_replication_role = replica;")
+	w("")
+
+	// 1. Domains
+	w("-- DOMAINS TABLE")
+	rows, _ := sqliteDB.Query(`SELECT id, domain, created_at, updated_at FROM domains`)
+	count := 0
+	for rows.Next() {
+		var id int
+		var domain string
+		var created_at, updated_at sql.NullString
+		rows.Scan(&id, &domain, &created_at, &updated_at)
+		ca := "NOW()"; if created_at.Valid { ca = esc(created_at.String) }
+		ua := "NOW()"; if updated_at.Valid { ua = esc(updated_at.String) }
+		w(fmt.Sprintf("INSERT INTO domains (id, domain, created_at, updated_at) VALUES (%d, %s, %s, %s) ON CONFLICT (domain) DO NOTHING;", id, esc(domain), ca, ua))
+		count++
+	}
+	rows.Close()
+	w(fmt.Sprintf("SELECT setval('domains_id_seq', COALESCE((SELECT MAX(id) FROM domains), 1));"))
+	log.Printf("[+] Exported %d domains", count)
+	w("")
+
+	// 2. Subdomains
+	w("-- SUBDOMAINS TABLE")
+	rows, _ = sqliteDB.Query(`SELECT id, domain_id, subdomain, is_live, COALESCE(http_url,''), COALESCE(https_url,''), COALESCE(http_status,0), COALESCE(https_status,0), created_at, updated_at FROM subdomains`)
+	count = 0
+	for rows.Next() {
+		var id, domain_id, is_live, http_status, https_status int
+		var subdomain, http_url, https_url string
+		var created_at, updated_at sql.NullString
+		rows.Scan(&id, &domain_id, &subdomain, &is_live, &http_url, &https_url, &http_status, &https_status, &created_at, &updated_at)
+		ca := "NOW()"; if created_at.Valid { ca = esc(created_at.String) }
+		ua := "NOW()"; if updated_at.Valid { ua = esc(updated_at.String) }
+		isLive := "FALSE"; if is_live != 0 { isLive = "TRUE" }
+		w(fmt.Sprintf("INSERT INTO subdomains (id, domain_id, subdomain, is_live, http_url, https_url, http_status, https_status, created_at, updated_at) VALUES (%d, %d, %s, %s, %s, %s, %d, %d, %s, %s) ON CONFLICT (subdomain) DO NOTHING;", id, domain_id, esc(subdomain), isLive, esc(http_url), esc(https_url), http_status, https_status, ca, ua))
+		count++
+	}
+	rows.Close()
+	w("SELECT setval('subdomains_id_seq', COALESCE((SELECT MAX(id) FROM subdomains), 1));")
+	log.Printf("[+] Exported %d subdomains", count)
+	w("")
+
+	// 3. JS Files
+	w("-- JS_FILES TABLE")
+	rows, _ = sqliteDB.Query(`SELECT id, subdomain_id, js_url, COALESCE(content_hash,''), COALESCE(last_scanned,''), created_at, updated_at FROM js_files`)
+	count = 0
+	for rows.Next() {
+		var id, subdomain_id int
+		var js_url, content_hash, last_scanned string
+		var created_at, updated_at sql.NullString
+		rows.Scan(&id, &subdomain_id, &js_url, &content_hash, &last_scanned, &created_at, &updated_at)
+		ca := "NOW()"; if created_at.Valid { ca = esc(created_at.String) }
+		ua := "NOW()"; if updated_at.Valid { ua = esc(updated_at.String) }
+		ls := "NOW()"; if last_scanned != "" { ls = esc(last_scanned) }
+		w(fmt.Sprintf("INSERT INTO js_files (id, subdomain_id, js_url, content_hash, last_scanned, created_at, updated_at) VALUES (%d, %d, %s, %s, %s, %s, %s) ON CONFLICT (js_url) DO NOTHING;", id, subdomain_id, esc(js_url), esc(content_hash), ls, ca, ua))
+		count++
+	}
+	rows.Close()
+	w("SELECT setval('js_files_id_seq', COALESCE((SELECT MAX(id) FROM js_files), 1));")
+	log.Printf("[+] Exported %d JS files", count)
