###############################################################################
# SPDX-License-Identifier: GPL-3.0-only
# PURPOSE: Nikto core functionality
###############################################################################

sub change_variables {
    my ($line, $mark, $checkid, $skip_lfi) = @_;

    # If no mark provided, use global mark
    $mark = $mark || $::mark;

    # If no variables to expand, check for LFI before returning
    my $at_index = index($line, '@');
    if ($at_index == -1) {
        return ($line);
    }

    # Use cached $shname for efficiency
    my $shname = $mark->{'hostname'} || $mark->{'ip'};
    my @subtests;

    # Replace JUNK(n) with random string
    $line =~ s/\@JUNK\((\d+)\)/LW2::utils_randstr($1)/e;

    # Replace static variables
    $line =~ s/\@IP/$mark->{'ip'}/g;
    $line =~ s/\@HOSTNAME/$shname/g;

    # Phase 1: Expand all non-LFI variables recursively
    # Keep expanding until no more non-LFI variables remain
    if (index($line, '@') == -1) {
        push @subtests, $line;
    }
    else {
        # Check for non-LFI variables and expand them
        my $found_variable = 0;
        foreach my $varname (keys %VARIABLES) {
            next if $varname =~ /^\@LFI/;
            next unless index($line, $varname) != -1;
            if ($line =~ /\Q$varname\E/) {

                # Expand this variable: split by whitespace and recursively process each value
                foreach my $value (split(/\s+/, $VARIABLES{$varname})) {
                    my $cooked = $line;
                    $cooked =~ s/\Q$varname\E/$value/g;

          # Recursively expand variables in the cooked line (skip LFI processing in recursive calls)
                    my @expanded = change_variables($cooked, $mark, $checkid, 1);
                    push @subtests, @expanded;
                }
                $found_variable = 1;
                last;    # Break out of foreach loop after handling first variable found
            }
        }
        if (!$found_variable) {
            push(@subtests, $line);
        }
    }

    # Phase 2: Handle LFI (only if not skipping)
    if ($skip_lfi) {

        # In recursive call, just return the subtests without processing LFI
        return @subtests;
    }

    # Now that other expansions are done, handle LFI
    my @tests;
    foreach my $subtest (@subtests) {
        if ($subtest =~ /\@LFI\(([^)]*)\)/) {
            my $args       = $1 || '';
            my @temp_tests = lfi_function($subtest, $args, $checkid, $mark);
            push @tests, @temp_tests;
        }
        else {
            push @tests, $subtest;
        }
    }
    return @tests;
}

sub lfi_function {
    my ($test, $args, $checkid, $mark) = @_;
    my @options = split(/,/, $args);
    my @lfitests;

    # Get detected/forced platform (default to 'all' if not set)
    my $detected_platform = ($mark && $mark->{'platform'}) ? $mark->{'platform'} : 'all';

    # Determine platform and path settings from test options
    my $is_nix  = grep(/nix/i, @options);
    my $is_win  = grep(/win/i, @options);
    my $use_url = grep(/url/i, @options);
    my $use_abs = grep(/abs/i, @options);

    # Determine which platforms to generate tests for
    my @platforms;
    my $test_specifies_platform = ($is_nix || $is_win);

    if ($test_specifies_platform) {

        # Test explicitly specifies platform(s)
        # Only run if platform matches or platform is 'all'
        if ($detected_platform eq 'all') {

            # Platform is 'all' - respect test's specification
            if ($is_nix && !$is_win) {
                push @platforms, 'nix';
            }
            elsif ($is_win && !$is_nix) {
                push @platforms, 'win';
            }
            else {
                # Both specified in test - generate both
                push @platforms, 'nix', 'win';
            }
        }
        elsif (   ($is_nix && $detected_platform eq 'nix')
               || ($is_win && $detected_platform eq 'win')) {

            # Platform matches test specification - use test's choice
            if ($is_nix && !$is_win) {
                push @platforms, 'nix';
            }
            elsif ($is_win && !$is_nix) {
                push @platforms, 'win';
            }
            else {
                # Both specified in test - but only one matches platform
                push @platforms, $detected_platform;
            }
        }
        else {
            # Platform doesn't match test specification - return empty (no tests)
            return @lfitests;    # Return empty array
        }
    }
    else {
        # Test doesn't specify platform - use detected platform
        if ($detected_platform eq 'all') {
            push @platforms, 'nix', 'win';
        }
        elsif ($detected_platform eq 'nix') {
            push @platforms, 'nix';
        }
        elsif ($detected_platform eq 'win') {
            push @platforms, 'win';
        }
        else {
            # Unknown platform, default to both
            push @platforms, 'nix', 'win';
        }
    }

    # Get depth (same for both platforms)
    my $depth = $VARIABLES{'@LFIDEPTH'} || 5;
    $depth =~ s/^\s+|\s+$//g;
    $depth = int($depth) if $depth =~ /^\s*\d+\s*$/;
    $depth = 5           if $depth < 1 || $depth > 20;    # Sanity check

    # Generate tests for each platform
    foreach my $platform (@platforms) {
        my $is_nix_platform = ($platform eq 'nix');

        # Get LFI variables (trim whitespace)
        my $target =
          $is_nix_platform
          ? ($VARIABLES{'@LFITGTNIX'} || '/etc/hosts')
          : ($VARIABLES{'@LFITGTWIN'} || '\\Windows\\win.ini');
        $target =~ s/^\s+|\s+$//g;

        # Build the full path
        my $full_path;
        if ($use_abs) {

            # 'abs' means skip traversal, use absolute path directly
            $full_path = $target;

            # Ensure it starts with / for nix or \ for win
            if ($is_nix_platform) {
                $full_path = '/' . $full_path unless $full_path =~ /^\//;
            }
            else {
                # For Windows, ensure it starts with \ (unless it has a drive letter)
                $full_path = '\\' . $full_path unless $full_path =~ /^[A-Za-z]:|^\\/;
            }
        }
        else {
            # Build traversal sequence
            my $path =
              $is_nix_platform
              ? ($VARIABLES{'@LFIPATHNIX'} || '../')
              : ($VARIABLES{'@LFIPATHWIN'} || '..\\');
            $path =~ s/^\s+|\s+$//g;
            my $traversal = $path x $depth;

            # Fix double slash if test is exactly @LFI(...)
            if ($test =~ /^\@LFI\([^)]*\)$/) {

                # Remove trailing / from traversal or leading / from target to avoid //
                if ($is_nix_platform && $traversal =~ /\/$/ && $target =~ /^\//) {
                    $traversal =~ s/\/$//;
                }
                elsif (!$is_nix_platform && $traversal =~ /\\$/ && $target =~ /^\\/) {
                    $traversal =~ s/\\$//;
                }
            }
            $full_path = $traversal . $target;
        }

        # Apply URL encoding if requested (do this after absolute path handling)
        if ($use_url) {
            $full_path =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
        }

        # Replace @LFI(...) in the test string with the generated path
        my $expanded_test = $test;
        $expanded_test =~ s/\@LFI\([^)]*\)/$full_path/g;

        push @lfitests, $expanded_test;
    }

    return @lfitests;
}

###############################################################################
sub unslash {
    my $line = $_[0] || return;    # $line is the slash-escaped variable

