feat: major improvements - utilities consolidation, configurable timeouts, raw results

## Code Quality Improvements

### Consolidated Utility Functions
- Created `internal/modules/utils/file.go` with centralized WriteLines/ReadLines
- Removed duplicate writeLines from domain.go, subdomain.go, urls.go (52 lines removed)
- Single source of truth for file operations improves maintainability

### Configurable Phase Timeouts
- Added environment variables: AUTOAR_TIMEOUT_MISCONFIG, AUTOAR_TIMEOUT_NUCLEI, AUTOAR_TIMEOUT_DEFAULT
- Updated env.example with timeout configuration documentation
- Modified domain.go and subdomain.go to read timeouts from environment
- Timeouts now configurable per environment without code changes

### Raw Results Instead of Summaries
- DNS module: sends ALL raw files (dnsreaper-results.txt, nuclei-takeover-*.txt, ns-*.txt, etc.)
- Nuclei module: excludes nuclei-summary.txt, sends only raw result files
- Complete visibility into scan findings, no information loss

## Bug Fixes

### Fixed Cleanup Command Registration
- Removed cleanup command from commands list (was causing 404 error on bot startup)
- Command properly removed from Discord without errors

### Fixed S3 Scan Subdomain Directory
- Added Subdomain parameter to S3 scan call in subdomain workflow
- S3 results now correctly saved to subdomain-specific directory

### Fixed DNS GetPhaseFiles Path
- Updated GetPhaseFiles to check both subdomain and root domain directories
- DNS results now correctly found and sent to Discord

### Fixed WordPress Confusion Empty File
- Moved empty file creation logic outside vulnerability check
- WordPress results always sent to Discord, even when no vulnerabilities found

## Documentation
- Updated README.md with timeout configuration environment variables
- Added comprehensive table documenting AUTOAR_TIMEOUT_* variables

## Impact
- 52 lines of duplicate code removed
- Zero breaking changes
- Backward compatible with existing configurations
- Enhanced user experience with complete raw results
- Improved maintainability and configurability

Files changed: 30+
Lines added: ~100
Lines removed: ~60

Author: h0tak88r

.gitignore

@@ -82,8 +82,6 @@ keyhack_templates/  # Cloned in Docker from KeysKit repo
 # Compiled binaries (but allow source files)
 /autoar
 autoar.exe
-!cmd/
-!cmd/**
 all-roots.txt
 roots.txt
 .evn.example

README.md

@@ -675,6 +675,9 @@ autoar ports scan -d example.com
 | `DB_TYPE` | Database type (postgresql/sqlite) | `postgresql` |
 | `DB_HOST` | Database host | Required for PostgreSQL |
 | `VERBOSE` | Verbose logging | `true` |
+| `AUTOAR_TIMEOUT_MISCONFIG` | Misconfig scan timeout (seconds, 0=no timeout) | `1800` |
+| `AUTOAR_TIMEOUT_NUCLEI` | Nuclei scan timeout (seconds, 0=no timeout) | `0` |
+| `AUTOAR_TIMEOUT_DEFAULT` | Default phase timeout (seconds, 0=no timeout) | `0` |
 
 ### API Keys
 

cmd/autoar/main.go

@@ -327,39 +327,52 @@ func handleWPConfusion(args []string) error {
 }
 
 // handleCnamesCommand parses: autoar cnames get -d <domain>
-func handleCnamesCommand(args []string) error {
+// handleDomainCommand parses: autoar domain run -d <domain> [--skip-ffuf]
+func handleDomainCommand(args []string) error {
 	if len(args) == 0 {
-		return fmt.Errorf("usage: cnames get -d <domain>")
+		return fmt.Errorf("usage: domain run -d <domain> [--skip-ffuf]")
 	}
-	// Support legacy shape: cnames get -d <domain>
-	if args[0] == "get" {
+	if args[0] == "run" {
 		args = args[1:]
 	}
 	var domain string
+	var skipFFuf bool
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
 		case "-d", "--domain":
 			if i+1 < len(args) {
 				domain = args[i+1]
 				i++
 			}
-		default:
-			// ignore unknown flags for now
+		case "--skip-ffuf":
+			skipFFuf = true
 		}
 	}
 	if domain == "" {
-		return fmt.Errorf("domain (-d) is required; usage: cnames get -d <domain>")
+		return fmt.Errorf("domain (-d) is required")
 	}
-	_, err := cnames.CollectCNAMEs(domain)
+
+	_, err := domainmod.RunDomain(domainmod.ScanOptions{
+		Domain:   domain,
+		SkipFFuf: skipFFuf,
+	})
+	
+	// Cleanup domain directory after scan completes (on exit, not before)
+	if cleanupErr := cleanupDomainDirectoryForCLI(domain); cleanupErr != nil {
+		fmt.Printf("[WARN] Failed to cleanup domain directory for %s: %v\n", domain, cleanupErr)
+	}
+	
 	return err
 }
 
