Source Code

#!/usr/bin/env bash
# web-pentest-automation-v4.sh
# Verbose + progress-visible + parallel (AUTHORIZED LAB / HOME TARGETS ONLY)
# Revised: cleaner output (no ANSI junk), stage numbering, more robust parallelism.

set -Eeuo pipefail
IFS=$'\n\t'

# -----------------------------
# Colors (terminal only; logs are sanitized)
# -----------------------------
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

print_status()  { echo -e "${GREEN}[+]${NC} $1"; }
print_warning() { echo -e "${YELLOW}[!]${NC} $1"; }
print_error()   { echo -e "${RED}[-]${NC} $1" >&2; }
print_info()    { echo -e "${BLUE}[i]${NC} $1"; }

command_exists() { command -v "$1" >/dev/null 2>&1; }

# -----------------------------
# Args
# -----------------------------
TARGET_RAW="${1:-}"
shift || true

usage() {
  cat <<'EOF'
Usage:
  ./web-pentest-automation-v4.sh <target> [--no-pdf] [--no-parallel] [--raw-output]

Examples (AUTHORIZED LABS / HOME TARGETS ONLY):
  ./web-pentest-automation-v4.sh 10.10.10.10
  ./web-pentest-automation-v4.sh http://10.10.10.10:8080
  ./web-pentest-automation-v4.sh hometest.lab/

Flags:
  --no-pdf        Disable PDF generation
  --no-parallel   Run sequentially (debug-friendly)
  --raw-output    Do not sanitize ANSI/progress characters (not recommended)

Env overrides:
  STAGE_TIMEOUT=1800
  HEARTBEAT_SECS=20
  PARALLEL_JOBS=4

  FFUF_THREADS FFUF_RATE FFUF_TIMEOUT
  DIRSEARCH_THREADS
  NUCLEI_CONCURRENCY NUCLEI_RATE NUCLEI_TIMEOUT
EOF
}

NO_PDF=0
NO_PARALLEL=0
RAW_OUTPUT=0
for arg in "$@"; do
  case "$arg" in
    --help|-h) usage; exit 0 ;;
    --no-pdf) NO_PDF=1 ;;
    --no-parallel) NO_PARALLEL=1 ;;
    --raw-output) RAW_OUTPUT=1 ;;
    *) print_warning "Ignoring unknown arg: $arg" ;;
  esac
done

if [[ -z "$TARGET_RAW" ]]; then
  usage
  exit 1
fi

# -----------------------------
# CPU-aware tuning
# -----------------------------
CPU_CORES="$(nproc 2>/dev/null || echo 4)"
HEARTBEAT_SECS="${HEARTBEAT_SECS:-20}"
STAGE_TIMEOUT="${STAGE_TIMEOUT:-1800}"

FFUF_THREADS="${FFUF_THREADS:-$((CPU_CORES * 25))}"
FFUF_RATE="${FFUF_RATE:-$((CPU_CORES * 80))}"
FFUF_TIMEOUT="${FFUF_TIMEOUT:-10}"

DIRSEARCH_THREADS="${DIRSEARCH_THREADS:-$((CPU_CORES * 10))}"

NUCLEI_CONCURRENCY="${NUCLEI_CONCURRENCY:-$((CPU_CORES * 10))}"
NUCLEI_RATE="${NUCLEI_RATE:-$((CPU_CORES * 30))}"
NUCLEI_TIMEOUT="${NUCLEI_TIMEOUT:-10}"

# Caps
(( FFUF_THREADS > 300 )) && FFUF_THREADS=300
(( FFUF_RATE > 1200 )) && FFUF_RATE=1200
(( DIRSEARCH_THREADS > 200 )) && DIRSEARCH_THREADS=200
(( NUCLEI_CONCURRENCY > 200 )) && NUCLEI_CONCURRENCY=200
(( NUCLEI_RATE > 600 )) && NUCLEI_RATE=600

PARALLEL_JOBS="${PARALLEL_JOBS:-$((CPU_CORES / 2))}"
(( PARALLEL_JOBS < 2 )) && PARALLEL_JOBS=2
(( PARALLEL_JOBS > 6 )) && PARALLEL_JOBS=6