    # Early return for empty strings
    return $line if $line eq '';

    # Use a single regex with eval to handle all escape sequences at once
    $line =~ s/\\([abefnrt])|\\x([[:xdigit:]]{2})/defined($1) ? eval("qq{\\$1}") : chr(hex($2))/ge;

    return $line;
}
###############################################################################
sub is_404 {
    my ($mark, $uri, $response) = @_;
    return 0 unless defined $uri;
    return 0 unless defined $mark;
    return 0 unless defined $response;
    my $debug_404 = 0;

    my $code = $response->{'whisker'}{'code'};
    if ($debug_404) {
        print "--------------------------------\n";
        print "404: URI is: $uri\n";
        print "404: URI code is: $code\n";
    }

    # Check user-specified error codes first (highest priority)
    if (defined $VARIABLES{'ERRCODES'} && ref($VARIABLES{'ERRCODES'}) eq 'HASH') {
        if (exists $VARIABLES{'ERRCODES'}->{$code}) {
            print "404: 1\n" if $debug_404;
            return 1;
        }
    }

    # Check user-specified error strings (second priority, before expensive checks)
    if (defined $VARIABLES{'ERRSTRINGS'} && ref($VARIABLES{'ERRSTRINGS'}) eq 'HASH') {
        foreach my $pattern (keys %{ $VARIABLES{'ERRSTRINGS'} }) {
            if ($response->{'content'} =~ /$pattern/) {
                print "404: 2\n" if $debug_404;
                return 1;
            }
        }
    }

    # Trust 404, 406, and 410 codes
    if ($code =~ /^40[46]$/ || $code eq '410') {
        print "404: 3\n" if $debug_404;
        return 1;
    }

    # remove and capture the query string
    my $query_string = "";
    if ($uri =~ /\?(.*)$/) {
        $query_string = $1;
        $uri =~ s/\?(.*)$//;
    }
    my @uri_parts = split("/", $uri);

    # If we don't have a real path (probably /) just return 0
    # Filter out empty URI, just "/", or all empty parts
    if ($uri eq "" || $uri eq "/" || (scalar(@uri_parts) > 0 && !grep { $_ ne "" } @uri_parts)) {
        return 0;
    }

    my $ext = get_ext($uri);

    # Build base path (all parts except the last one)
    my @base_parts = @uri_parts;
    pop @base_parts if scalar(@base_parts) > 0;
    my $base_path = join("/", @base_parts);

    # Ensure base_path ends with / if it's not empty (for proper path construction)
    if ($base_path ne "" && $base_path ne "/") {
        $base_path .= "/";
    }
    elsif ($base_path eq "") {
        $base_path = "/";
    }

    # Determine the suffix pattern based on extension type
    my $suffix_pattern = "";
    if ($ext eq "DIRECTORY") {
        $suffix_pattern = "/";
    }
    elsif ($ext eq "DOTFILE") {
        $base_path .= ".";
    }
    elsif ($ext eq "NONE") {
    }
    else {
        $suffix_pattern = "." . $ext;
    }

    # Build cache key using "RAND" placeholder
    my $cache_key = $base_path . "RAND" . $suffix_pattern;

    # Check cache before making request
    my $cached_entry = $mark->{'nf_cache'}{$cache_key};
    my ($err_res, $err_content, $err_error, $err_request, $err_response);

    if (defined $cached_entry) {
        print "404: Cached Entry\n" if $debug_404;

        # Use cached response data
        $err_res     = $cached_entry->{'code'};
        $err_content = "";                        # Content not cached
        $err_error   = "";
        $err_request = {};
        $err_response = {
                 'code'     => $cached_entry->{'code'},
                 'location' => exists $cached_entry->{'location'} ? $cached_entry->{'location'} : ''
                 };
    }
    else {
        print "404: No Cached Entry\n" if $debug_404;

        # Build nf_path by replacing "RAND" with actual random string
        my $rand_str = LW2::utils_randstr(8);
        my $nf_path  = $base_path . $rand_str . $suffix_pattern;
        $nf_path .= "?" . $query_string if $query_string ne "";

        ($err_res, $err_content, $err_error, $err_request, $err_response) =
          nfetch($mark, $nf_path, "GET", "", "", "", "is_404");

        # Determine mode, type, match, and location
        my %response_map = (200 => "OK",
                            300 => "REDIR",
                            301 => "REDIR",
                            302 => "REDIR",
                            303 => "REDIR",
                            307 => "REDIR",
                            401 => "STD",
                            403 => "STD",
                            404 => "STD",
                            406 => "STD",
                            410 => "STD"
                            );

        my $mode = $response_map{$err_res} || "OTHER";
        my $cache_entry = { 'code' => $err_res,
                            'mode' => $mode
                            };
        print "404: $nf_path returned code: $err_res\n" if $debug_404;
        print "404: mode is: $mode\n"                   if $debug_404;

        # Handle redirects - store location if present
        if ($err_response && $err_response->{'location'} ne '') {
            $cache_entry->{'location'} = get_base_host($err_response->{'location'});
        }

        # Only determine type for OK/OTHER modes (STD and REDIR don't need type)
        if ($mode eq "OK" || $mode eq "OTHER") {
            if (length($err_content) == 0) {
                print "404: Type is BLANK\n" if $debug_404;
                $cache_entry->{'type'}  = "BLANK";
                $cache_entry->{'match'} = "";
            }
            else {
                print "404: Type is HASH\n" if $debug_404;
                $cache_entry->{'type'}  = "HASH";
                $cache_entry->{'match'} = LW2::md5(rm_active_content($err_content, $nf_path));
                print "404: Match is: $cache_entry->{'match'}\n" if $debug_404;
            }
        }

        # Store in cache
        $mark->{'nf_cache'}{$cache_key} = $cache_entry;
    }

    # Now determine if the actual response matches the "not found" pattern
    # Get the cached entry (should always be defined at this point)
    my $nf_entry = $mark->{'nf_cache'}{$cache_key};
    return 0 unless defined $nf_entry;

    my $nf_mode         = $nf_entry->{'mode'};
    my $actual_code     = $response->{'whisker'}{'code'};   # From the actual response being checked
    my $actual_content  = $response->{'whisker'}{'data'} || "";
    my $actual_location = $response->{'location'}        || "";

    # Check STD mode first (most common case - fastest check)
    if ($nf_mode eq "STD") {
        if ($actual_code =~ /^4\d\d$/) {
            print "404: 4\n" if $debug_404;
            return 1;
        }
        return 0;
    }

    # Check REDIR mode
    if ($nf_mode eq "REDIR") {
        if ($actual_location ne '' && exists $nf_entry->{'location'}) {
            my $actual_base = get_base_host($actual_location);
            if ($actual_base eq $nf_entry->{'location'}) {
                print "404: 5\n" if $debug_404;
                return 1;
            }
        }
        return 0;
    }

    # Check BLANK type (for OK/OTHER modes)
    if (exists $nf_entry->{'type'} && $nf_entry->{'type'} eq "BLANK") {
        if (length($actual_content) == 0) {
            print "404: 6\n" if $debug_404;
            return 1;
        }
        return 0;
    }

