🚀 Getting Started with ASM

# Pull and run the ASM toolkit container
docker run -it --rm -v $(pwd)/results:/results \
  asmtoolkit/quickstart:latest

# You're now in a fully configured ASM environment!

# Linux/macOS
wget https://go.dev/dl/go1.21.5.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.5.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
source ~/.bashrc

# macOS with Homebrew
brew install go

# Windows
# Download installer from https://golang.org/dl/

# Subdomain discovery
go install -v github.com/owasp-amass/amass/v4/...@master
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Web service discovery
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

# Port scanning
sudo apt install nmap  # Linux
brew install nmap      # macOS

# Screenshots
go install github.com/sensepost/gowitness@latest

# Verify installations
amass version && subfinder -version && httpx -version && nmap --version

# 🚨 AUTHORIZATION VERIFICATION SCRIPT 🚨
echo "⚠️  AUTHORIZATION CHECK ⚠️"
echo "Do you own or have written permission to scan the target? (y/N)"
read -r auth_response
if [[ ! "$auth_response" =~ ^[Yy]$ ]]; then
    echo "❌ Scan aborted - Authorization required"
    echo "Only scan targets you own or have explicit permission to test"
    exit 1
fi

# Set your target (replace with your authorized domain)
TARGET="scanme.nmap.org"
OUTPUT_DIR="asm_scan_$(date +%Y%m%d_%H%M%S)"

# Validate target format
if [[ ! "$TARGET" =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]$ ]]; then
    echo "❌ Invalid target format: $TARGET"
    exit 1
fi

# Create output directory with error handling
mkdir -p "$OUTPUT_DIR" || { echo "❌ Failed to create directory"; exit 1; }
cd "$OUTPUT_DIR" || { echo "❌ Failed to change directory"; exit 1; }

echo "✅ Authorization verified"
echo "🔍 Starting ASM scan for: $TARGET"
echo "📁 Results will be saved in: $OUTPUT_DIR"

# Step 1: Subdomain Discovery (2-3 minutes)
echo "[1/4] Discovering subdomains (passive reconnaissance)..."

# Check if subfinder is available
if ! command -v subfinder &> /dev/null; then
    echo "❌ subfinder not found. Please install it first:"
    echo "   go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"
    exit 1
fi

# Run subdomain discovery with error handling
subfinder -d "$TARGET" -silent > subdomains.txt || {
    echo "❌ Subdomain discovery failed"
    exit 1
}

SUBDOMAIN_COUNT=$(wc -l < subdomains.txt)
echo "   Found $SUBDOMAIN_COUNT subdomains"

if [[ $SUBDOMAIN_COUNT -eq 0 ]]; then
    echo "⚠️ No subdomains found. This might be normal for some targets."
fi

# Step 2: Live Host Detection (1-2 minutes)
echo "[2/4] Finding live web services (with rate limiting)..."

# Check if httpx is available
if ! command -v httpx &> /dev/null; then
    echo "❌ httpx not found. Please install it first:"
    echo "   go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest"
    exit 1
fi

# Skip if no subdomains found
if [[ ! -s subdomains.txt ]]; then
    echo "⚠️ No subdomains to test - skipping live host detection"
    touch live_hosts.txt
    LIVE_COUNT=0
else
    # Use rate limiting to be respectful
    httpx -l subdomains.txt -silent -status-code -title -rate-limit 10 > live_hosts.txt || {
        echo "❌ Live host detection failed"
        exit 1
    }
    
    LIVE_COUNT=$(wc -l < live_hosts.txt)
    echo "   Found $LIVE_COUNT live hosts"
    
    if [[ $LIVE_COUNT -eq 0 ]]; then
        echo "⚠️ No live hosts found. This might be normal for some targets."
    fi
fi

# Step 3: Port Scanning (2-3 minutes)
echo "[3/4] Scanning for open ports (respectful timing)..."

# Check if nmap is available
if ! command -v nmap &> /dev/null; then
    echo "❌ nmap not found. Please install it first:"
    echo "   sudo apt install nmap  # Linux"
    echo "   brew install nmap      # macOS"
    exit 1
fi

# Skip if no live hosts
if [[ $LIVE_COUNT -eq 0 ]]; then
    echo "⚠️ No live hosts to scan - skipping port scanning"
    touch port_scan.txt
else
    # Warn about port scanning implications
    echo "⚠️ Port scanning can be detected by security systems"
    echo "   Using respectful timing to minimize impact..."
    
