<?php
// live_attack.php - Real-time attack visualization with ACTUAL exploitation
require_once 'config.php';
requireLogin();

$attackType = $_GET['type'] ?? '';
$targetUrl = $_GET['url'] ?? '';
$payload = $_GET['payload'] ?? '';
$parameter = $_GET['parameter'] ?? '';

if (empty($targetUrl) || empty($attackType)) {
    die("Invalid attack parameters");
}

// Log the live attack attempt
logAttack($targetUrl, $attackType . ' (Live)', $payload, 'Live attack execution', 
          determineSeverityFromType($attackType));

function determineSeverityFromType($type) {
    $type = strtolower($type);
    if (strpos($type, 'sql') !== false) return 'Critical';
    if (strpos($type, 'command') !== false || strpos($type, 'rce') !== false) return 'Critical';
    if (strpos($type, 'xss') !== false) return 'High';
    if (strpos($type, 'path') !== false || strpos($type, 'traversal') !== false) return 'High';
    if (strpos($type, 'csrf') !== false) return 'Medium';
    return 'Medium';
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>⚡ Live Attack: <?php echo htmlspecialchars($attackType); ?></title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            font-family: 'Courier New', monospace;
            background: #0a0a0a;
            color: #0f0;
            padding: 20px;
            min-height: 100vh;
        }
        .container { max-width: 1400px; margin: 0 auto; }
        
        .header {
            text-align: center;
            padding: 20px;
            background: linear-gradient(135deg, rgba(255,0,0,0.2), rgba(0,0,0,0.8));
            border: 2px solid #f00;
            border-radius: 10px;
            margin-bottom: 30px;
            animation: borderGlow 2s infinite;
        }
        
        @keyframes borderGlow {
            0%, 100% { border-color: #f00; box-shadow: 0 0 20px rgba(255,0,0,0.3); }
            50% { border-color: #ff0; box-shadow: 0 0 40px rgba(255,255,0,0.5); }
        }
        
        .attack-info {
            background: #1a1a1a;
            padding: 20px;
            border-radius: 10px;
            margin: 20px 0;
            border-left: 4px solid #f00;
        }
        
        .progress-container {
            background: #111;
            padding: 20px;
            border-radius: 10px;
            margin: 20px 0;
        }
        
        .progress-label {
            display: flex;
            justify-content: space-between;
            margin-bottom: 10px;
            font-weight: bold;
        }
        
        .progress-bar {
            width: 100%;
            height: 50px;
            background: #1a1a1a;
            border-radius: 25px;
            overflow: hidden;
            border: 2px solid #333;
            position: relative;
        }
        
        .progress-fill {
            width: 0%;
            height: 100%;
            background: linear-gradient(90deg, #0f0, #ff0, #f00);
            transition: width 0.3s ease;
            display: flex;
            align-items: center;
            justify-content: center;
            font-weight: bold;
            font-size: 18px;
            color: #000;
            position: relative;
            overflow: hidden;
        }
        
        .progress-fill::after {
            content: '';
            position: absolute;
            top: 0;
            left: 0;
            right: 0;
            bottom: 0;
            background: linear-gradient(45deg, transparent 30%, rgba(255,255,255,0.3) 50%, transparent 70%);
            animation: shimmer 2s infinite;
        }
        
        @keyframes shimmer {
            0% { transform: translateX(-100%); }
            100% { transform: translateX(100%); }
        }
        
        .terminal {
            background: #000;
            padding: 20px;
            border-radius: 10px;
            height: 500px;
            overflow-y: auto;
            font-family: 'Courier New', monospace;
            font-size: 14px;
            border: 1px solid #333;
            position: relative;
        }
        
        .terminal::before {
            content: 'LIVE ATTACK TERMINAL - REAL EXECUTION';
            position: sticky;
            top: 0;
            background: #1a1a1a;
            padding: 5px 10px;
            display: block;
            color: #ff0;
            font-weight: bold;
            border-bottom: 1px solid #333;
            z-index: 1;
        }
        
        .terminal-line { 
            margin: 5px 0; 
            padding: 3px 5px;
            animation: fadeIn 0.3s;
            border-left: 2px solid transparent;
        }
        
        .terminal-line:hover {
            border-left-color: #0f0;
            background: rgba(0,255,0,0.05);
        }
        
        @keyframes fadeIn { 
            from { opacity: 0; transform: translateX(-10px); } 
            to { opacity: 1; transform: translateX(0); } 
        }
        
