scan-unauth-gateways.ts

#!/usr/bin/env bun
/**
 * Scanner for Clawdbot gateways missing authentication
 * Usage: bun scripts/scan-unauth-gateways.ts <shodan-json-file> [--concurrency=N]
 */

import { readFileSync, writeFileSync } from "node:fs";

const TIMEOUT_MS = 5000;
const DEFAULT_CONCURRENCY = 20;

type Target = { ip: string; port: number };
type ScanResult = {
  ip: string;
  port: number;
  status: "no_auth" | "auth_required" | "not_clawdbot" | "error" | "timeout";
  details?: string;
  responseTime?: number;
};

function parseArgs() {
  const args = process.argv.slice(2);
  let file = "";
  let concurrency = DEFAULT_CONCURRENCY;

  for (const arg of args) {
    if (arg.startsWith("--concurrency=")) {
      concurrency = parseInt(arg.split("=")[1], 10) || DEFAULT_CONCURRENCY;
    } else if (!arg.startsWith("-")) {
      file = arg;
    }
  }

  if (!file) {
    console.error("Usage: bun scripts/scan-unauth-gateways.ts <shodan-json-file> [--concurrency=N]");
    process.exit(1);
  }

  return { file, concurrency };
}

function extractTargets(filePath: string): Target[] {
  const content = readFileSync(filePath, "utf-8");
  const seen = new Set<string>();
  const targets: Target[] = [];

  for (const line of content.split("\n")) {
    if (!line.trim()) continue;

    // Try plain text format first: "ip:port"
    const textMatch = line.trim().match(/^(\d+\.\d+\.\d+\.\d+):(\d+)$/);
    if (textMatch) {
      const [, ip, portStr] = textMatch;
      const port = parseInt(portStr, 10);
      const key = `${ip}:${port}`;
      if (!seen.has(key)) {
        seen.add(key);
        targets.push({ ip, port });
      }
      continue;
    }

    // Try JSON format (Shodan)
    try {
      const entry = JSON.parse(line);

      // Check for mDNS Clawdbot discovery format
      if (entry.mdns?.services) {
        const serviceKeys = Object.keys(entry.mdns.services);
        const clawdbotService = serviceKeys.find((k) => k.includes("clawdbot"));
        if (clawdbotService && entry.ip_str) {
          // Extract port from service key like "18789/tcp clawdbot-gw"
          const portMatch = clawdbotService.match(/^(\d+)/);
          const port = portMatch ? parseInt(portMatch[1], 10) : 18789;
          const key = `${entry.ip_str}:${port}`;
          if (!seen.has(key)) {
            seen.add(key);
            targets.push({ ip: entry.ip_str, port });
          }
          continue;
        }
      }

      // Standard Shodan format
      const ip = entry.ip_str;
      const port = entry.port;
      if (ip && port) {
        const key = `${ip}:${port}`;
        if (!seen.has(key)) {
          seen.add(key);
          targets.push({ ip, port });
        }
      }
    } catch {
      // skip malformed lines
    }
  }

  return targets;
}

async function checkTarget(target: Target): Promise<ScanResult> {
  const { ip, port } = target;
  const url = `http://${ip}:${port}/tools/invoke`;
  const start = Date.now();

  try {
    const controller = new AbortController();
    const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);

    const response = await fetch(url, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ tool: "gateway" }),
      signal: controller.signal,
    });

    clearTimeout(timeout);
    const responseTime = Date.now() - start;
    const text = await response.text();

    // 401 = auth required (properly configured)
    if (response.status === 401) {
      return { ip, port, status: "auth_required", responseTime };
    }

    // 404 with specific error = no auth, tool not found (VULNERABLE)
    if (response.status === 404) {
      try {
        const json = JSON.parse(text);
        if (json.error?.type === "not_found" || json.error?.message?.includes("Tool not available")) {
          return {
            ip,
            port,
            status: "no_auth",
            details: "Gateway accessible without authentication",
            responseTime,
          };
        }
      } catch {}
    }

    // 200 with ok:true = tool executed (VULNERABLE)
    if (response.status === 200) {
      try {
        const json = JSON.parse(text);
        if (json.ok === true) {
          return {
            ip,
            port,
            status: "no_auth",
            details: `Tool executed successfully: ${JSON.stringify(json.result).slice(0, 100)}`,
            responseTime,
          };
        }
      } catch {}
    }