    # Check HASH type (most expensive, check last)
    if (exists $nf_entry->{'type'} && $nf_entry->{'type'} eq "HASH") {
        print "404: Checking HASH type\n"                     if $debug_404;
        print "404: nf_entry hash is: $nf_entry->{'match'}\n" if $debug_404;
        if (exists $nf_entry->{'match'} && $nf_entry->{'match'} ne '') {
            print "404: in exists\n" if $debug_404;

            if (length($actual_content) > 0) {
                print "404: length is > 0\n" if $debug_404;
                my $clean_content = rm_active_content($actual_content, $uri);
                print "404: Hash comparison is: \n"            if $debug_404;
                print "    " . LW2::md5($clean_content) . "\n" if $debug_404;
                print "    " . $nf_entry->{'match'} . "\n"     if $debug_404;
                if (LW2::md5($clean_content) eq $nf_entry->{'match'}) {
                    print "404: 7\n" if $debug_404;
                    return 1;
                }
            }
            else { print "length is 0\n" if $debug_404; }
        }
        print "404: 8\n" if $debug_404;
        return 0;
    }

    # If we get here, the cached entry doesn't match any known pattern
    print "404: 9\n" if $debug_404;
    return 0;
}

###############################################################################
sub scrub {

    # line to scrub
    my $line = shift;

    for my $val (@_) {
        next if $val eq "";

        # Create a copy to avoid modifying read-only values
        my $val_copy = $val;

        # remove IPv6 brackets if present
        $val_copy =~ s/^\[([^\]]+)\]$/$1/;
        $val_copy = validate_and_fix_regex($val_copy);

        my ($validip, $internal, $loopback) = is_ip($val_copy);
        if ($validip) {
            if ($val_copy =~ /^$LW2::IPv6_re$/) {
                $line =~ s/$val_copy/\:\:/g;
            }
            else {
                $line =~ s/$val_copy/0.0.0.0/g;
            }
        }
        else {
            $line =~ s/$val_copy/example.com/ig;
        }
    }

    return $line;
}

###############################################################################
sub nprint {
    my ($line, $mode, $testid) = @_;
    chomp($line);

    # Deferred output?
    if ($VARIABLES{'deferout'}) {
        push @{ $VARIABLES{'defertxt'} }, $mode . "::" . ($testid // '') . "::" . $line;
        return;
    }

    # scrub values - only pass scrub values (everything after $line and $mode)
    if ($OUTPUT{'scrub'}) {
        my @scrub_values = @_[ 3 .. $#_ ];
        $line = scrub($line, @scrub_values);
    }

    # don't print debug & verbose to output file...
    if ($mode ne '') {
        my %output_flags = ('d' => 'debug', 'v' => 'verbose', 'e' => 'errors');

        if (exists $output_flags{$mode} && $OUTPUT{ $output_flags{$mode} }) {
            my $prefix     = $mode eq 'd'    ? "D:"        : $mode eq 'v' ? "V:" : "E:";
            my $output     = $mode eq 'd'    ? \*STDERR    : \*STDOUT;
            my $testid_str = defined $testid ? "[$testid]" : "[000000]";
            print $output $prefix . localtime() . " $testid_str - $line\n";
        }
        return;
    }

    # print errors to STDERR
    if ($line =~ /^\t?\+ ERROR:/) { print STDERR "$line\n"; return; }

    # don't print to STDOUT if output file is "-"
    return if defined $CLI{'file'} && $CLI{'file'} eq "-";

    $line =~
      s/(CVE\-[12][0-9]{3}-[0-9]{4,5})/https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name\=$1/g;
    $line =~ s/(CA\-[12][0-9]{3}-[0-9]{2})/https:\/\/www.cert.org\/advisories\/$1.html/g;
    $line =~
      s/(MS([0-9]{2})\-[0-9]{3})/https\:\/\/docs\.microsoft\.com\/en-us\/security-updates\/securitybulletins\/20$2\/$1/gi;

    print $line . "\n";

    return;
}

###############################################################################
sub get_ext {
    my $uri = $_[0] || return;
    return "DIRECTORY" if $uri =~ /\/$/;
    $uri                       =~ s/^.*\///;
    return "DOTFILE" if $uri   =~ /^\.[^.%]/;
    $uri                       =~ s/[?&%;\|].*$//;
    return "NONE" if index($uri, '.') == -1;
    $uri =~ s/\@[A-Z]+(\([^\)]*\))?//;    # remove variables and functions
    $uri =~ s/".*$//;
    $uri =~ s/^.*\.//;
    return $uri;
}

###############################################################################
sub status_report {
    my ($mark) = shift;
    my $line;

    # without this we could face a div by 0 error
    if (   $COUNTERS{'totalrequests'} eq 0
        || $COUNTERS{'total_checks'} eq 0
        || $COUNTERS{'total_targets'} eq 0) {
        nprint("- STATUS: Starting up!");
        return;
    }

    my $secleft =
      ((time() - $COUNTERS{'scan_start'}) / $COUNTERS{'totalrequests'}) *
      (($COUNTERS{'total_checks'} * $COUNTERS{'total_targets'}) - $COUNTERS{'totalrequests'});
    my $timeleft;
    if ($secleft > 60) {
        my $minleft = $secleft / 60;
        $timeleft = sprintf("%.1f minutes", $minleft);
        if ($minleft > 60) {
            my $hrsleft = $minleft / 60;
            $timeleft = sprintf("%.1f hours", $hrsleft);
        }
    }
    else { $timeleft = sprintf("%.0f seconds", $secleft); }

    my $perc_compl =
      ($COUNTERS{'totalrequests'} / ($COUNTERS{'total_checks'} * $COUNTERS{'total_targets'}) * 100);

    $line = "- STATUS: Completed $COUNTERS{'totalrequests'} requests";
    if ($COUNTERS{'total_targets'} > 1) {
        $line .= " (target " . ($COUNTERS{'hosts_completed'} + 1) . "/$COUNTERS{'total_targets'})";
    }

    if (($perc_compl < 100) && ($secleft > 0)) {
        $line .= sprintf(" (~%.0f%% complete, ~$timeleft left)", $perc_compl);
    }

    if ($NIKTO{'current_plugin'} ne '') {
        $line .= ": currently in plugin '$NIKTO{'current_plugin'}'";
    }

    nprint($line);
    nprint("- STATUS: " . running_average_print($mark));

    return;
}
###############################################################################
sub date_disp {
    my $t      = $_[0] || return;
    my @time   = localtime($t);
    my $result = sprintf("%d-%02d-%02d %02d:%02d:%02d",
                         $time[5] + 1900,
                         $time[4] + 1,
                         $time[3], $time[2], $time[1], $time[0]);
    return $result;
}

###############################################################################
sub get_base_host {
    my $uri = $_[0] || return;

    # uri, protocol, host, port, params, frag, user, password.
    my @hd   = LW2::uri_split($uri);
    my $base = $hd[1] . "://" . $hd[2];
    if (($hd[3] != 80) && ($hd[3] != 443)) { $base .= ":" . $hd[3]; }
    $base .= "/";
    return $base;
}

###############################################################################
sub rm_active_content {

    # Try to remove active content which could mess up the file's signature
    my ($cont, $file) = @_;
    return "" if (length($cont) == 0);