# -----------------------------
# Report dirs (include target)
# -----------------------------
SAFE_HOST="$(echo "$TARGET_RAW" | sed -E 's#https?://##' | sed -E 's#/*$##' | tr ':/ ' '___' | tr -cd '[:alnum:]_')"
REPORT_DIR="pentest_report_${SAFE_HOST}_$(date +%Y%m%d_%H%M%S)"
OUTPUT_DIR="$REPORT_DIR/output"
STAGES_DIR="$REPORT_DIR/stages"
LOG_FILE="$REPORT_DIR/pentest.log"
mkdir -p "$OUTPUT_DIR" "$STAGES_DIR" "$REPORT_DIR/screenshots"

log_message() {
  echo -e "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
}

trap 'print_error "Failed at line $LINENO. See $LOG_FILE"; exit 1' ERR

# -----------------------------
# Target normalization
# -----------------------------
TARGET_URL=""
TARGET_HOST=""

normalize_target() {
  local t="$TARGET_RAW"
  t="$(echo "$t" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g')"
  t="$(echo "$t" | sed -E 's#/*$##')"

  if [[ "$t" =~ ^https?:// ]]; then
    TARGET_URL="$t"
  else
    TARGET_URL="http://$t"
  fi

  TARGET_HOST="$(echo "$TARGET_URL" | sed -E 's|^https?://||' | cut -d'/' -f1)"
}

is_ip() {
  [[ "$TARGET_HOST" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}(:[0-9]+)?$ ]]
}

# -----------------------------
# Output sanitation to remove ANSI junk
# -----------------------------
sanitize_stream() {
  # Remove ANSI escape sequences and carriage returns used for spinners/progress.
  # Keeps logs and terminal readable when piped.
  # If RAW_OUTPUT=1, bypass.
  if (( RAW_OUTPUT == 1 )); then
    cat
    return 0
  fi
  sed -u -E \
    -e 's/\x1B\[[0-9;]*[A-Za-z]//g' \
    -e 's/\r/\n/g'
}

# -----------------------------
# Stage registry / progress numbering
# -----------------------------
STAGES=()
STAGE_COUNT=0
CURRENT_STAGE=0

register_stage() {
  STAGES+=("$1")
  ((STAGE_COUNT++))
}

announce_stage() {
  local name="$1"
  ((CURRENT_STAGE++))
  print_status "[$CURRENT_STAGE/$STAGE_COUNT] $name"
  log_message "ANNOUNCE: [$CURRENT_STAGE/$STAGE_COUNT] $name"
}

# -----------------------------
# Requirements
# -----------------------------
check_requirements() {
  print_status "Checking tools..."
  local required=(curl jq python3 ffuf httpx nuclei)
  local optional=(subfinder dirsearch dalfox wkhtmltopdf amass stdbuf timeout)

  for t in "${required[@]}"; do
    if ! command_exists "$t"; then
      print_error "Missing required tool: $t"
      exit 1
    fi
  done
  for t in "${optional[@]}"; do
    if ! command_exists "$t"; then
      print_warning "Optional tool not found (stage may be skipped): $t"
    fi
  done
  print_status "Tool check complete."
}

# -----------------------------
# Wordlist selection
# -----------------------------
pick_wordlist() {
  local candidates=(
    "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
    "/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt"
    "/usr/share/seclists/Discovery/Web-Content/common.txt"
  )
  for w in "${candidates[@]}"; do
    [[ -f "$w" ]] && { echo "$w"; return 0; }
  done
  local fallback="$OUTPUT_DIR/fallback_wordlist.txt"
  cat > "$fallback" <<'EOF'
admin
login
dashboard
robots.txt
sitemap.xml
api
uploads
assets
backup
test
dev
EOF
  echo "$fallback"
}

# -----------------------------
# Heartbeat
# -----------------------------
heartbeat() {
  local pid="$1"
  local name="$2"
  while kill -0 "$pid" 2>/dev/null; do
    sleep "$HEARTBEAT_SECS"
    if kill -0 "$pid" 2>/dev/null; then
      log_message "HEARTBEAT: still running ($name) pid=$pid"
      print_info "Still running: $name (pid=$pid)"
    fi
  done
}