    // 400 with tool error = no auth (VULNERABLE)
    if (response.status === 400) {
      try {
        const json = JSON.parse(text);
        if (json.error?.type === "tool_error") {
          return {
            ip,
            port,
            status: "no_auth",
            details: "Gateway accessible without authentication (tool error)",
            responseTime,
          };
        }
      } catch {}
    }

    // Check if it looks like a Clawdbot gateway at all
    const looksLikeClawdbot =
      text.includes("clawdbot") ||
      text.includes("Clawdbot") ||
      text.includes("tool") ||
      response.headers.get("content-type")?.includes("application/json");

    if (!looksLikeClawdbot) {
      return { ip, port, status: "not_clawdbot", details: `HTTP ${response.status}`, responseTime };
    }

    return {
      ip,
      port,
      status: "error",
      details: `Unexpected response: HTTP ${response.status}`,
      responseTime,
    };
  } catch (err) {
    const responseTime = Date.now() - start;
    if (err instanceof Error) {
      if (err.name === "AbortError" || err.message.includes("abort")) {
        return { ip, port, status: "timeout", responseTime };
      }
      return { ip, port, status: "error", details: err.message, responseTime };
    }
    return { ip, port, status: "error", details: String(err), responseTime };
  }
}

async function runBatch<T, R>(
  items: T[],
  concurrency: number,
  fn: (item: T) => Promise<R>,
  onProgress?: (completed: number, total: number) => void
): Promise<R[]> {
  const results: R[] = [];
  let index = 0;
  let completed = 0;

  async function worker() {
    while (index < items.length) {
      const currentIndex = index++;
      const result = await fn(items[currentIndex]);
      results[currentIndex] = result;
      completed++;
      onProgress?.(completed, items.length);
    }
  }

  const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => worker());
  await Promise.all(workers);
  return results;
}

async function main() {
  const { file, concurrency } = parseArgs();

  console.log(`Loading targets from ${file}...`);
  const targets = extractTargets(file);
  console.log(`Found ${targets.length} unique IP:port combinations`);
  console.log(`Scanning with concurrency=${concurrency}, timeout=${TIMEOUT_MS}ms\n`);

  const startTime = Date.now();
  let lastPrint = 0;

  const results = await runBatch(targets, concurrency, checkTarget, (completed, total) => {
    const now = Date.now();
    if (now - lastPrint > 1000 || completed === total) {
      const pct = ((completed / total) * 100).toFixed(1);
      const elapsed = ((now - startTime) / 1000).toFixed(1);
      process.stdout.write(`\rProgress: ${completed}/${total} (${pct}%) - ${elapsed}s elapsed`);
      lastPrint = now;
    }
  });

  console.log("\n\n");

  // Summarize results
  const noAuth = results.filter((r) => r.status === "no_auth");
  const authRequired = results.filter((r) => r.status === "auth_required");
  const notClawdbot = results.filter((r) => r.status === "not_clawdbot");
  const errors = results.filter((r) => r.status === "error");
  const timeouts = results.filter((r) => r.status === "timeout");

  console.log("=== SCAN RESULTS ===\n");
  console.log(`Total scanned:     ${results.length}`);
  console.log(`No auth (VULN):    ${noAuth.length}`);
  console.log(`Auth required:     ${authRequired.length}`);
  console.log(`Not Clawdbot:      ${notClawdbot.length}`);
  console.log(`Errors:            ${errors.length}`);
  console.log(`Timeouts:          ${timeouts.length}`);

  if (noAuth.length > 0) {
    console.log("\n=== VULNERABLE GATEWAYS (NO AUTH) ===\n");
    for (const r of noAuth) {
      console.log(`  http://${r.ip}:${r.port}/`);
      if (r.details) console.log(`    ${r.details}`);
    }
  }

  // Write results to file
  const outputFile = file.replace(/\.json$/, "") + "-scan-results.json";
  writeFileSync(
    outputFile,
    JSON.stringify(
      {
        scanTime: new Date().toISOString(),
        summary: {
          total: results.length,
          noAuth: noAuth.length,
          authRequired: authRequired.length,
          notClawdbot: notClawdbot.length,
          errors: errors.length,
          timeouts: timeouts.length,
        },
        vulnerable: noAuth,
        allResults: results,
      },
      null,
      2
    )
  );
  console.log(`\nResults written to: ${outputFile}`);
}

main().catch(console.error);