    # Dates/Times
    $cont =~ s/[12]\d{3}[-.\/][1-3]?\d[-.\/][1-3]?\d//g;      # 2001-12-12
    $cont =~ s/[1-3]?\d[-.\/][1-3]?\d\d[-.\/][12]\d{3}//g;    # 12-12-2002
    $cont =~ s/\d{8,14}//g;                                   # timestamp
    $cont =~ s/\d{6}//g;                                      # timestamp
    $cont =~ s/\d{2}:\d{2}(?::\d{2})?//g;                     # 12:11:33
    $cont =~
      s/(?:mon|tue|wed|thu|fri|sat|sun)(?:day)?,? [1-3]?[0-9] (?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)//ig;
    $cont =~ s/[12][0-9]{3}\s?(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s?[1-3]?[0-9]//gi
      ;                                                       # 2009 jan 29
    $cont =~
      s/[1-3]?[0-9]\s?(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[, ]?(?:[12][0-9]{3})?//gi
      ;                                                       # 29 Jan 2009
    $cont =~ s/[\d.]+ (?:second|queries)//gi;                 # page load time

    # URI, if provided, plus encoded versions of it
    # $_[1] has unescaped file name, and $file has escaped. use appropriate one!
    if ($file ne '') {
        $file = quotemeta($file);
        $cont =~ s/$file//g;

        # base 64
        my $e = LW2::encode_base64($_[1]);
        $cont =~ s/$e//gs;

        # hex encoded
        $e = LW2::encode_uri_hex($_[1]);
        $cont =~ s/$e//gs;

        # unicode encoded
        $e = LW2::encode_unicode($_[1]);
        $e = quotemeta($e);
        $cont =~ s/$e//gs;

        # url encoding, full url
        $e = $_[1];
        $e    =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
        $cont =~ s/$e//gs;

        # url encoding, query portion
        if ($file =~ /\?(.*$)/) {
            my $qs = $1;

            # match pages which link to themselves w/diff args
            $cont =~ s/$qs//gs;

            # url encoded
            $qs   =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
            $cont =~ s/$qs//gs;
        }
    }

    return $cont;
}

###############################################################################
sub dump_target_info {
    my ($mark) = @_;
    my $sslprint = "";

    if ($mark->{ssl}) {

        $sslprint = "$VARIABLES{'DIV'}\n";
        $sslprint .= "+ SSL Info:           Subject:  $mark->{'ssl_cert_subject'}\n";

        # Extract and display CN separately
        my $cn = '';
        if ($mark->{'ssl_cert_subject'} =~ /CN=([^$ \/]+)/) {
            $cn = $1;
            $sslprint .= "                      CN:       $cn\n";
        }

        # Display SAN if present
        if ($mark->{'ssl_cert_altnames'} ne '') {
            $sslprint .= "                      SAN:      $mark->{'ssl_cert_altnames'}\n";
        }

        $sslprint .= "                      Ciphers:  $mark->{'ssl_cipher'}\n";
        $sslprint .= "                      Issuer:   $mark->{'ssl_cert_issuer'}";
    }

    if ($CLI{'plugins'} ne '@@NONE') {
        if ($mark->{ip} =~ /^$LW2::IPv4_re$/ || $mark->{ip} =~ /^$LW2::IPv6_re_inc_zoneid$/) {
            nprint("+ Target IP:          $mark->{ip}", "", ($mark->{'ip'}));
        }
        else {
            nprint("+ Target IP:          (proxied)", "", ($mark->{'ip'}));
        }

        nprint("+ Target Hostname:    $mark->{hostname}",
               "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        nprint("+ Target Port:        $mark->{port}");
        if (defined $CLI{'root'}) {
            nprint("+ Target Path:        $CLI{'root'}",
                   "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        }

        if ((defined $CLI{'vhost'}) && ($CLI{'vhost'} ne $mark->{hostname})) {
            nprint("+ Virtual Host:       $CLI{'vhost'}",
                   "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        }

        if ($request{'whisker'}->{'proxy_host'} ne '') {
            nprint(
                "+ Proxy:              $request{'whisker'}->{'proxy_host'}:$request{'whisker'}->{'proxy_port'}",
                "",
                ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'})
                );
        }

        if ($mark->{ssl}) {
            nprint($sslprint, "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        }

        if (defined $NIKTO{'anti_ids'} && defined $CLI{'evasion'}) {
            for (my $i = 1 ; $i <= (keys %{ $NIKTO{'anti_ids'} }) ; $i++) {
                if ($CLI{'evasion'} =~ /$i/) {
                    nprint("+ Using Encoding:     $NIKTO{'anti_ids'}{$i}");
                }
            }
        }
        if (defined $NIKTO{'mutate_opts'} && defined $CLI{'mutate'}) {
            for (my $i = 1 ; $i <= (keys %{ $NIKTO{'mutate_opts'} }) ; $i++) {
                if ($CLI{'mutate'} =~ /$i/) {
                    nprint("+ Using Mutation:     $NIKTO{'mutate_opts'}{$i}");
                }
            }
        }

        if (defined $mark->{'messages'}) {
            my @msgs = @{ $mark->{'messages'} };
            foreach my $m (@msgs) {
                nprint("+ Message:            $m",
                       "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
            }
        }

        if (defined $mark->{'platform'}) {
            my %platform_names = ('nix' => 'Linux/Unix',
                                  'win' => 'Windows',
                                  'all' => 'Unknown'
                                  );
            my $platform_display = $platform_names{ $mark->{'platform'} } || $mark->{'platform'};
            nprint("+ Platform:           $platform_display");
        }

        my $time = date_disp($mark->{start_time});
        nprint("+ Start Time:         $time (GMT$VARIABLES{'GMTOFFSET'})");
        nprint($VARIABLES{'DIV'});
    }

    if ($mark->{banner} ne "") {
        nprint("+ Server: $mark->{banner}",
               "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
    }
    else {
        nprint("+ Server: No banner retrieved");
    }

    return;
}

###############################################################################
sub general_config {
    ## gotta set these first
    $| = 1;

    # internal array, this should never be used outside this sub
    my @options;

    # This is used in dump_target_info(), not just help output
    $NIKTO{'anti_ids'}{'1'} = "Random URI encoding (non-UTF8)";
    $NIKTO{'anti_ids'}{'2'} = "Directory self-reference (/./)";
    $NIKTO{'anti_ids'}{'3'} = "Premature URL ending";
    $NIKTO{'anti_ids'}{'4'} = "Prepend long random string";
    $NIKTO{'anti_ids'}{'5'} = "Fake parameter";
    $NIKTO{'anti_ids'}{'6'} = "TAB as request spacer";
    $NIKTO{'anti_ids'}{'7'} = "Change the case of the URL";
    $NIKTO{'anti_ids'}{'8'} = "Use Windows directory separator (\\)";
    $NIKTO{'anti_ids'}{'A'} = "Use a carriage return (0x0d) as a request spacer";
    $NIKTO{'anti_ids'}{'B'} = "Use binary value 0x0b as a request spacer";

    # This is used in dump_target_info(), not just help output
    $NIKTO{'mutate_opts'}{'1'} = "Test all files with all root directories";
    $NIKTO{'mutate_opts'}{'2'} = "Guess for password file names";
    $NIKTO{'mutate_opts'}{'3'} = "Enumerate user names via Apache (/~user type requests)";
    $NIKTO{'mutate_opts'}{'4'} =
      "Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)";
    $NIKTO{'mutate_opts'}{'6'} =
      "Attempt to guess directory names from the supplied dictionary file";