# -----------------------------
# Stage runner (single command string)
# -----------------------------
stage_log_path() {
  local name="$1"
  echo "$STAGES_DIR/$(echo "$name" | tr ' /' '__' | tr -cd '[:alnum:]_').log"
}

run_cmd_stage() {
  local name="$1"; shift
  local cmd="$1"
  local slog
  slog="$(stage_log_path "$name")"

  announce_stage "$name"
  log_message "STAGE_START: $name"
  log_message "COMMAND: $cmd"

  local start end elapsed rc
  start="$(date +%s)"

  local runner=(bash -c "$cmd")
  if command_exists stdbuf; then
    runner=(stdbuf -oL -eL bash -c "$cmd")
  fi

  if command_exists timeout; then
    (
      set -o pipefail
      timeout "$STAGE_TIMEOUT" "${runner[@]}" 2>&1 \
        | sanitize_stream \
        | tee -a "$slog" \
        | tee -a "$LOG_FILE" >/dev/null
    )
  else
    (
      set -o pipefail
      "${runner[@]}" 2>&1 \
        | sanitize_stream \
        | tee -a "$slog" \
        | tee -a "$LOG_FILE" >/dev/null
    )
  fi

  rc=$?
  end="$(date +%s)"
  elapsed=$((end - start))

  if [[ $rc -ne 0 ]]; then
    print_warning "Stage failed/timed out: $name (rc=$rc, elapsed=${elapsed}s)"
    log_message "STAGE_FAIL: $name rc=$rc elapsed=${elapsed}s"
    return 1
  fi

  log_message "STAGE_OK: $name elapsed=${elapsed}s"
  return 0
}

# -----------------------------
# Stages
# -----------------------------
probe_target() {
  run_cmd_stage "HTTP probing (httpx)" \
    "httpx -u '$TARGET_URL' -silent -status-code -title -tech-detect -follow-redirects -timeout 10 -o '$OUTPUT_DIR/httpx_probe.txt'"
}

enumerate_subdomains() {
  if is_ip; then
    print_info "Subdomain enumeration: IP target; skipping."
    log_message "SKIP: subdomains (IP target)"
    return 0
  fi
  if ! command_exists subfinder; then
    print_warning "Subdomain enumeration skipped: subfinder missing."
    log_message "SKIP: subdomains (subfinder missing)"
    return 0
  fi

  run_cmd_stage "Subdomain enumeration (subfinder)" \
    "subfinder -d '${TARGET_HOST}' -silent -o '$OUTPUT_DIR/subfinder_subdomains.txt'"

  if command_exists amass; then
    run_cmd_stage "Subdomain enumeration (amass)" \
      "amass enum -d '${TARGET_HOST}' -o '$OUTPUT_DIR/amass_subdomains.txt'"
    cat "$OUTPUT_DIR/subfinder_subdomains.txt" "$OUTPUT_DIR/amass_subdomains.txt" 2>/dev/null | sort -u > "$OUTPUT_DIR/all_subdomains.txt" || true
  else
    cp "$OUTPUT_DIR/subfinder_subdomains.txt" "$OUTPUT_DIR/all_subdomains.txt" 2>/dev/null || true
  fi

  local count
  count="$(wc -l < "$OUTPUT_DIR/all_subdomains.txt" 2>/dev/null || echo 0)"
  print_status "Subdomains found: $count"
}

brute_directories_ffuf() {
  local wordlist
  wordlist="$(pick_wordlist)"
  print_info "Using wordlist: $wordlist"
  print_info "ffuf tuning: threads=$FFUF_THREADS rate=$FFUF_RATE timeout=$FFUF_TIMEOUT"

  # -s reduces noise; results saved to json + live text
  run_cmd_stage "Directory discovery (ffuf)" \
    "ffuf -u '${TARGET_URL%/}/FUZZ' \
      -w '$wordlist' \
      -t '$FFUF_THREADS' \
      -rate '$FFUF_RATE' \
      -timeout '$FFUF_TIMEOUT' \
      -fc 404 \
      -s \
      -of json -o '$OUTPUT_DIR/ffuf_results.json' \
      | tee '$OUTPUT_DIR/ffuf_live.txt'"
}

brute_directories_dirsearch() {
  if ! command_exists dirsearch; then
    print_warning "dirsearch skipped: not installed."
    log_message "SKIP: dirsearch (missing)"
    return 0
  fi
  print_info "dirsearch tuning: threads=$DIRSEARCH_THREADS"

  # --quiet reduces spinner/progress junk; output file still produced
  run_cmd_stage "Directory discovery (dirsearch)" \
    "dirsearch -u '$TARGET_URL' \
      -e php,asp,aspx,jsp,html,js,txt \
      --random-agent \
      --timeout 10 \
      --quiet \
      -t '$DIRSEARCH_THREADS' \
      -o '$OUTPUT_DIR/dirsearch_results.txt'"
}

scan_vulnerabilities() {
  print_info "nuclei tuning: concurrency=$NUCLEI_CONCURRENCY rate=$NUCLEI_RATE timeout=$NUCLEI_TIMEOUT"