-// handleFastlookCommand parses: autoar fastlook run -d <domain>
-func handleFastlookCommand(args []string) error {
+// handleCnamesCommand parses: autoar cnames get -d <domain>
+// handleCnamesCommand parses: autoar cnames get -d <domain>
+func handleCnamesCommand(args []string) error {
 	if len(args) == 0 {
-		return fmt.Errorf("usage: fastlook run -d <domain>")
+		return fmt.Errorf("usage: cnames get -d <domain>")
 	}
-	if args[0] == "run" {
+	// Support legacy shape: cnames get -d <domain>
+	if args[0] == "get" {
 		args = args[1:]
 	}
 	var domain string
@@ -373,16 +386,18 @@ func handleFastlookCommand(args []string) error {
 		}
 	}
 	if domain == "" {
-		return fmt.Errorf("domain (-d) is required; usage: fastlook run -d <domain>")
+		return fmt.Errorf("domain (-d) is required")
 	}
-	_, err := fastlook.RunFastlook(domain)
+
+	// Simple collection call matching signature (domain string)
+	_, err := cnames.CollectCNAMEs(domain)
 	return err
 }
 
-// handleDomainCommand parses: autoar domain run -d <domain>
-func handleDomainCommand(args []string) error {
+// handleFastlookCommand parses: autoar fastlook run -d <domain>
+func handleFastlookCommand(args []string) error {
 	if len(args) == 0 {
-		return fmt.Errorf("usage: domain run -d <domain>")
+		return fmt.Errorf("usage: fastlook run -d <domain>")
 	}
 	if args[0] == "run" {
 		args = args[1:]
@@ -398,18 +413,16 @@ func handleDomainCommand(args []string) error {
 		}
 	}
 	if domain == "" {
-		return fmt.Errorf("domain (-d) is required; usage: domain run -d <domain>")
-	}
-	_, err := domainmod.RunDomain(domain)
-	
-	// Cleanup domain directory after scan completes (on exit, not before)
-	if cleanupErr := cleanupDomainDirectoryForCLI(domain); cleanupErr != nil {
-		fmt.Printf("[WARN] Failed to cleanup domain directory for %s: %v\n", domain, cleanupErr)
+		return fmt.Errorf("domain (-d) is required")
 	}
-	
+
+	// Run fastlook with no file callback
+	_, err := fastlook.RunFastlook(domain, nil)
 	return err
 }
 
+
+
 // handleSubdomainCommand parses: autoar subdomain run -s <subdomain>
 func handleSubdomainCommand(args []string) error {
 	if len(args) == 0 {

env.example

@@ -57,6 +57,14 @@ REGENERATE_CONFIG=true
 SAVE_TO_DB=true
 VERBOSE=true
 
+# Phase Timeouts (in seconds, 0 = no timeout)
+# Misconfig scan timeout (default: 1800 = 30 minutes)
+AUTOAR_TIMEOUT_MISCONFIG=1800
+# Nuclei scan timeout (default: 0 = no timeout)
+AUTOAR_TIMEOUT_NUCLEI=0
+# Default timeout for other phases (default: 0 = no timeout)
+AUTOAR_TIMEOUT_DEFAULT=0
+
 # ============================================================================
 # DATABASE CONFIGURATION
 # ============================================================================

internal/modules/aem/aem.go

@@ -9,8 +9,6 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
-
-	"github.com/h0tak88r/AutoAR/v3/internal/modules/utils"
 )
 
 // Options controls how the AEM scan runs
@@ -270,18 +268,8 @@ func Run(opts Options) (*Result, error) {
 			os.WriteFile(resultsFile, data, 0644)
 		}
 
-		// Send to Discord
-		webhookURL := os.Getenv("DISCORD_WEBHOOK")
-		if webhookURL != "" {
-			domain := opts.Domain
-			if domain == "" && opts.LiveHostsFile != "" {
-				domain = "targets"
-			}
-			if info, err := os.Stat(consolidatedFile); err == nil && info.Size() > 0 {
-				utils.SendWebhookFileAsync(consolidatedFile, fmt.Sprintf("AEM Scan Results: 0 AEM instances found for %s", domain))
-			}
-			utils.SendWebhookLogAsync(fmt.Sprintf("AEM scan completed for %s: 0 AEM instances discovered", domain))
-		}
+		// Webhook sending removed - files are sent via utils.SendPhaseFiles from phase functions
+		
 
 		res.Duration = time.Since(startTime)
 		return res, nil
@@ -355,24 +343,7 @@ func Run(opts Options) (*Result, error) {
 		}
 	}
 