    ### CLI STUFF
    $CLI{'pause'} = $CLI{'html'} = $OUTPUT{'verbose'} = $CLI{'skiplookup'} =
      $COUNTERS{'totalrequests'} = $OUTPUT{'debug'} = $OUTPUT{'scrub'} = $OUTPUT{'errors'} = 0;
    $CLI{'all_options'} = join(" ", @ARGV);
    $CLI{'all_options'} =~ s/(\-id?\s[^\s:]+:)[^\s]+/$1****/i;

    GetOptions("ask=s"            => \$CLI{'ask'},
               "Add-header=s"     => \@{ $CLI{'headers'} },
               "check6"           => \$CLI{'check6'},
               "Cgidirs=s"        => \$CLI{'forcecgi'},
               "config=s"         => \$CLI{'config'},
               "dbcheck"          => \&check_dbs,
               "Display=s"        => \$CLI{'display'},
               "evasion=s"        => \$CLI{'evasion'},
               "followredirects"  => \$CLI{'followredirects'},
               "Format=s"         => \$CLI{'format'},
               "Help"             => \&usage,
               "host=s"           => \$CLI{'host'},
               "id=s"             => \$CLI{'hostauth'},
               "key=s"            => \$CLI{'key'},
               "list-plugins"     => \&list_plugins,
               "maxtime=s"        => \$CLI{'maxtime'},
               "mutate-options=s" => \$CLI{'mutate-options'},
               "mutate=s"         => \$CLI{'mutate'},
               "nointeractive"    => \$CLI{'nointeractive'},
               "nolookup"         => \$CLI{'skiplookup'},
               "nossl"            => \$CLI{'nossl'},
               "Option=s"         => \@options,
               "output=s"         => \$CLI{'file'},
               "Pause=f"          => \$CLI{'pause'},
               "Plugins=s"        => \$CLI{'plugins'},
               "Platform=s"       => \$CLI{'platform'},
               "RSAcert=s"        => \$CLI{'cert'},
               "port=s"           => \$CLI{'ports'},
               "root=s"           => \$CLI{'root'},
               "ssl"              => \$CLI{'ssl'},
               "noslash"          => \$CLI{'noslash'},
               "Save=s"           => \$CLI{'saveresults'},
               "timeout=i"        => \$CLI{'timeout'},
               "Tuning=s"         => \$CLI{'tuning'},
               "Userdbs:s"        => \$CLI{'userdbs'},
               "nocheck"          => \$CLI{'nocheck'},
               "nocookies"        => \$CLI{'nocookies'},
               "useproxy:s"       => \$CLI{'useproxy'},
               "useragent=s"      => \$CLI{'useragent'},
               "url=s"            => \$CLI{'host'},
               "Version"          => \&version,
               "vhost=s"          => \$CLI{'vhost'},
               "404string=s"      => \$CLI{'404string'},
               "404code=s"        => \$CLI{'404code'},
               "ipv6"             => \$CLI{'ipv6'},
               "ipv4"             => \$CLI{'ipv4'},
               )
      or usage();

    # Validate that -followredirects doesn't have an argument, a common confusion with -Format
    if ($CLI{'followredirects'}) {
        if ($CLI{'all_options'} =~ /\-f(ollowredirects)?\s+[^-]/) {
            nprint(
                "+ ERROR: -f (-followredirects) does not accept arguments. Use -F for output format (e.g., -F html)"
                );
            exit 1;
        }
    }

    # Run a test for IPv6 connectivity
    if ($CLI{'check6'}) {
        check_ipv6();
    }

    # both -host and -url
    if (($CLI{'host'} ne '') && ($CLI{'url'} ne '')) {
        nprint("+ ERROR: Cannot use -url and -host at the same time");
        exit 1;
    }

    # -ipv4 and -ipv6 validations
    if ($CLI{'ipv4'} && $CLI{'ipv6'}) {
        nprint("+ ERROR: Cannot use -ipv4 and -ipv6 at the same time");
        exit 1;
    }
    if ($CLI{'ipv6'}) {
        $CLI{'ipv4'} = 0;
    }
    else {
        $CLI{'ipv4'} = 1;
    }

    # 404string
    if ($CLI{'404string'} ne '') {
        my $s = validate_and_fix_regex($CLI{'404string'});
        $VARIABLES{'ERRSTRINGS'}->{$s} = 1;
    }

    # 404code
    if ($CLI{'404code'} ne '') {
        foreach my $code (split(/\s?,\s?/, $CLI{'404code'})) {
            $code =~ s/^\s+|\s+$//g;    # Trim whitespace
            if ($code =~ /[^\d]/) {
                nprint("+ ERROR: Invalid 404code, must be an integer");
                exit 1;
            }
            $VARIABLES{'ERRCODES'}->{$code} = 1;
        }
    }

    # Maxtime must be seconds
    if ($CLI{'maxtime'} ne '') {
        $CLI{'maxtime'} = time_to_seconds($CLI{'maxtime'});
        if ($CLI{'maxtime'} eq '') {
            nprint("+ ERROR: Invalid maxtime value, must be a valid time (e.g., 3600s, 60m, 1h)");
            exit 1;
        }
    }

    # options allows overriding of nikto.conf entries on command line
    foreach my $option (@options) {
        my @optione = split("=", $option, 2);
        $CONFIGFILE{ $optione[0] } = $optione[1];
    }

    # Userdb type: blank is db_tests only, so 'all' is only valid option
    if (defined($CLI{'userdbs'})) {
        if   ($CLI{'userdbs'} =~ /^all$/i) { $CLI{'userdbs'} = 'all'; }
        else                               { $CLI{'userdbs'} = 'tests'; }
    }

    # CLI proxy overrides nikto.conf
    if ((defined($CLI{'useproxy'})) && ($CLI{'useproxy'} ne '')) {
        if ($CLI{'useproxy'} !~ /^https?:\/\//) { $CLI{'useproxy'} = "http://$CLI{'useproxy'}"; }
        my @prox = LW2::uri_split($CLI{'useproxy'});
        $CONFIGFILE{'PROXYHOST'} = $prox[2];
        $CONFIGFILE{'PROXYPORT'} = $prox[3];
        $CONFIGFILE{'PROXYUSER'} = $prox[6];
        $CONFIGFILE{'PROXYPASS'} = $prox[7];
    }
    elsif (defined($CLI{'useproxy'})) { $CLI{'useproxy'} = 1; }
    else {
        undef $CONFIGFILE{'PROXYHOST'};
        undef $CONFIGFILE{'PROXYPORT'};
        undef $CONFIGFILE{'PROXYUSER'};
        undef $CONFIGFILE{'PROXYPASS'};
    }

    # Save Results
    if (defined($CLI{'saveresults'})) {
        if ($CLI{'saveresults'} eq '') {
            nprint("+ ERROR: -Save must have a directory name or '.' for auto-generated");
            exit 1;
        }
        eval "require JSON::PP";
        if ($@) {
            nprint("+ ERROR: Module JSON::PP missing.");
            exit 1;
        }
    }

    # Parse comma-separated formats early (before validation)
    my @formats_raw = ();
    if (defined $CLI{'format'} && $CLI{'format'} ne '') {
        @formats_raw = split(/,/, $CLI{'format'});
    }

