|
| 1 | +package api |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/base64" |
| 5 | + "encoding/json" |
| 6 | + "fmt" |
| 7 | + "net/http" |
| 8 | + "os" |
| 9 | + "strconv" |
| 10 | + "strings" |
| 11 | + "sync" |
| 12 | + "time" |
| 13 | + |
| 14 | + "github.com/h0tak88r/AutoAR/internal/db" |
| 15 | + "github.com/h0tak88r/AutoAR/internal/logger" |
| 16 | + "github.com/h0tak88r/AutoAR/internal/utils" |
| 17 | +) |
| 18 | + |
| 19 | +// ─── Bug-bounty scope-change monitor ──────────────────────────────────────────── |
| 20 | +// A slow rolling sweep over every program that fires a Discord (MONITOR_WEBHOOK_URL) |
| 21 | +// alert whenever a NEW in-scope asset appears. It deliberately spaces requests |
| 22 | +// (default 3s between programs) so polling ~1000+ programs doesn't trip the |
| 23 | +// platforms' API rate limits — a full sweep takes ~an hour, which is fine for |
| 24 | +// catching new assets. A fetch that returns no assets (rate-limited / transient) |
| 25 | +// is skipped, never baselined, so it can't produce a false "all assets are new" flood. |
| 26 | + |
| 27 | +var ( |
| 28 | + progMonRunning bool |
| 29 | + progMonMu sync.Mutex |
| 30 | + progMonStop chan struct{} |
| 31 | +) |
| 32 | + |
| 33 | +// StartProgramMonitor launches the scope-change monitor if a webhook is configured |
| 34 | +// and it isn't explicitly disabled. Safe to call once at startup. |
| 35 | +func StartProgramMonitor() { |
| 36 | + if strings.TrimSpace(os.Getenv("MONITOR_WEBHOOK_URL")) == "" { |
| 37 | + return // nowhere to send alerts |
| 38 | + } |
| 39 | + if strings.EqualFold(strings.TrimSpace(os.Getenv("PROGRAM_MONITOR")), "off") { |
| 40 | + return |
| 41 | + } |
| 42 | + progMonMu.Lock() |
| 43 | + if progMonRunning { |
| 44 | + progMonMu.Unlock() |
| 45 | + return |
| 46 | + } |
| 47 | + progMonRunning = true |
| 48 | + progMonStop = make(chan struct{}) |
| 49 | + stop := progMonStop |
| 50 | + progMonMu.Unlock() |
| 51 | + |
| 52 | + // Pass the stop channel by value so the goroutine never races on the package var. |
| 53 | + go runProgramMonitorLoop(stop) |
| 54 | +} |
| 55 | + |
| 56 | +// StopProgramMonitor signals the monitor to stop. |
| 57 | +func StopProgramMonitor() { |
| 58 | + progMonMu.Lock() |
| 59 | + defer progMonMu.Unlock() |
| 60 | + if !progMonRunning { |
| 61 | + return |
| 62 | + } |
| 63 | + close(progMonStop) |
| 64 | + progMonRunning = false |
| 65 | +} |
| 66 | + |
| 67 | +func programMonitorSpacing() time.Duration { |
| 68 | + ms := 3000 |
| 69 | + if v := strings.TrimSpace(os.Getenv("PROGRAM_MONITOR_SPACING_MS")); v != "" { |
| 70 | + if n, err := strconv.Atoi(v); err == nil && n >= 500 { |
| 71 | + ms = n |
| 72 | + } |
| 73 | + } |
| 74 | + return time.Duration(ms) * time.Millisecond |
| 75 | +} |
| 76 | + |
| 77 | +func runProgramMonitorLoop(stop chan struct{}) { |
| 78 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] started (spacing %s) — alerting new in-scope assets to MONITOR_WEBHOOK_URL", programMonitorSpacing()) |
| 79 | + for { |
| 80 | + programs := collectProgramsForMonitor() |
| 81 | + if len(programs) == 0 { |
| 82 | + if progMonSleep(5*time.Minute, stop) { |