        .success { color: #0f0; }
        .error { color: #f00; }
        .info { color: #0ff; }
        .warning { color: #ff0; }
        .critical { color: #f0f; font-weight: bold; }
        
        .result-box {
            background: #1a1a1a;
            border: 2px solid #ff0;
            border-radius: 10px;
            padding: 20px;
            margin-top: 20px;
            display: none;
            animation: slideDown 0.5s ease;
        }
        
        @keyframes slideDown {
            from { opacity: 0; transform: translateY(-20px); }
            to { opacity: 1; transform: translateY(0); }
        }
        
        button {
            background: #f00;
            color: white;
            border: none;
            padding: 15px 30px;
            font-size: 18px;
            font-weight: bold;
            border-radius: 10px;
            cursor: pointer;
            margin: 10px;
            transition: all 0.3s;
            text-transform: uppercase;
            letter-spacing: 2px;
        }
        
        button:hover { 
            transform: scale(1.05); 
            box-shadow: 0 0 30px rgba(255,0,0,0.5);
        }
        
        button:disabled {
            opacity: 0.5;
            cursor: not-allowed;
        }
        
        .btn-green { 
            background: #0f0; 
            color: #000;
        }
        
        .btn-green:hover {
            box-shadow: 0 0 30px rgba(0,255,0,0.5);
        }
        
        .real-response {
            background: #000;
            padding: 20px;
            border-radius: 10px;
            margin: 15px 0;
            border: 1px solid #0f0;
            max-height: 600px;
            overflow-y: auto;
        }
        
        .real-response pre {
            white-space: pre-wrap;
            word-wrap: break-word;
            color: #0f0;
            font-family: 'Courier New', monospace;
            font-size: 13px;
            line-height: 1.4;
        }
        
        .blink {
            animation: blink 1s infinite;
        }
        
        @keyframes blink {
            0%, 100% { opacity: 1; }
            50% { opacity: 0; }
        }
        
        .http-headers {
            background: #1a1a1a;
            padding: 15px;
            border-radius: 5px;
            margin: 10px 0;
            border-left: 3px solid #0ff;
        }
        
        .stat-highlight {
            font-size: 24px;
            font-weight: bold;
            color: #f00;
        }
    </style>
</head>
<body>
    <div class="container">
        <div class="header">
            <h1>⚔️ LIVE ATTACK EXECUTION</h1>
            <p class="blink" style="color: #f00;">⚠️ REAL EXPLOITATION - ACTUAL RESULTS ⚠️</p>
        </div>
        
        <div class="attack-info">
            <h3>🎯 Target: <span style="color: #ff0;" id="displayTarget"><?php echo htmlspecialchars($targetUrl); ?></span></h3>
            <h3>⚡ Attack Type: <span style="color: #f00;" id="displayType"><?php echo htmlspecialchars($attackType); ?></span></h3>
            <h3>💣 Payload: <code style="color: #0f0;" id="displayPayload"><?php echo htmlspecialchars($payload); ?></code></h3>
            <h3>📍 Vector: <code style="color: #ff0;" id="displayParameter"><?php echo htmlspecialchars($parameter); ?></code></h3>
        </div>
        
        <div class="progress-container">
            <div class="progress-label">
                <span>Attack Progress</span>
                <span id="progressText">0% - Ready to launch</span>
            </div>
            <div class="progress-bar">
                <div class="progress-fill" id="progressFill">0%</div>
            </div>
        </div>
        
        <div class="terminal" id="terminal">
            <div class="terminal-line info">[+] Attack framework initialized</div>
            <div class="terminal-line info">[+] Target: <?php echo htmlspecialchars($targetUrl); ?></div>
            <div class="terminal-line info">[+] Attack: <?php echo htmlspecialchars($attackType); ?></div>
            <div class="terminal-line info">[+] Payload prepared</div>
            <div class="terminal-line warning">[!] Ready to execute real attack</div>
        </div>
        
        <div style="text-align: center; margin: 20px 0;">
            <button onclick="executeRealAttack()" id="attackBtn">
                🚀 EXECUTE REAL ATTACK
            </button>
            <button onclick="window.close()" style="background: #333;">
                ✖️ CLOSE
            </button>
        </div>
        