    # If no format specified, try to infer from file extension later
    my @formats      = ();
    my %formats_hash = ();

    foreach my $fmt (@formats_raw) {
        $fmt =~ s/^\s+|\s+$//g;    # Trim whitespace
        $fmt = lc($fmt);
        $fmt = 'txt' if $fmt eq 'text';
        $fmt = 'htm' if $fmt eq 'html';

        if ($fmt !~ /^(?:txt|htm|csv|json|sql|sqld|xml|none)$/) {
            nprint("+ ERROR: Invalid output format: $fmt");
            exit 1;
        }

        # Avoid duplicates
        if (!exists $formats_hash{$fmt}) {
            push(@formats, $fmt);
            $formats_hash{$fmt} = 1;
        }
    }

    # Store formats array for later use
    $CLI{'formats'} = \@formats;

    # Keep first format for backward compatibility with single-format code paths
    $CLI{'format'} = $formats[0] if @formats > 0;

    # Check XML dependencies (check if xml is in formats)
    if (grep { $_ eq 'xml' } @formats) {
        eval "require XML::Writer";
        if ($@) {
            nprint("+ ERROR: Module XML::Writer missing. Install with: cpan XML::Writer");
            exit 1;
        }
    }

    # port(s)
    if (defined $CLI{'ports'}) {
        $CLI{'ports'} =~ s/^\s+//;
        $CLI{'ports'} =~ s/\s+$//;
        if ($CLI{'ports'} =~ /[^0-9\-\, ]/) {
            nprint("+ ERROR: Invalid port option '$CLI{'ports'}'");
            exit 1;
        }
    }

    # output file - infer format from extension if not specified
    if (@formats == 0) {

        # No format specified, try to infer from file
        if (defined $CLI{'file'} && $CLI{'file'} ne '' && $CLI{'file'} ne '.') {
            my $ext = lc($CLI{'file'});
            $ext =~ s/(^.*\.)([^.]*$)/$2/g;
            $ext = 'txt' if $ext eq 'text';
            $ext = 'htm' if $ext eq 'html';
            if ($ext =~ /^(?:txt|htm|csv|json|sql|sqld|xml)$/) {
                push(@formats, $ext);
                $CLI{'formats'} = \@formats;
                $CLI{'format'}  = $ext;
            }
            else {
                $CLI{'format'} = 'none';
                push(@formats, 'none');
                $CLI{'formats'} = \@formats;
            }
        }
        else {
            $CLI{'format'} = 'none';
            push(@formats, 'none');
            $CLI{'formats'} = \@formats;
        }
    }

    # Check if we need files for any format
    my $needs_file = 0;
    foreach my $fmt (@formats) {
        if (($fmt ne "none") && ($fmt ne "sqld")) {
            $needs_file = 1;
            last;
        }
    }

    # Initialize files hash
    $CLI{'files'} = {};

    # File naming logic
    if ($CLI{'file'} eq '.') {

        # Auto-generate file names for each format
        if (@formats == 0 || ($formats[0] eq '')) {
            nprint("+ ERROR: Output format must be used with auto file naming");
            exit 1;
        }

        my $hn = $CLI{'host'};
        $hn =~ s/[^a-zA-Z0-9\.\-\_]/_/g;
        $hn =~ s/_+/_/g;
        my $port = $CLI{'ports'};
        $port =~ s/,/\-/g;
        $port =~ s/[^a-zA-Z0-9\.\-\_]/_/g;
        my $now = date_disp(time());
        $now =~ s/[^0-9-]/-/g;
        my $base_name = "nikto_" . $hn . "_" . $port . "_" . $now;
        $base_name =~ s/_+/_/g;

        # Generate file names for each format
        foreach my $fmt (@formats) {
            next if ($fmt eq "none" || $fmt eq "sqld");    # These don't need files

            my $file_name = $base_name . "." . $fmt;

            # Check if file exists and add counter if needed
            if (-e $file_name) {
                $file_name =~ /^(.*)(\.[a-z]{3,4})/;
                my $fn     = $1;
                my $ext    = $2;
                my $ctr    = 0;
                my $exists = 1;
                while ($exists) {
                    $ctr++;
                    my $new_name = $fn . "_" . $ctr . $ext;
                    if (!-e $new_name) {
                        $file_name = $new_name;
                        $exists    = 0;
                    }
                }
            }

            $CLI{'files'}{$fmt} = $file_name;
            nprint("- Auto-generated save file: $file_name",
                   "v", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        }
    }
    elsif (defined $CLI{'file'} && $CLI{'file'} ne '' && $CLI{'file'} ne '.') {

        # Use filename as prefix, append format extensions
        my $prefix = $CLI{'file'};

        # Generate file names for each format
        foreach my $fmt (@formats) {
            if ($fmt eq "none" || $fmt eq "sqld") {
                $CLI{'files'}{$fmt} = "";    # No file for these formats
                next;
            }

            # Append format extension to prefix only if not already present
            my $file_name;
            if ($prefix =~ /\.\Q$fmt\E$/i) {
                $file_name = $prefix;
            }
            else {
                $file_name = $prefix . "." . $fmt;
            }
            $CLI{'files'}{$fmt} = $file_name;
        }
    }
    else {
        # No file specified - only sqld/none formats allowed
        foreach my $fmt (@formats) {
            if ($fmt eq "none" || $fmt eq "sqld") {
                $CLI{'files'}{$fmt} = "";
            }
        }
    }

    # Validation: If file-based formats are specified but no output file, default to auto-generation
    if ((!defined $CLI{'file'} || $CLI{'file'} eq '') && $needs_file) {
        $CLI{'file'} = '.';

        # Re-run the auto-generation logic above (simplified, since formats are already parsed)
        my $hn = $CLI{'host'};
        $hn =~ s/[^a-zA-Z0-9\.\-\_]/_/g;
        $hn =~ s/_+/_/g;
        my $port = $CLI{'ports'};
        $port =~ s/,/\-/g;
        $port =~ s/[^a-zA-Z0-9\.\-\_]/_/g;
        my $now = date_disp(time());
        $now =~ s/[^0-9-]+/-/g;
        my $base_name = "nikto_" . $hn . "_" . $port . "_" . $now;
        $base_name =~ s/_+/_/g;

        foreach my $fmt (@formats) {
            next if ($fmt eq "none" || $fmt eq "sqld");

            my $file_name = $base_name . "." . $fmt;

            if (-e $file_name) {
                $file_name =~ /^(.*)(\.[a-z]{3,4})/;
                my $fn     = $1;
                my $ext    = $2;
                my $ctr    = 0;
                my $exists = 1;
                while ($exists) {
                    $ctr++;
                    my $new_name = $fn . "_" . $ctr . $ext;
                    if (!-e $new_name) {
                        $file_name = $new_name;
                        $exists    = 0;
                    }
                }
            }

            $CLI{'files'}{$fmt} = $file_name;
            nprint("- Auto-generated save file: $file_name",
                   "v", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        }
    }

    # Validation checks
    if ((defined $CLI{'file'}) && (@formats == 0 || ($formats[0] eq ""))) {
        nprint("+ ERROR: Output file specified without a format");
        exit 1;
    }

    if ((!defined $CLI{'file'} || $CLI{'file'} eq '') && $needs_file && @formats > 0) {
        nprint("+ ERROR: Output file format specified without a name");
        exit 1;
    }