| 83 | + return |
| 84 | + } |
| 85 | + continue |
| 86 | + } |
| 87 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] sweeping %d program(s)", len(programs)) |
| 88 | + for _, p := range programs { |
| 89 | + select { |
| 90 | + case <-stop: |
| 91 | + return |
| 92 | + default: |
| 93 | + } |
| 94 | + sweepProgram(p) |
| 95 | + if progMonSleep(programMonitorSpacing(), stop) { |
| 96 | + return |
| 97 | + } |
| 98 | + } |
| 99 | + // Brief pause between full sweeps. |
| 100 | + if progMonSleep(2*time.Minute, stop) { |
| 101 | + return |
| 102 | + } |
| 103 | + } |
| 104 | +} |
| 105 | + |
| 106 | +// progMonSleep waits d or returns true if the monitor was asked to stop. |
| 107 | +func progMonSleep(d time.Duration, stop chan struct{}) bool { |
| 108 | + select { |
| 109 | + case <-stop: |
| 110 | + return true |
| 111 | + case <-time.After(d): |
| 112 | + return false |
| 113 | + } |
| 114 | +} |
| 115 | + |
| 116 | +// collectProgramsForMonitor fetches the program list (without scope — cheap) for every |
| 117 | +// configured platform. PROGRAM_MONITOR_PLATFORMS (csv of h1,bc,it) narrows it; empty = all. |
| 118 | +func collectProgramsForMonitor() []ProgramSummary { |
| 119 | + platforms := strings.ToLower(strings.TrimSpace(os.Getenv("PROGRAM_MONITOR_PLATFORMS"))) |
| 120 | + want := func(pl string) bool { return platforms == "" || strings.Contains(platforms, pl) } |
| 121 | + |
| 122 | + var all []ProgramSummary |
| 123 | + if want("h1") && os.Getenv("H1_USERNAME") != "" && os.Getenv("H1_TOKEN") != "" { |
| 124 | + if progs, err := fetchH1Programs(false, false); err == nil { |
| 125 | + all = append(all, progs...) |
| 126 | + } else { |
| 127 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] H1 list fetch failed: %v", err) |
| 128 | + } |
| 129 | + } |
| 130 | + if want("bc") && os.Getenv("BUGCROWD_TOKEN") != "" { |
| 131 | + if progs, err := fetchBCPrograms(false, false); err == nil { |
| 132 | + all = append(all, progs...) |
| 133 | + } |
| 134 | + } |
| 135 | + if want("it") && intigritiToken() != "" { |
| 136 | + if progs, err := fetchITPrograms(false, false); err == nil { |
| 137 | + all = append(all, progs...) |
| 138 | + } |
| 139 | + } |
| 140 | + return all |
| 141 | +} |
| 142 | + |
| 143 | +// sweepProgram fetches one program's current in-scope assets and alerts on new ones. |
| 144 | +func sweepProgram(p ProgramSummary) { |
| 145 | + assets := fetchProgramAssets(p) |
| 146 | + if len(assets) == 0 { |
| 147 | + // Failed / rate-limited / genuinely empty — skip. Never baseline an empty result, |
| 148 | + // otherwise the next successful fetch would report every asset as "new". |
| 149 | + return |
| 150 | + } |
| 151 | + key := programScopeCacheKey(p.Platform, p.Handle) |
| 152 | + newAssets, firstRun, err := db.RecordProgramScopeAssets(key, assets) |
| 153 | + if err != nil { |
| 154 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] record failed for %s: %v", key, err) |
| 155 | + return |
| 156 | + } |
| 157 | + if firstRun || len(newAssets) == 0 { |
| 158 | + return // baseline run, or nothing new |
| 159 | + } |
| 160 | + alertNewAssets(p, newAssets) |
| 161 | +} |