+	w("")
+
+	// 4. Keyhack Templates
+	w("-- KEYHACK_TEMPLATES TABLE")
+	rows, _ = sqliteDB.Query(`SELECT id, keyname, command_template, COALESCE(method,'GET'), url, COALESCE(header,''), COALESCE(body,''), COALESCE(description,''), COALESCE(notes,''), created_at, updated_at FROM keyhack_templates`)
+	count = 0
+	for rows.Next() {
+		var id int
+		var keyname, command_template, method, url, header, body, description, notes string
+		var created_at, updated_at sql.NullString
+		rows.Scan(&id, &keyname, &command_template, &method, &url, &header, &body, &description, &notes, &created_at, &updated_at)
+		ca := "NOW()"; if created_at.Valid { ca = esc(created_at.String) }
+		ua := "NOW()"; if updated_at.Valid { ua = esc(updated_at.String) }
+		w(fmt.Sprintf("INSERT INTO keyhack_templates (id, keyname, command_template, method, url, header, body, description, notes, created_at, updated_at) VALUES (%d, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s) ON CONFLICT (keyname) DO NOTHING;", id, esc(keyname), esc(command_template), esc(method), esc(url), esc(header), esc(body), esc(description), esc(notes), ca, ua))
+		count++
+	}
+	rows.Close()
+	w("SELECT setval('keyhack_templates_id_seq', COALESCE((SELECT MAX(id) FROM keyhack_templates), 1));")
+	log.Printf("[+] Exported %d keyhack templates", count)
+	w("")
+
+	// 5. Scans
+	w("-- SCANS TABLE")
+	rows, _ = sqliteDB.Query(`SELECT id, scan_id, scan_type, target, status, COALESCE(channel_id,''), COALESCE(thread_id,''), COALESCE(message_id,''), current_phase, total_phases, COALESCE(phase_name,''), COALESCE(started_at,''), COALESCE(completed_at,''), last_update, COALESCE(command,''), created_at, updated_at FROM scans`)
+	count = 0
+	for rows.Next() {
+		var id, current_phase, total_phases int
+		var scan_id, scan_type, target, status, channel_id, thread_id, message_id, phase_name, started_at, completed_at, last_update, command string
+		var created_at, updated_at sql.NullString
+		rows.Scan(&id, &scan_id, &scan_type, &target, &status, &channel_id, &thread_id, &message_id, &current_phase, &total_phases, &phase_name, &started_at, &completed_at, &last_update, &command, &created_at, &updated_at)
+		ca := "NOW()"; if created_at.Valid { ca = esc(created_at.String) }
+		ua := "NOW()"; if updated_at.Valid { ua = esc(updated_at.String) }
+		sa := "NOW()"; if started_at != "" { sa = esc(started_at) }
+		w(fmt.Sprintf("INSERT INTO scans (id, scan_id, scan_type, target, status, channel_id, thread_id, message_id, current_phase, total_phases, phase_name, started_at, last_update, command, created_at, updated_at) VALUES (%d, %s, %s, %s, %s, %s, %s, %s, %d, %d, %s, %s, %s, %s, %s, %s) ON CONFLICT (scan_id) DO NOTHING;",
+			id, esc(scan_id), esc(scan_type), esc(target), esc(status), esc(channel_id), esc(thread_id), esc(message_id), current_phase, total_phases, esc(phase_name), sa, esc(last_update), esc(command), ca, ua))
+		count++
+	}
+	rows.Close()
+	w("SELECT setval('scans_id_seq', COALESCE((SELECT MAX(id) FROM scans), 1));")
+	log.Printf("[+] Exported %d scans", count)
+	w("")
+
+	w("-- Re-enable triggers")
+	w("SET session_replication_role = DEFAULT;")
+	w("")
+	w("-- Done!")