        <div id="resultBox" class="result-box"></div>
    </div>
    
    <script>
        let progress = 0;
        
        const attackType = '<?php echo addslashes($attackType); ?>';
        const targetUrl = '<?php echo addslashes($targetUrl); ?>';
        const payload = '<?php echo addslashes($payload); ?>';
        const parameter = '<?php echo addslashes($parameter); ?>';
        
        function addTerminalLine(message, type = 'info') {
            const terminal = document.getElementById('terminal');
            const line = document.createElement('div');
            line.className = `terminal-line ${type}`;
            const timestamp = new Date().toLocaleTimeString('en-US', { hour12: false });
            line.innerHTML = `[${timestamp}] ${message}`;
            terminal.appendChild(line);
            terminal.scrollTop = terminal.scrollHeight;
        }
        
        function updateProgress(value, phase = '') {
            progress = Math.min(value, 100);
            const fill = document.getElementById('progressFill');
            const progressText = document.getElementById('progressText');
            
            fill.style.width = progress + '%';
            fill.innerHTML = Math.floor(progress) + '%';
            
            if (phase) {
                progressText.innerHTML = Math.floor(progress) + '% - ' + phase;
            } else {
                progressText.innerHTML = Math.floor(progress) + '%';
            }
        }
        
        function sleep(ms) {
            return new Promise(resolve => setTimeout(resolve, ms));
        }
        
        async function executeRealAttack() {
            const btn = document.getElementById('attackBtn');
            btn.disabled = true;
            btn.innerHTML = '⚔️ ATTACKING... DO NOT CLOSE';
            
            // Phase 1: Preparation (0-15%)
            addTerminalLine("Phase 1: Preparing attack vector...", 'info');
            updateProgress(5, 'Initializing');
            await sleep(500);
            
            addTerminalLine("Crafting exploit for: " + attackType, 'info');
            updateProgress(10, 'Crafting payload');
            await sleep(500);
            
            addTerminalLine("Encoding payload with bypass techniques...", 'info');
            updateProgress(15, 'Ready');
            await sleep(300);
            
            // Phase 2: Attack Delivery (15-40%)
            addTerminalLine("Phase 2: Delivering attack...", 'warning');
            updateProgress(20, 'Connecting to target');
            
            // Prepare the actual attack request
            const attackData = {
                attack_type: attackType,
                target_url: targetUrl,
                payload: payload,
                parameter: parameter,
                method: detectMethod(attackType, targetUrl),
                encoding: detectEncoding(attackType)
            };
            
            addTerminalLine("Target URL: " + targetUrl, 'info');
            addTerminalLine("Attack Method: " + attackData.method, 'info');
            updateProgress(30, 'Sending payload');
            
            await sleep(800);
            
            // Phase 3: Real Attack Execution (40-70%)
            addTerminalLine("Phase 3: Executing attack on target...", 'critical');
            updateProgress(40, 'Executing');
            
            let realResult;
            try {
                // Execute the real attack using attack_executor.php
                const response = await fetch('attack_executor.php', {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                        'X-Attack-Type': attackType,
                        'X-Attack-Target': targetUrl
                    },
                    body: JSON.stringify(attackData)
                });
                
                updateProgress(60, 'Receiving response');
                addTerminalLine("Response received from target server", 'info');
                
                const result = await response.json();
                realResult = result;
                
                if (result.success) {
                    addTerminalLine("✓ ATTACK SUCCESSFUL - Target responded", 'success');
                } else {
                    addTerminalLine("! Attack delivered - analyzing response", 'warning');
                }
                
                updateProgress(70, 'Analyzing');
                
            } catch (error) {
                addTerminalLine("! Direct attack failed: " + error.message, 'error');
                addTerminalLine("Attempting alternative attack methods...", 'warning');
                
                // Try fallback direct attack
                realResult = await executeFallbackAttack(attackData);
            }
            
            // Phase 4: Result Analysis (70-90%)
            addTerminalLine("Phase 4: Analyzing attack results...", 'info');
            updateProgress(80, 'Processing');
            await sleep(800);
            
            // Analyze the real response
            const analysis = analyzeRealResponse(realResult, attackType);
            
            addTerminalLine("Response size: " + (realResult.response_size || 'Unknown') + " bytes", 'info');
            addTerminalLine("HTTP Status: " + (realResult.http_code || 'Unknown'), 'info');
            
            if (analysis.vulnerable) {
                addTerminalLine("✓ VULNERABILITY CONFIRMED - Evidence found in response", 'success');
            } else if (analysis.suspicious) {
                addTerminalLine("! Suspicious response detected - Further testing recommended", 'warning');
            }
            
            updateProgress(90, 'Complete');
            await sleep(500);
            
