name: vulnerability-flow
kind: flow
desc: Vulnerability assessment flow with discovery, scanning, and reporting modules

params:
  - name: threads
    value: "25"
  - name: severity
    value: "medium,high,critical"
  - name: templates
    value: "{{Data}}/nuclei-templates"

modules:
  # Module 1: Discovery - Find attack surface
  - name: discovery
    condition: "true"
    steps:
      - name: init-discovery
        type: bash
        commands:
          - mkdir -p {{Output}}/discovery
          - mkdir -p {{Output}}/endpoints
        exports:
          discovery_dir: "{{Output}}/discovery"
          endpoints_dir: "{{Output}}/endpoints"

      - name: find-endpoints
        type: bash
        parallel_commands:
          - "{{Binaries}}/waybackurls {{Target}} > {{endpoints_dir}}/wayback.txt"
          - "{{Binaries}}/gau {{Target}} > {{endpoints_dir}}/gau.txt"
          - "{{Binaries}}/katana -u {{Target}} -silent -o {{endpoints_dir}}/katana.txt"
        timeout: 900
        on_error: continue

      - name: merge-endpoints
        type: bash
        command: |
          cat {{endpoints_dir}}/*.txt | sort -u > {{discovery_dir}}/all-endpoints.txt
          grep -E '\.(php|asp|aspx|jsp|cgi)' {{discovery_dir}}/all-endpoints.txt > {{discovery_dir}}/dynamic-endpoints.txt || true
        exports:
          all_endpoints: "{{discovery_dir}}/all-endpoints.txt"
          dynamic_endpoints: "{{discovery_dir}}/dynamic-endpoints.txt"

  # Module 2: Scanning - Run vulnerability scanners
  - name: scanning
    depends_on:
      - discovery
    condition: "file_length('{{all_endpoints}}') > 0"
    steps:
      - name: init-scanning
        type: bash
        commands:
          - mkdir -p {{Output}}/vulns
          - mkdir -p {{Output}}/findings
        exports:
          vulns_dir: "{{Output}}/vulns"
          findings_dir: "{{Output}}/findings"

      - name: nuclei-scan
        type: bash
        command: "{{Binaries}}/nuclei -l {{all_endpoints}} -t {{templates}} -severity {{severity}} -c {{threads}} -o {{vulns_dir}}/nuclei.json -jsonl"
        timeout: 7200
        on_error: continue
        exports:
          nuclei_results: "{{vulns_dir}}/nuclei.json"

      - name: additional-scans
        type: parallel-steps
        parallel_steps:
          - name: xss-scan
            type: bash
            command: "cat {{dynamic_endpoints}} | {{Binaries}}/dalfox pipe -o {{vulns_dir}}/xss.txt"
            timeout: 3600
            on_error: continue
          - name: sqli-check
            type: bash
            command: "{{Binaries}}/sqlmap -m {{dynamic_endpoints}} --batch --output-dir={{vulns_dir}}/sqli"
            timeout: 3600
            on_error: continue

  # Module 3: Reporting - Generate vulnerability reports
  - name: reporting
    depends_on:
      - scanning
    condition: "true"
    steps:
      - name: init-reports
        type: bash
        command: mkdir -p {{Output}}/reports

      - name: aggregate-findings
        type: function
        script: |
          var findings = [];
          var nucleiFile = "{{nuclei_results}}";

          if (file_exists(nucleiFile)) {
            var content = read_file(nucleiFile);
            var lines = content.split("\n").filter(function(l) { return l.trim().length > 0; });
            findings = lines.map(function(l) {
              try { return JSON.parse(l); } catch(e) { return {raw: l}; }
            });
          }

          log_info("Total findings aggregated: " + findings.length);
          writeFile("{{Output}}/reports/findings.json", JSON.stringify(findings, null, 2));
          return findings.length;
        exports:
          finding_count: "{{Result}}"

      - name: generate-report
        type: bash
        command: |
          cat > {{Output}}/reports/vulnerability-report.md << EOF
          # Vulnerability Assessment Report

          **Target:** {{Target}}
          **Date:** $(date)
          **Severity Filter:** {{severity}}

          ## Summary
          - Total Findings: {{finding_count}}
          - Endpoints Scanned: $(wc -l < {{all_endpoints}})

          ## Detailed Findings
          See findings.json for complete details.
          EOF
        exports:
          final_report: "{{Output}}/reports/vulnerability-report.md"