    # verify readable dtd (check all formats for xml)
    if (grep { $_ eq 'xml' } @formats) {
        if (!defined $CONFIGFILE{'NIKTODTD'} || $CONFIGFILE{'NIKTODTD'} eq '') {
            nprint("+ ERROR: DTD not defined in configuration");
            exit 1;
        }

        # Check if DTD file exists
        my $dtd_path = $CONFIGFILE{'NIKTODTD'};
        if ($dtd_path !~ /^\// && defined $CONFIGFILE{'EXECDIR'}) {
            $dtd_path = "$CONFIGFILE{'EXECDIR'}/$dtd_path";
        }

        if (!-f $dtd_path) {
            nprint("+ ERROR: DTD file not found: $dtd_path");
            nprint("+ Please check your nikto.conf configuration");
            exit 1;
        }
    }

    # screen output
    if (defined $CLI{'display'}) {
        if ($CLI{'display'} =~ /d/i) { $OUTPUT{'debug'}          = 1; }
        if ($CLI{'display'} =~ /v/i) { $OUTPUT{'verbose'}        = 1; }
        if ($CLI{'display'} =~ /s/i) { $OUTPUT{'scrub'}          = 1; }
        if ($CLI{'display'} =~ /e/i) { $OUTPUT{'errors'}         = 1; }
        if ($CLI{'display'} =~ /p/i) { $OUTPUT{'progress'}       = 1; }
        if ($CLI{'display'} =~ /1/i) { $OUTPUT{'show_redirects'} = 1; }
        if ($CLI{'display'} =~ /2/i) { $OUTPUT{'show_cookies'}   = 1; }
        if ($CLI{'display'} =~ /3/i) { $OUTPUT{'show_ok'}        = 1; }
        if ($CLI{'display'} =~ /4/i) { $OUTPUT{'show_auth'}      = 1; }
    }

    # Fixup
    if (defined $CLI{'root'}) {
        $CLI{'root'} =~ s/\/$//;
        if (($CLI{'root'} !~ /^\//) && ($CLI{'root'} ne "")) { $CLI{'root'} = "/$CLI{'root'}"; }
    }

    if (defined $CLI{'evasion'}) {
        $CLI{'evasion'} =~ s/[^1-8AB]//g;
    }

    if (!defined $CLI{'plugins'} || $CLI{'plugins'} eq "") {
        $CLI{'plugins'} = '@@DEFAULT';
    }

    # Mapping for mutate for plugins
    if (defined $CLI{'mutate'}) {
        if ($CLI{'mutate'} =~ /1/ || $CLI{'mutate'} =~ /2/) {
            my $parameters;
            $parameters = "passfiles" if ($CLI{'mutate'} =~ /2/);
            $parameters .= ",all" if ($CLI{'mutate'} =~ /1/);
            $CLI{'plugins'} .= ';tests(' . $parameters . ')';
        }
        if ($CLI{'mutate'} =~ /3/ || $CLI{'mutate'} =~ /4/) {
            my $parameters;
            $parameters = "enumerate";
            $parameters .= ",home"    if ($CLI{'mutate'} =~ /3/);
            $parameters .= ",cgiwrap" if ($CLI{'mutate'} =~ /4/);
            $parameters .= ",dictionary:" . $CLI{'mutate-options'}
              if (defined $CLI{'mutate-options'});
            $CLI{'plugins'} .= ';apacheusers(' . $parameters . ')';
        }
        if ($CLI{'mutate'} =~ /6/) {
            $CLI{'plugins'} .= ';dictionary(dictionary:' . $CLI{'mutate-options'} . ')';
        }
        nprint(
            "- Mutate is deprecated, use -Plugins instead. The following option can be used in future: -Plugin $CLI{'plugins'}"
            );
    }

    # Asking questions?
    if ($CLI{'ask'} =~ /^(?:auto|yes|no)$/) {
        $CONFIGFILE{'UPDATES'} = $CLI{'ask'};    # override nikto.conf setting
        undef($CLI{'ask'});
    }

    $CLI{'timeout'} = $CLI{'timeout'} || 10;

    # RFI URL -- push it to VARIABLES
    if (defined $CONFIGFILE{'RFIURL'}) {
        $VARIABLES{'@RFIURL'} = $CONFIGFILE{'RFIURL'};
    }
    else {
        nprint("- ***** RFIURL is not defined in nikto.conf--no RFI tests will run *****");
    }

    # SSL Test
    if (!LW2::ssl_is_available()) {
        nprint("- ***** TLS/SSL support not available (see docs for SSL install) *****");
        if ($CLI{'ssl'} || ($CLI{'host'} =~ /^https/i)) {
            nprint("- ERROR: -ssl was specified but TLS/SSL is not available.");
            exit 1;
        }
    }

    # get core version
    open(FI, "<$CONFIGFILE{'PLUGINDIR'}/nikto_core.plugin");
    my @F = <FI>;
    close(FI);
    my @VERS = grep(/^#VERSION/, @F);
    $VARIABLES{'core_version'} = $VERS[0];
    $VARIABLES{'core_version'} =~ s/\#VERSION,//;
    chomp($VARIABLES{'core_version'});
    $VARIABLES{'TEMPL_HCTR'} = 0;

    if ($^O !~ /MSWin32/) {
        $NIKTO{'POSIX'}{'fd_stdin'} = fileno(STDIN);
        $NIKTO{'POSIX'}{'term'}     = POSIX::Termios->new();
        $NIKTO{'POSIX'}{'term'}->getattr($NIKTO{'POSIX'}{'fd_stdin'});
        $NIKTO{'POSIX'}{'oterm'}  = $NIKTO{'POSIX'}{'term'}->getlflag();
        $NIKTO{'POSIX'}{'echo'}   = ECHOE | ECHO | ECHOK | ICANON;
        $NIKTO{'POSIX'}{'noecho'} = $NIKTO{'POSIX'}{'oterm'} & ~$NIKTO{'POSIX'}{'echo'};
    }

    if ($CLI{'pause'} > 0) {
        nprint("-***** Pausing $CLI{'pause'} second(s) per request");
    }

    # Default values
    $COUNTERS{'totalrequests'} = 0;
    $COUNTERS{'total_checks'}  = 0;
    $COUNTERS{'total_targets'} = 0;

    $VARIABLES{'GMTOFFSET'} = gmt_offset();
    $VARIABLES{'DIV'}       = "-" x 75;
    $VARIABLES{'deferout'}  = 0;
    $VARIABLES{'defertxt'}  = [];

    # Some Win versions can't use Time::HiRes correctly
    $VARIABLES{'MSWIN32'} = 0;
    if ($^O =~ /MSWin32/) {
        $VARIABLES{'MSWIN32'} = 1;
    }

    return;
}

###############################################################################
sub time_to_seconds {
    my $time = $_[0] || return;
    if ($time =~ /m$/i) {
        $time =~ s/m$//i;
        $time = ($time * 60);
    }
    elsif ($time =~ /h$/i) {
        $time =~ s/h$//i;
        $time = ($time * 3600);
    }
    elsif ($time =~ /s$/i) {
        $time =~ s/s$//i;
    }
    return $time;
}