            // ALWAYS REACH 100%
            updateProgress(100, 'ATTACK COMPLETE');
            addTerminalLine("==================== ATTACK COMPLETE ====================", 'success');
            addTerminalLine("✓ Execution finished - 100% complete", 'success');
            
            // Display REAL results
            displayRealResults(realResult, analysis);
            
            btn.innerHTML = '🔄 RE-EXECUTE ATTACK';
            btn.disabled = false;
        }
        
        function detectMethod(attackType, url) {
            // Determine best HTTP method based on attack type and URL
            if (attackType.toLowerCase().includes('post') || 
                attackType.toLowerCase().includes('csrf')) {
                return 'POST';
            }
            if (url.includes('?') || parameter) {
                return 'GET';
            }
            return 'POST'; // Default to POST for payload delivery
        }
        
        function detectEncoding(attackType) {
            const type = attackType.toLowerCase();
            if (type.includes('sql')) return 'url_encode';
            if (type.includes('xss')) return 'none';
            if (type.includes('path')) return 'url_encode';
            if (type.includes('command')) return 'url_encode';
            return 'url_encode';
        }
        
        async function executeFallbackAttack(attackData) {
            // Direct attack using multiple methods
            addTerminalLine("Attempting GET-based attack...", 'info');
            
            const testUrl = injectPayloadIntoUrl(attackData.target_url, attackData.parameter, attackData.payload);
            
            try {
                const response = await fetch('attack_executor.php', {
                    method: 'POST',
                    headers: { 'Content-Type': 'application/json' },
                    body: JSON.stringify({
                        ...attackData,
                        target_url: testUrl,
                        method: 'GET',
                        fallback: true
                    })
                });
                
                const result = await response.json();
                addTerminalLine("Fallback attack completed", 'info');
                return result;
                
            } catch (error) {
                addTerminalLine("All attack methods exhausted", 'error');
                return {
                    success: false,
                    http_code: 0,
                    response_size: 0,
                    response_headers: '',
                    response_body: '',
                    error: error.message
                };
            }
        }
        
        function injectPayloadIntoUrl(url, param, payloadValue) {
            const urlObj = new URL(url);
            urlObj.searchParams.set(param, payloadValue);
            return urlObj.toString();
        }
        
        function analyzeRealResponse(result, attackType) {
            const analysis = {
                vulnerable: false,
                suspicious: false,
                evidence: [],
                response_indicators: []
            };
            
            if (!result || !result.response_body) {
                return analysis;
            }
            
            const body = result.response_body || '';
            const headers = result.response_headers || '';
            const httpCode = result.http_code || 0;
            
            // Check for SQL injection indicators
            if (attackType.toLowerCase().includes('sql')) {
                const sqlErrors = [
                    'sql syntax', 'mysql_fetch', 'ora-', 'postgresql', 'sqlite',
                    'unclosed quotation', 'you have an error in your sql',
                    'warning: mysql', 'microsoft sql', 'odbc driver',
                    'syntax error', 'unexpected token', 'sqlstate'
                ];
                
                for (const error of sqlErrors) {
                    if (body.toLowerCase().includes(error)) {
                        analysis.vulnerable = true;
                        analysis.evidence.push('SQL error detected: ' + error);
                    }
                }
                
                // Check for boolean-based evidence
                if (body.includes('1=1') || body.includes('true')) {
                    analysis.suspicious = true;
                    analysis.evidence.push('Boolean-based injection possible');
                }
            }
            
            // Check for XSS indicators
            if (attackType.toLowerCase().includes('xss')) {
                const decodedPayload = decodeURIComponent(result.original_payload || '');
                if (body.includes(decodedPayload) && !body.includes(htmlEncode(decodedPayload))) {
                    analysis.vulnerable = true;
                    analysis.evidence.push('XSS payload reflected unencoded in response');
                }
            }
            
            // Check for path traversal
            if (attackType.toLowerCase().includes('path')) {
                const traversalIndicators = [
                    'root:x:', '[extensions]', 'boot.ini', 'win.ini',
                    'bin/bash', 'daemon', 'nobody'
                ];
                
                for (const indicator of traversalIndicators) {
                    if (body.includes(indicator)) {
                        analysis.vulnerable = true;
                        analysis.evidence.push('Path traversal successful: ' + indicator);
                    }
                }
            }
            