+
+	log.Printf("[SUCCESS] SQL export written to: supabase_import.sql")
+	log.Printf("Now: 1) Open Supabase SQL Editor  2) Paste the file contents  3) Click Run")
+}

cmd/autoar/main.go

@@ -0,0 +1,219 @@
+package main
+
+import (
+	"bytes"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+var (
+	SupabaseURL = os.Getenv("SUPABASE_URL")
+	SupabaseKey = os.Getenv("SUPABASE_KEY")
+)
+
+func postChunk(table string, records []map[string]interface{}) error {
+	if len(records) == 0 {
+		return nil
+	}
+
+	url := fmt.Sprintf("%s/rest/v1/%s", SupabaseURL, table)
+	
+	jsonData, err := json.Marshal(records)
+	if err != nil {
+		return fmt.Errorf("failed to marshal JSON: %v", err)
+	}
+
+	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("failed to create request: %v", err)
+	}
+
+	req.Header.Set("apikey", SupabaseKey)
+	req.Header.Set("Authorization", "Bearer "+SupabaseKey)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Prefer", "resolution=merge-duplicates")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		bodyBytes, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("API error (status %d): %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	return nil
+}
+
+func nullStr(ns sql.NullString) interface{} {
+	if ns.Valid && ns.String != "" {
+		return ns.String
+	}
+	return nil
+}
+
+func nullInt(ni sql.NullInt64) interface{} {
+	if ni.Valid {
+		return ni.Int64
+	}
+	return nil
+}
+
+func main() {
+	if SupabaseURL == "" || SupabaseKey == "" {
+		log.Fatal("ERROR: Please set SUPABASE_URL and SUPABASE_KEY (service_role tier) environment variables.")
+	}
+
+	sqliteDB, err := sql.Open("sqlite", "./bughunt.db?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)")
+	if err != nil {
+		log.Fatalf("Failed to open SQLite: %v", err)
+	}
+	defer sqliteDB.Close()
+
+	const batchSize = 1000
+
+	// 1. DOMAINS (Skip, likely already migrated)
+	// But let's re-run it since merge-duplicates handles it.
+	fmt.Println("[*] Migrating domains...")
+	rows, _ := sqliteDB.Query(`SELECT id, domain, created_at, updated_at FROM domains`)
+	var domainBatch []map[string]interface{}
+	totalDomains := 0
+
+	for rows.Next() {
+		var id int
+		var domain string
+		var ca, ua sql.NullString
+		rows.Scan(&id, &domain, &ca, &ua)
+
+		domainBatch = append(domainBatch, map[string]interface{}{
+			"id":         id,
+			"domain":     domain,
+			"created_at": nullStr(ca),
+			"updated_at": nullStr(ua),
+		})
+		
+		if len(domainBatch) >= batchSize {
+			if err := postChunk("domains", domainBatch); err != nil {
+				log.Fatalf("Failed to post domain chunk: %v", err)
+			}
+			totalDomains += len(domainBatch)
+			domainBatch = nil
+		}
+	}
+	if len(domainBatch) > 0 {
+		if err := postChunk("domains", domainBatch); err != nil {
+			log.Fatalf("Failed to post final domain chunk: %v", err)
+		}
+		totalDomains += len(domainBatch)
+	}
+	rows.Close()
+	fmt.Printf("[+] Uploaded %d domains\n", totalDomains)
+
+	// 2. SUBDOMAINS
+	fmt.Println("[*] Migrating subdomains (batching 1000 at a time)...")