| 162 | + |
| 163 | +// fetchProgramAssets returns the current in-scope asset identifiers for a program, |
| 164 | +// reusing the existing per-platform scope fetchers. Empty on failure. |
| 165 | +func fetchProgramAssets(p ProgramSummary) []string { |
| 166 | + switch strings.ToLower(p.Platform) { |
| 167 | + case "h1", "hackerone": |
| 168 | + auth := h1BasicAuth() |
| 169 | + if auth == "" { |
| 170 | + return nil |
| 171 | + } |
| 172 | + summary, ok := fetchH1ScopeSummary(p.Handle, auth) |
| 173 | + if !ok { |
| 174 | + return nil |
| 175 | + } |
| 176 | + return summary.Assets |
| 177 | + case "bc", "bugcrowd": |
| 178 | + token := os.Getenv("BUGCROWD_TOKEN") |
| 179 | + if token == "" { |
| 180 | + return nil |
| 181 | + } |
| 182 | + return fetchBCScopeSummary(p.Handle, p.URL, token).Assets |
| 183 | + case "it", "intigriti": |
| 184 | + token := intigritiToken() |
| 185 | + if token == "" { |
| 186 | + return nil |
| 187 | + } |
| 188 | + client := &http.Client{Timeout: 20 * time.Second} |
| 189 | + return fetchITScopeSummary(client, token, p.ID).Assets |
| 190 | + } |
| 191 | + return nil |
| 192 | +} |
| 193 | + |
| 194 | +func h1BasicAuth() string { |
| 195 | + u, t := os.Getenv("H1_USERNAME"), os.Getenv("H1_TOKEN") |
| 196 | + if u == "" || t == "" { |
| 197 | + return "" |
| 198 | + } |
| 199 | + return base64.StdEncoding.EncodeToString([]byte(u + ":" + t)) |
| 200 | +} |
| 201 | + |
| 202 | +// alertNewAssets posts a Discord message and records a dashboard change row. |
| 203 | +func alertNewAssets(p ProgramSummary, newAssets []string) { |
| 204 | + name := p.Name |
| 205 | + if name == "" { |
| 206 | + name = p.Handle |
| 207 | + } |
| 208 | + plural := "" |
| 209 | + if len(newAssets) != 1 { |
| 210 | + plural = "s" |
| 211 | + } |
| 212 | + var sb strings.Builder |
| 213 | + fmt.Fprintf(&sb, "🆕 **%d new in-scope asset%s** — %s `%s` (%s)\n", |
| 214 | + len(newAssets), plural, name, p.Handle, strings.ToUpper(p.Platform)) |
| 215 | + const maxList = 20 |
| 216 | + for i, a := range newAssets { |
| 217 | + if i >= maxList { |
| 218 | + fmt.Fprintf(&sb, " • …and %d more\n", len(newAssets)-maxList) |
| 219 | + break |
| 220 | + } |
| 221 | + fmt.Fprintf(&sb, " • `%s`\n", a) |
| 222 | + } |
| 223 | + if p.URL != "" { |
| 224 | + fmt.Fprintf(&sb, "%s\n", p.URL) |
| 225 | + } |
| 226 | + utils.SendMonitorWebhook(sb.String()) |
| 227 | + |
| 228 | + detail, _ := json.Marshal(map[string]any{ |
| 229 | + "program": p.Handle, |
| 230 | + "platform": p.Platform, |
| 231 | + "name": name, |
| 232 | + "url": p.URL, |
| 233 | + "assets": newAssets, |
| 234 | + }) |
| 235 | + if err := db.InsertMonitorChange(&db.MonitorChange{ |
| 236 | + TargetType: "program", |
| 237 | + Domain: p.Handle, |
| 238 | + ChangeType: "new_program_asset", |
| 239 | + Detail: string(detail), |
| 240 | + Notified: true, |
| 241 | + }); err != nil { |
| 242 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] failed to persist change for %s: %v", p.Handle, err) |
| 243 | + } |
| 244 | + logger.GetLogger().Infof("[PROGRAM-MONITOR] %s (%s): %d new asset(s) alerted", p.Handle, p.Platform, len(newAssets)) |
| 245 | +} |
0 commit comments