            // Check for command injection
            if (attackType.toLowerCase().includes('command') || attackType.toLowerCase().includes('rce')) {
                const cmdIndicators = [
                    'uid=', 'gid=', 'www-data', 'root:', 'apache',
                    '\\[boot loader\\]', 'dos device'
                ];
                
                for (const indicator of cmdIndicators) {
                    if (body.includes(indicator)) {
                        analysis.vulnerable = true;
                        analysis.evidence.push('Command execution detected: ' + indicator);
                    }
                }
            }
            
            // General error indicators
            const errorIndicators = [
                'error', 'exception', 'warning', 'traceback',
                'stack trace', 'fatal error', 'debug'
            ];
            
            for (const indicator of errorIndicators) {
                if (body.toLowerCase().includes(indicator)) {
                    analysis.suspicious = true;
                    analysis.response_indicators.push('Error message exposed: ' + indicator);
                }
            }
            
            // Check HTTP status codes
            if (httpCode === 500 || httpCode === 503) {
                analysis.suspicious = true;
                analysis.response_indicators.push('Server error (HTTP ' + httpCode + ') - possible injection triggered');
            }
            
            if (httpCode === 200 && body.length === 0) {
                analysis.suspicious = true;
                analysis.response_indicators.push('Empty 200 response - possible blind vulnerability');
            }
            
            return analysis;
        }
        
        function htmlEncode(str) {
            const div = document.createElement('div');
            div.textContent = str;
            return div.innerHTML;
        }
        
        function displayRealResults(result, analysis) {
            const resultBox = document.getElementById('resultBox');
            resultBox.style.display = 'block';
            
            let html = '';
            
            // Status header
            if (analysis.vulnerable) {
                html += '<h2 style="color: #f00; text-align: center; font-size: 24px;" class="blink">';
                html += '⚠️ VULNERABILITY EXPLOITED SUCCESSFULLY ⚠️</h2>';
            } else if (analysis.suspicious) {
                html += '<h2 style="color: #ff0; text-align: center; font-size: 24px;">';
                html += '⚠️ POTENTIAL VULNERABILITY DETECTED</h2>';
            } else {
                html += '<h2 style="color: #0f0; text-align: center; font-size: 24px;">';
                html += 'ℹ️ ATTACK EXECUTED - REVIEW RESULTS</h2>';
            }
            
            // Attack summary
            html += `
                <div style="background: #1a1a1a; padding: 15px; border-radius: 8px; margin: 15px 0;">
                    <h3>📊 Attack Summary</h3>
                    <table style="width: 100%; border-collapse: collapse; margin-top: 10px;">
                        <tr>
                            <td style="padding: 8px; border: 1px solid #333;">HTTP Status</td>
                            <td style="padding: 8px; border: 1px solid #333; color: #0f0;">
                                <strong>${result.http_code || 'N/A'}</strong>
                            </td>
                        </tr>
                        <tr>
                            <td style="padding: 8px; border: 1px solid #333;">Response Size</td>
                            <td style="padding: 8px; border: 1px solid #333; color: #0f0;">
                                <strong>${result.response_size || 'N/A'} bytes</strong>
                            </td>
                        </tr>
                        <tr>
                            <td style="padding: 8px; border: 1px solid #333;">Connection Time</td>
                            <td style="padding: 8px; border: 1px solid #333; color: #0f0;">
                                <strong>${result.connection_time || 'N/A'}ms</strong>
                            </td>
                        </tr>
                        <tr>
                            <td style="padding: 8px; border: 1px solid #333;">Vulnerability Confirmed</td>
                            <td style="padding: 8px; border: 1px solid #333; color: ${analysis.vulnerable ? '#f00' : '#ff0'};">
                                <strong>${analysis.vulnerable ? 'YES - EXPLOITABLE' : (analysis.suspicious ? 'POSSIBLE' : 'INCONCLUSIVE')}</strong>
                            </td>
                        </tr>
                    </table>
                </div>
            `;
            