+	rows, _ = sqliteDB.Query(`SELECT id, domain_id, subdomain, is_live, http_url, https_url, http_status, https_status, created_at, updated_at FROM subdomains`)
+	var subBatch []map[string]interface{}
+	totalSubs := 0
+
+	for rows.Next() {
+		var id, domain_id, is_live int
+		var http_status, https_status sql.NullInt64
+		var subdomain string
+		var ca, ua, h_url, hs_url sql.NullString
+		
+		rows.Scan(&id, &domain_id, &subdomain, &is_live, &h_url, &hs_url, &http_status, &https_status, &ca, &ua)
+
+		subBatch = append(subBatch, map[string]interface{}{
+			"id":           id,
+			"domain_id":    domain_id,
+			"subdomain":    subdomain,
+			"is_live":      is_live != 0,
+			"http_url":     nullStr(h_url),
+			"https_url":    nullStr(hs_url),
+			"http_status":  nullInt(http_status),
+			"https_status": nullInt(https_status),
+			"created_at":   nullStr(ca),
+			"updated_at":   nullStr(ua),
+		})
+		
+		if len(subBatch) >= batchSize {
+			if err := postChunk("subdomains", subBatch); err != nil {
+				log.Fatalf("Failed to post subdomain chunk: %v", err)
+			}
+			totalSubs += len(subBatch)
+			fmt.Printf("    ... pushed %d subdomains\n", totalSubs)
+			subBatch = nil
+		}
+	}
+	if len(subBatch) > 0 {
+		if err := postChunk("subdomains", subBatch); err != nil {
+			log.Fatalf("Failed to post final subdomain chunk: %v", err)
+		}
+		totalSubs += len(subBatch)
+	}
+	rows.Close()
+	fmt.Printf("[+] Uploaded %d subdomains\n", totalSubs)
+
+	// 3. SCANS
+	fmt.Println("[*] Migrating scans...")
+	rows, _ = sqliteDB.Query(`SELECT id, scan_id, scan_type, target, status, channel_id, thread_id, message_id, current_phase, total_phases, phase_name, started_at, completed_at, last_update, command, created_at, updated_at FROM scans`)
+	var scanBatch []map[string]interface{}
+	totalScans := 0
+
+	for rows.Next() {
+		var id, cp, tp int
+		var sid, stype, tar, stat, lu string
+		var cid, tid, mid, pname, sa, ca_at, cmd, ca, ua sql.NullString
+		
+		rows.Scan(&id, &sid, &stype, &tar, &stat, &cid, &tid, &mid, &cp, &tp, &pname, &sa, &ca_at, &lu, &cmd, &ca, &ua)
+
+		scanBatch = append(scanBatch, map[string]interface{}{
+			"id":             id,
+			"scan_id":        sid,
+			"scan_type":      stype,
+			"target":         tar,
+			"status":         stat,
+			"current_phase":  cp,
+			"total_phases":   tp,
+			"last_update":    lu,
+			"channel_id":     nullStr(cid),
+			"thread_id":      nullStr(tid),
+			"message_id":     nullStr(mid),
+			"phase_name":     nullStr(pname),
+			"started_at":     nullStr(sa),
+			"completed_at":   nullStr(ca_at),
+			"command":        nullStr(cmd),
+			"created_at":     nullStr(ca),
+			"updated_at":     nullStr(ua),
+		})
+		
+		if len(scanBatch) >= batchSize {
+			if err := postChunk("scans", scanBatch); err != nil {
+				log.Fatalf("Failed to post scan chunk: %v", err)
+			}
+			totalScans += len(scanBatch)
+			scanBatch = nil
+		}
+	}
+	if len(scanBatch) > 0 {
+		if err := postChunk("scans", scanBatch); err != nil {
+			log.Fatalf("Failed to post final scan chunk: %v", err)
+		}
+		totalScans += len(scanBatch)
+	}
+	rows.Close()
+	fmt.Printf("[+] Uploaded %d scans\n", totalScans)
+
+	fmt.Println("\n[SUCCESS] REST API Migration completed successfully!")
+}