  # -no-color avoids ANSI; -stats is readable (no spinners).
  run_cmd_stage "Vulnerability scan (nuclei)" \
    "nuclei -u '$TARGET_URL' \
      -c '$NUCLEI_CONCURRENCY' \
      -rl '$NUCLEI_RATE' \
      -timeout '$NUCLEI_TIMEOUT' \
      -severity low,medium,high,critical \
      -stats -silent -no-color \
      -o '$OUTPUT_DIR/nuclei_results.txt'"
}

detect_xss() {
  if ! command_exists dalfox; then
    print_warning "dalfox skipped: not installed."
    log_message "SKIP: dalfox (missing)"
    return 0
  fi

  # Your dalfox supports --no-spinner and --no-color per help output
  run_cmd_stage "XSS scan (dalfox)" \
    "dalfox url '$TARGET_URL' --silence --no-color --no-spinner --timeout 10 --output '$OUTPUT_DIR/dalfox_xss_results.txt'"
}

custom_checks() {
  local out="$OUTPUT_DIR/custom_checks.txt"
  run_cmd_stage "Custom checks (headers + common files)" \
    "{
      echo '== Headers (Server/X-Powered-By/etc) ==';
      curl -skD - '$TARGET_URL' | grep -Ei '^(Server|X-Powered-By|X-AspNet|X-Generator|Via):' || true;
      echo;
      echo '== robots.txt (first 80 lines) ==';
      curl -sk '${TARGET_URL%/}/robots.txt' | head -80 || true;
      echo;
      echo '== sitemap.xml (first 80 lines) ==';
      curl -sk '${TARGET_URL%/}/sitemap.xml' | head -80 || true;
      echo;
      echo '== .git/config (first 40 lines if exposed) ==';
      curl -sk '${TARGET_URL%/}/.git/config' | head -40 || true;
    } > '$out'"
}

capture_versions() {
  {
    echo "Generated: $(date)"
    echo "Target: $TARGET_URL"
    echo "Cores: $CPU_CORES"
    echo "Parallel jobs: $PARALLEL_JOBS"
    echo "FFUF: threads=$FFUF_THREADS rate=$FFUF_RATE timeout=$FFUF_TIMEOUT"
    echo "DIRSEARCH: threads=$DIRSEARCH_THREADS"
    echo "NUCLEI: concurrency=$NUCLEI_CONCURRENCY rate=$NUCLEI_RATE timeout=$NUCLEI_TIMEOUT"
    echo "Stage timeout: ${STAGE_TIMEOUT}s Heartbeat: ${HEARTBEAT_SECS}s"
    echo
    for t in ffuf httpx nuclei subfinder dirsearch dalfox amass wkhtmltopdf; do
      if command_exists "$t"; then
        echo "== $t =="
        ($t -version 2>/dev/null || $t -V 2>/dev/null || $t --version 2>/dev/null || $t -h 2>/dev/null | head -n 3) || true
        echo
      fi
    done
  } > "$REPORT_DIR/tool_versions.txt" || true
}

make_quickview() {
  local q="$OUTPUT_DIR/quickview.txt"
  {
    echo "== Quickview =="
    [[ -s "$OUTPUT_DIR/nuclei_results.txt" ]] && { echo; echo "[Nuclei top 10]"; head -10 "$OUTPUT_DIR/nuclei_results.txt"; }
    [[ -s "$OUTPUT_DIR/dalfox_xss_results.txt" ]] && { echo; echo "[Dalfox top 10]"; head -10 "$OUTPUT_DIR/dalfox_xss_results.txt"; }
    [[ -s "$OUTPUT_DIR/ffuf_live.txt" ]] && { echo; echo "[ffuf top 10]"; head -10 "$OUTPUT_DIR/ffuf_live.txt"; }
    [[ -s "$OUTPUT_DIR/dirsearch_results.txt" ]] && { echo; echo "[dirsearch top 10]"; head -10 "$OUTPUT_DIR/dirsearch_results.txt"; }
  } > "$q" 2>/dev/null || true
}

create_html_report() {
  make_quickview

  local subdomains_count="0"
  local ffuf_hits="0"