            // Evidence found
            if (analysis.evidence.length > 0) {
                html += `
                    <div style="background: rgba(255,0,0,0.1); padding: 15px; border-radius: 8px; border-left: 4px solid #f00; margin: 15px 0;">
                        <h3 style="color: #f00;">🔍 EXPLOITATION EVIDENCE</h3>
                        <ul style="margin-top: 10px; color: #ff0;">
                            ${analysis.evidence.map(e => `<li>${e}</li>`).join('')}
                        </ul>
                    </div>
                `;
            }
            
            // Response indicators
            if (analysis.response_indicators.length > 0) {
                html += `
                    <div style="background: rgba(255,255,0,0.1); padding: 15px; border-radius: 8px; border-left: 4px solid #ff0; margin: 15px 0;">
                        <h3 style="color: #ff0;">📋 RESPONSE INDICATORS</h3>
                        <ul style="margin-top: 10px;">
                            ${analysis.response_indicators.map(i => `<li style="color: #ff0;">${i}</li>`).join('')}
                        </ul>
                    </div>
                `;
            }
            
            // REAL HTTP Headers
            if (result.response_headers) {
                html += `
                    <div class="real-response">
                        <h3 style="color: #0ff;">📡 ACTUAL HTTP RESPONSE HEADERS</h3>
                        <pre style="color: #0ff; margin-top: 10px;">${escapeHtml(result.response_headers)}</pre>
                    </div>
                `;
            }
            
            // REAL Response Body
            if (result.response_body) {
                const bodyPreview = result.response_body.substring(0, 5000);
                html += `
                    <div class="real-response">
                        <h3 style="color: #0f0;">📄 ACTUAL RESPONSE BODY (${result.response_body.length} bytes)</h3>
                        <pre style="color: #0f0; margin-top: 10px;">${escapeHtml(bodyPreview)}</pre>
                        ${result.response_body.length > 5000 ? '<p style="color: #ff0;">[Response truncated - full response available in report]</p>' : ''}
                    </div>
                `;
            }
            
            // Error details if any
            if (result.error) {
                html += `
                    <div style="background: rgba(255,0,0,0.1); padding: 15px; border-radius: 8px; margin: 15px 0;">
                        <h3 style="color: #f00;">⚠️ ATTACK ERROR</h3>
                        <pre style="color: #f00; margin-top: 10px;">${escapeHtml(result.error)}</pre>
                    </div>
                `;
            }
            
            // Actions
            html += `
                <div style="text-align: center; margin-top: 20px;">
                    <button onclick="downloadReport()" class="btn-green">
                        📥 DOWNLOAD ATTACK REPORT
                    </button>
                    <button onclick="executeRealAttack()">
                        🔄 RE-EXECUTE ATTACK
                    </button>
                </div>
            `;
            
            resultBox.innerHTML = html;
            resultBox.scrollIntoView({ behavior: 'smooth' });
            
            // Log results to terminal
            addTerminalLine("==================== REAL ATTACK RESULTS ====================", 'info');
            addTerminalLine("HTTP Status: " + (result.http_code || 'N/A'), 'info');
            addTerminalLine("Response Size: " + (result.response_size || 'N/A') + " bytes", 'info');
            addTerminalLine("Vulnerable: " + (analysis.vulnerable ? 'YES' : 'Not confirmed'), analysis.vulnerable ? 'error' : 'info');
            if (analysis.evidence.length > 0) {
                addTerminalLine("Evidence found: " + analysis.evidence.length + " indicators", 'warning');
            }
            addTerminalLine("==================== END OF RESULTS ====================", 'info');
        }
        
        function escapeHtml(text) {
            const map = {
                '&': '&amp;',
                '<': '&lt;',
                '>': '&gt;',
                '"': '&quot;',
                "'": '&#039;'
            };
            return text.replace(/[&<>"']/g, m => map[m]);
        }
        
        function downloadReport() {
            const reportData = {
                attack_type: attackType,
                target_url: targetUrl,
                payload: payload,
                parameter: parameter,
                timestamp: new Date().toISOString(),
                results: document.getElementById('resultBox').innerText
            };
            
            const blob = new Blob([JSON.stringify(reportData, null, 2)], { type: 'application/json' });
            const url = URL.createObjectURL(blob);
            const a = document.createElement('a');
            a.href = url;
            a.download = 'attack_report_' + Date.now() + '.json';
            a.click();
            URL.revokeObjectURL(url);
            
            addTerminalLine("Report downloaded successfully", 'success');
        }
        
        // Auto-start attack
        setTimeout(() => {
            executeRealAttack();
        }, 1500);
    </script>
</body>
</html>