    # Use respectful timing (T2 instead of T4)
    nmap -iL <(cut -d' ' -f1 live_hosts.txt) -oN port_scan.txt --top-ports 100 -T2 --max-rate 50 || {
        echo "⚠️ Port scan failed or was interrupted"
        echo "   This might be due to network restrictions or target protection"
        touch port_scan.txt
    }
    
    echo "   Port scan completed"
fi

# Step 4: Screenshots (2-3 minutes)
echo "[4/4] Taking screenshots..."

# Check if gowitness is available
if ! command -v gowitness &> /dev/null; then
    echo "⚠️ gowitness not found. Installing..."
    go install github.com/sensepost/gowitness@latest || {
        echo "❌ Failed to install gowitness. Skipping screenshots."
        mkdir -p screenshots
        SCREENSHOT_COUNT=0
    }
fi

# Skip if no live hosts
if [[ $LIVE_COUNT -eq 0 ]]; then
    echo "⚠️ No live hosts to screenshot"
    mkdir -p screenshots
    SCREENSHOT_COUNT=0
else
    # Create screenshots directory
    mkdir -p screenshots
    
    # Take screenshots with delays to be respectful
    echo "   Taking screenshots with delays (being respectful)..."
    gowitness file -f <(cut -d' ' -f1 live_hosts.txt) --disable-logging --delay 2 || {
        echo "⚠️ Screenshot capture failed or was interrupted"
    }
    
    SCREENSHOT_COUNT=$(ls screenshots/*.png 2>/dev/null | wc -l)
    echo "   Screenshots completed ($SCREENSHOT_COUNT captured)"
fi

echo "✅ ASM scan completed! Results saved in: $OUTPUT_DIR"

# View discovered subdomains
echo "=== SUBDOMAINS DISCOVERED ==="
cat subdomains.txt

# View live web services
echo "=== LIVE WEB SERVICES ==="
cat live_hosts.txt

# View open ports
echo "=== OPEN PORTS ==="
grep "open" port_scan.txt

# View screenshots
echo "=== SCREENSHOTS ==="
ls -la screenshots/

# Generate basic HTML report
cat > asm_report.html << EOF
<!DOCTYPE html>
<html>
<head>
    <title>ASM Report for $TARGET</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 40px; }
        .section { margin: 20px 0; padding: 15px; border-left: 4px solid #007bff; }
        .finding { background: #f8f9fa; padding: 10px; margin: 5px 0; }
        .critical { border-left-color: #dc3545; }
        .warning { border-left-color: #ffc107; }
        .info { border-left-color: #17a2b8; }
    </style>
</head>
<body>
    <h1>ASM Report for $TARGET</h1>
    <p>Generated on: $(date)</p>
    
    <div class="section info">
        <h2>📊 Summary</h2>
        <div class="finding">
            <strong>Subdomains Discovered:</strong> $(wc -l < subdomains.txt)<br>
            <strong>Live Web Services:</strong> $(wc -l < live_hosts.txt)<br>
            <strong>Open Ports Found:</strong> $(grep -c "open" port_scan.txt)<br>
            <strong>Screenshots Taken:</strong> $(ls screenshots/*.png 2>/dev/null | wc -l)
        </div>
    </div>
    
    <div class="section">
        <h2>🌐 Discovered Subdomains</h2>
        $(while read subdomain; do echo "<div class='finding'>$subdomain</div>"; done < subdomains.txt)
    </div>
    
    <div class="section">
        <h2>✅ Live Web Services</h2>
        $(while read line; do echo "<div class='finding'>$line</div>"; done < live_hosts.txt)
    </div>
    
    <div class="section">
        <h2>🔌 Open Ports</h2>
        $(grep "open" port_scan.txt | while read line; do echo "<div class='finding'>$line</div>"; done)
    </div>
    
    <div class="section">
        <h2>📸 Screenshots</h2>
        $(ls screenshots/*.png 2>/dev/null | while read img; do 
            echo "<div class='finding'><img src='$img' style='max-width:300px; margin:10px;' /></div>"
        done)
    </div>
</body>
</html>
EOF

echo "📄 Report generated: asm_report.html"
echo "🌐 Open in browser: file://$(pwd)/asm_report.html"

# Check if Go is installed
go version

# Check if tools are in PATH
echo $PATH | grep go

# Reinstall tools if needed
go install -v github.com/owasp-amass/amass/v4/...@master

# Make sure you have execute permissions
chmod +x /path/to/tool

# For nmap, you might need sudo
sudo nmap -sS target.com

# Verify target is reachable
ping target.com

# Try with a known working target
subfinder -d google.com

# Reduce scan intensity
nmap -T2 target.com  # Slower but more polite
amass enum -passive -d target.com  # Passive only