  [[ -f "$OUTPUT_DIR/all_subdomains.txt" ]] && subdomains_count="$(wc -l < "$OUTPUT_DIR/all_subdomains.txt" 2>/dev/null || echo 0)"
  [[ -f "$OUTPUT_DIR/ffuf_results.json" ]] && ffuf_hits="$(jq -r '.results | length' "$OUTPUT_DIR/ffuf_results.json" 2>/dev/null || echo 0)"

  cat > "$REPORT_DIR/pentest_report.html" <<EOF
<!DOCTYPE html>
<html><head><meta charset="UTF-8"><title>Web Pentest Report - $TARGET_URL</title>
<style>
body{font-family:Arial;margin:20px;background:#f5f5f5}
.container{max-width:1200px;margin:0 auto;background:#fff;padding:20px;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1)}
.section{margin-bottom:18px;padding:12px;border-left:4px solid #4CAF50;background:#f9f9f9}
.results{margin-top:10px;padding:10px;background:#f8f9fa;border-radius:4px;font-family:monospace;white-space:pre-wrap}
.meta{color:#555}
</style></head>
<body><div class="container">
<h1>Web Pentest Automation Report (v4)</h1>
<p class="meta"><strong>Target:</strong> $TARGET_URL<br/>
<strong>Generated:</strong> $(date)<br/>
<strong>Cores:</strong> $CPU_CORES &nbsp; <strong>Parallel jobs:</strong> $PARALLEL_JOBS</p>

<div class="section"><h2>Quickview</h2>
<div class="results">$(head -200 "$OUTPUT_DIR/quickview.txt" 2>/dev/null || echo "No quickview")</div></div>

<div class="section"><h2>Summary</h2>
<div class="results">Subdomains found: $subdomains_count
ffuf hits (json): $ffuf_hits</div></div>

<div class="section"><h2>HTTP Probe (httpx)</h2>
<div class="results">$(head -120 "$OUTPUT_DIR/httpx_probe.txt" 2>/dev/null || echo "No output")</div></div>

<div class="section"><h2>Subdomains</h2>
<div class="results">$(head -120 "$OUTPUT_DIR/all_subdomains.txt" 2>/dev/null || echo "Skipped / none")</div></div>

<div class="section"><h2>ffuf (first lines)</h2>
<div class="results">$(head -120 "$OUTPUT_DIR/ffuf_live.txt" 2>/dev/null || echo "No output")</div></div>

<div class="section"><h2>dirsearch (first lines)</h2>
<div class="results">$(head -120 "$OUTPUT_DIR/dirsearch_results.txt" 2>/dev/null || echo "Skipped / none")</div></div>

<div class="section"><h2>Nuclei (first lines)</h2>
<div class="results">$(head -200 "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null || echo "No output")</div></div>

<div class="section"><h2>Dalfox (first lines)</h2>
<div class="results">$(head -200 "$OUTPUT_DIR/dalfox_xss_results.txt" 2>/dev/null || echo "Skipped / none")</div></div>

<div class="section"><h2>Custom Checks</h2>
<div class="results">$(head -200 "$OUTPUT_DIR/custom_checks.txt" 2>/dev/null || echo "No output")</div></div>

<div class="section"><h2>Tool Versions</h2>
<div class="results">$(head -200 "$REPORT_DIR/tool_versions.txt" 2>/dev/null || echo "No output")</div></div>

<p class="meta">Artifacts: <strong>$REPORT_DIR</strong><br/>
Stage transcripts: <strong>$STAGES_DIR</strong></p>
</div></body></html>
EOF

  print_status "HTML report created: $REPORT_DIR/pentest_report.html"
}

create_pdf_report() {
  if [[ "$NO_PDF" -eq 1 ]]; then
    print_info "PDF generation disabled (--no-pdf)."
    log_message "SKIP: pdf (--no-pdf)"
    return 0
  fi
  if ! command_exists wkhtmltopdf; then
    print_warning "wkhtmltopdf not found. Skipping PDF."
    log_message "SKIP: pdf (wkhtmltopdf missing)"
    return 0
  fi
  wkhtmltopdf "$REPORT_DIR/pentest_report.html" "$REPORT_DIR/pentest_report.pdf" 2>>"$LOG_FILE" || true
  [[ -f "$REPORT_DIR/pentest_report.pdf" ]] && print_status "PDF report created: $REPORT_DIR/pentest_report.pdf"
}

show_summary() {
  print_status "=== Complete ==="
  echo "Target: $TARGET_URL"
  echo "Report directory: $REPORT_DIR"
  echo "HTML: $REPORT_DIR/pentest_report.html"
  [[ -f "$REPORT_DIR/pentest_report.pdf" ]] && echo "PDF:  $REPORT_DIR/pentest_report.pdf"
  echo
  print_info "Outputs:"
  ls -la "$OUTPUT_DIR" 2>/dev/null || true
  echo
  print_info "Stage transcripts:"
  ls -la "$STAGES_DIR" 2>/dev/null || true
}