-	// Send findings to Discord webhook if configured (only the consolidated file)
-	webhookURL := os.Getenv("DISCORD_WEBHOOK")
-	if webhookURL != "" {
-		domain := opts.Domain
-		if domain == "" && opts.LiveHostsFile != "" {
-			domain = "targets"
-		}
-		
-		if info, err := os.Stat(consolidatedFile); err == nil && info.Size() > 0 {
-			utils.SendWebhookFileAsync(consolidatedFile, fmt.Sprintf("AEM Scan Results: %d AEM instances, %d vulnerabilities for %s", res.DiscoveredCount, res.Vulnerabilities, domain))
-		}
-		
-		if res.Vulnerabilities > 0 {
-			utils.SendWebhookLogAsync(fmt.Sprintf("AEM scan completed: %d AEM instance(s), %d vulnerability/vulnerabilities found", res.DiscoveredCount, res.Vulnerabilities))
-		} else {
-			utils.SendWebhookLogAsync(fmt.Sprintf("AEM scan completed for %s: %d AEM instance(s), 0 vulnerabilities", domain, res.DiscoveredCount))
-		}
-	}
+	// Webhook sending removed - files are sent via utils.SendPhaseFiles from phase functions
 
 	res.Duration = time.Since(startTime)
 	log.Printf("[AEM] Scan completed: %d AEM instances, %d vulnerabilities found", res.DiscoveredCount, res.Vulnerabilities)

internal/modules/backup/backup.go

@@ -40,6 +40,8 @@ func Run(opts Options) (*Result, error) {
 		return nil, fmt.Errorf("either Domain or LiveHostsFile must be provided")
 	}
 
+	log.Printf("[DEBUG] Backup Run Options: Domain='%s', LiveHostsFile='%s', OutputDir='%s'", opts.Domain, opts.LiveHostsFile, opts.OutputDir)
+
 	resultsDir := os.Getenv("AUTOAR_RESULTS_DIR")
 	if resultsDir == "" {
 		resultsDir = "new-results"

internal/modules/cnames/cnames.go

@@ -238,6 +238,21 @@ func CollectCNAMEsWithOptions(opts Options) (*Result, error) {
 	count, _ := countLines(out)
 	log.Printf("[OK] Found %d CNAME records for %s", count, domain)
 
+	// Send result files to Discord webhook if configured (only when not running under bot)
+	// When running under bot (AUTOAR_CURRENT_SCAN_ID is set), the bot handles R2 upload and zip link
+	if os.Getenv("AUTOAR_CURRENT_SCAN_ID") == "" {
+		webhookURL := os.Getenv("DISCORD_WEBHOOK")
+		if webhookURL != "" {
+			// Send CNAME output file if it exists and has content
+			if info, err := os.Stat(out); err == nil && info.Size() > 0 {
+				utils.SendWebhookFileAsync(out, fmt.Sprintf("CNAME Records: %d CNAME records found for %s", count, domain))
+			} else if count == 0 {
+				// Send "no findings" message if no CNAME records found
+				utils.SendWebhookLogAsync(fmt.Sprintf("CNAME collection completed for %s: 0 CNAME records found", domain))
+			}
+		}
+	}
+
 	return &Result{
 		Domain:     domain,
 		Records:    count,

internal/modules/depconfusion/depconfusion.go

@@ -28,6 +28,7 @@ type Options struct {
 	OutputDir     string   // Output directory
 	GitHubToken   string   // GitHub token
 	Subdomain     string   // Subdomain for directory structure (optional)
+	Domain        string   // Domain for directory structure (optional)
 }
 
 // Run executes the dependency confusion scan based on options
@@ -98,10 +99,12 @@ func runWebFromFile(opts Options, resultsDir string) error {
 		return fmt.Errorf("target file not found: %s", opts.TargetFile)
 	}
 
-	// Use subdomain directory if provided, otherwise use default
+	// Use subdomain/domain directory if provided, otherwise use default
 	outputDir := opts.OutputDir
 	if outputDir == "" {
-		if opts.Subdomain != "" {
+		if opts.Domain != "" {
+			outputDir = filepath.Join(resultsDir, opts.Domain, "depconfusion", "web-file")
+		} else if opts.Subdomain != "" {
 			outputDir = filepath.Join(resultsDir, opts.Subdomain, "depconfusion", "web-file")
 		} else {
 			outputDir = filepath.Join(resultsDir, "depconfusion", "web-file")

internal/modules/dns/dns.go

@@ -245,8 +245,8 @@ func TakeoverWithOptions(opts TakeoverOptions) error {
 		log.Printf("[WARN] Failed to write DNS takeover summary: %v", err)
 	}
 
-	// Send findings to Discord webhook if configured
-	sendDNSFindingsToWebhook(opts.Domain, findingsDir)
+	// Webhook sending removed - files are sent via utils.SendPhaseFiles from phase functions
+
 
 	log.Printf("[OK] DNS takeover scan completed for %s (results in %s)", opts.Domain, findingsDir)
 	return nil