# -----------------------------
# Parallel orchestration
# -----------------------------
declare -A PID
declare -A NAME

launch_bg() {
  local key="$1"
  local human="$2"
  local fn="$3"

  ( "$fn" ) &
  PID["$key"]=$!
  NAME["$key"]="$human"

  if kill -0 "${PID[$key]}" 2>/dev/null; then
    heartbeat "${PID[$key]}" "$human" &
  fi
}

wait_bg() {
  local key="$1"
  local p="${PID[$key]:-}"
  local n="${NAME[$key]:-$key}"
  [[ -z "$p" ]] && return 0
  if wait "$p"; then
    return 0
  else
    print_warning "Stage failed: $n"
    log_message "WAIT_FAIL: $n"
    return 1
  fi
}

run_parallel_plan() {
  probe_target

  # Core parallel stages
  launch_bg "subdomains" "Subdomain enumeration" enumerate_subdomains
  launch_bg "ffuf" "Directory discovery (ffuf)" brute_directories_ffuf
  launch_bg "nuclei" "Vulnerability scan (nuclei)" scan_vulnerabilities

  if (( PARALLEL_JOBS >= 4 )); then
    launch_bg "dirsearch" "Directory discovery (dirsearch)" brute_directories_dirsearch
  else
    brute_directories_dirsearch || true
  fi

  # Also parallelize dalfox/custom when resources permit
  if (( PARALLEL_JOBS >= 5 )); then
    launch_bg "dalfox" "XSS scan (dalfox)" detect_xss
  else
    detect_xss || true
  fi

  if (( PARALLEL_JOBS >= 6 )); then
    launch_bg "custom" "Custom checks" custom_checks
  else
    custom_checks || true
  fi

  local failures=0
  wait_bg "subdomains" || failures=$((failures+1))
  wait_bg "ffuf" || failures=$((failures+1))
  wait_bg "nuclei" || failures=$((failures+1))
  (( PARALLEL_JOBS >= 4 )) && wait_bg "dirsearch" || true
  (( PARALLEL_JOBS >= 5 )) && wait_bg "dalfox" || true
  (( PARALLEL_JOBS >= 6 )) && wait_bg "custom" || true

  (( failures > 0 )) && print_warning "Some parallel stages failed. Review logs under $STAGES_DIR."
}

main() {
  local start end
  start="$(date +%s)"

  normalize_target
  check_requirements

  # Register planned stages (UX only)
  register_stage "HTTP probing (httpx)"
  register_stage "Subdomain enumeration (subfinder/amass)"
  register_stage "Directory discovery (ffuf)"
  register_stage "Directory discovery (dirsearch)"
  register_stage "Vulnerability scan (nuclei)"
  register_stage "XSS scan (dalfox)"
  register_stage "Custom checks (headers + common files)"
  register_stage "Reporting (HTML/PDF)"

  print_status "Target set to: $TARGET_URL"
  log_message "Target: $TARGET_URL"
  print_info "Total planned stages: $STAGE_COUNT"
  print_info "Tuning: cores=$CPU_CORES parallel_jobs=$PARALLEL_JOBS"
  print_info "ffuf: threads=$FFUF_THREADS rate=$FFUF_RATE timeout=$FFUF_TIMEOUT"
  print_info "dirsearch: threads=$DIRSEARCH_THREADS"
  print_info "nuclei: concurrency=$NUCLEI_CONCURRENCY rate=$NUCLEI_RATE timeout=$NUCLEI_TIMEOUT"
  print_info "stage timeout: ${STAGE_TIMEOUT}s heartbeat: ${HEARTBEAT_SECS}s"

  capture_versions

  if [[ "$NO_PARALLEL" -eq 1 ]]; then
    print_info "Parallel disabled (--no-parallel). Running sequentially."
    probe_target
    enumerate_subdomains || true
    brute_directories_ffuf || true
    brute_directories_dirsearch || true
    scan_vulnerabilities || true
    detect_xss || true
    custom_checks || true
  else
    run_parallel_plan
  fi

  announce_stage "Reporting (HTML/PDF)"
  create_html_report
  create_pdf_report
  show_summary

  end="$(date +%s)"
  print_status "Total time: $((end - start)) seconds"
}

main "$@"