###############################################################################
sub sleeper {
    sleep($CLI{'pause'}) if defined $CLI{'pause'};
}

###############################################################################
sub safe_quit {
    my ($mark) = @_;

    # When called as a signal handler, $mark is the signal name (e.g. "INT"), not a hashref
    if (!ref($mark)) {
        $mark = $NIKTO{'current_mark'};
    }

    if (ref($mark)) {
        $mark->{'end_time'}       = time();
        $mark->{'elapsed'}        = $mark->{'end_time'} - $mark->{'start_time'};
        $COUNTERS{'scan_elapsed'} = (time() - $COUNTERS{'scan_start'});
        report_host_end($mark);
        report_summary($mark);
        report_close($mark);
    }
    $NIKTO{'POSIX'}{'term'}->setlflag($NIKTO{'POSIX'}{'oterm'}) if ($^O !~ /MSWin32/);
    exit 1;
}

###############################################################################
sub check_input {
    my ($mark) = @_;
    my $key = readkey();
    return if $key eq '';

    # Key to OUTPUT field mapping for toggles
    my %toggles = (v => 'verbose',
                   d => 'debug',
                   e => 'errors',
                   p => 'progress',
                   r => 'show_redirects',
                   c => 'show_cookies',
                   o => 'show_ok',
                   a => 'show_auth',
                   );

    if ($key eq ' ') {
        status_report($mark);
    }
    elsif (exists $toggles{$key}) {
        $OUTPUT{ $toggles{$key} } = !$OUTPUT{ $toggles{$key} };
    }
    elsif ($key eq 'q' || ord($key) == 3) {
        safe_quit($mark);
    }
    elsif ($key eq 'P') {
        status_report($mark);
        pause();
    }
    elsif ($key eq 'N') {
        nprint("- Terminating host scan.");
        return 'term';
    }
    return;
}
###############################################################################
sub pause {
    return if ($^O =~ /MSWin32/);
    nprint("- Pausing--press P to resume.");

    while (readkey() ne 'P') { sleep 1; }
    nprint("- Resuming.");
}
###############################################################################
sub readkey {
    return if $^O =~ /MSWin32/;    # Early return for Windows

    my $key;
    $NIKTO{'POSIX'}{'term'}->setlflag($NIKTO{'POSIX'}{'noecho'});
    $NIKTO{'POSIX'}{'term'}->setattr($NIKTO{'POSIX'}{'fd_stdin'}, TCSANOW);

    eval {
        local $SIG{ALRM} = sub { die; };
        ualarm(1_000);
        sysread(STDIN, $key, 1);
        ualarm(0);
    };

    $NIKTO{'POSIX'}{'term'}->setlflag($NIKTO{'POSIX'}{'oterm'});
    $NIKTO{'POSIX'}{'term'}->setattr($NIKTO{'POSIX'}{'fd_stdin'}, TCSANOW);

    return $key;
}

###############################################################################
sub resolve {
    my $ident  = $_[0] or return;
    my $report = defined $_[1] ? $_[1] : 1;
    my ($ip, $name, $ipcache) = "";
    my (@addresses, @scrub);
    my $is6 = 0;

    if (($CONFIGFILE{'PROXYHOST'} ne '') && $CLI{'useproxy'}) {
        return $ident, $ident, $ident;
    }

    if ($ident =~ /^$LW2::IPv4_re$/) {    # ident is IPv4
        $ip = $name = $ident;
    }
    elsif ($ident =~ /^\[?($LW2::IPv6_re_inc_zoneid)\]?$/) {
        $ip   = $1;
        $name = $ident;    # HTTP host header uses [IPv6] rather than the raw IPv6 address
    }
    else                   # not an IP, assume name & resolve
    {
        if ($CLI{'skiplookup'}) {
            nprint("+ ERROR: -nolookup set, but given name\n");
            exit 1;
        }

        if ($LW2::LW2_CAN_IPv6) {    # IPv4/v6 resolve
            use Socket qw(:addrinfo SOCK_RAW);
            my ($err, @res) = Socket::getaddrinfo($ident, "", { socktype => SOCK_RAW });
            if ($err) {
                my $msg = "ERROR: Cannot resolve hostname '$ident' because '$err'.";
                if ($ident =~ /^\[?($LW2::IPv6_re_inc_zoneid)\]?$/) {
                    $msg .= " Use the -ipv6 flag if needed.";
                }
                if ($CLI{'ipv6'}) {
                    $msg .=
                      " Ensure you have IPv6 connectivity. Trying running Nikto with the '-check6' flag.";
                }
                return $ident, '', $ident, $msg;
            }

            foreach my $res (@res) {
                my ($err, $ip) = Socket::getnameinfo($res->{addr}, NI_NUMERICHOST, NIx_NOSERV);
                push @addresses, $ip unless $err;
            }

        }
        else {    # Traditional IPv4 resolve
            if ($hent = gethostbyname($ident)) {
                my $addr_ref = $hent->addr_list;
                @addresses = map { inet_ntoa($_) } @$addr_ref;
            }
        }

        my @temp4_ipcache;
        my @temp6_ipcache;
        my %seen;
        foreach $temp_ip (@addresses) {
            if ($temp_ip =~ /:/) {
                push @temp6_ipcache, $temp_ip if !$seen{$temp_ip}++;
            }
            else {
                push @temp4_ipcache, $temp_ip if !$seen{$temp_ip}++;
            }
        }

        $ip = ($CLI{'ipv6'}) ? shift @temp6_ipcache : shift @temp4_ipcache;
        push(@scrub, $ip, @temp4_ipcache, @temp6_ipcache);
        $ipcache = join ", ", (@temp4_ipcache, @temp6_ipcache);

        if ($ip eq '') {
            if ($CLI{'ipv6'} && scalar @temp4_ipcache) {
                nprint(
                    "+ ERROR: IPv6 scanning mode requested but only IPv4 addresses found ($ipcache)"
                    );
            }
            elsif ($CLI{'ipv4'} && scalar @temp6_ipcache) {
                nprint(
                    "+ ERROR: IPv4 scanning mode requested but only IPv6 addresses found ($ipcache)"
                    );
            }
            exit 1;
        }

        if ($ipcache ne "" && $report) {
            nprint("+ Multiple IPs found: $ip, $ipcache", "", @scrub);
        }

        if (   $ip !~ /^$LW2::IPv4_re$/
            && $ip !~ /^$LW2::IPv6_re$/) {
            nprint("+ ERROR: Invalid IP: $ip\n\n",
                   "", ($ident, $ip, $ident));
            exit 1;
        }

        $name = $ident;
    }

    my $displayname = ($name) ? $name : $ip;
    return $name, $ip, $displayname;
}

###############################################################################
sub set_targets {
    my ($hostlist, $portlist, $ssl, $root) = @_;
    my $host_ctr  = 1;
    my @hosts     = split(/,/, $hostlist);
    my @tempports = split(/,/, $portlist) if defined $portlist;
    my (@ports, @checkhosts, @results, @marks);
    my $defaultport = ($ssl) ? 443 : 80;

    nprint("- Getting targets", "v", "Init");

    # Check for portlist and expand
    foreach my $port (@tempports) {
        if ($port =~ /-/) {
            my ($start, $end);
            my @temp = split(/-/, $port);
            $start = $temp[0];
            $end   = $temp[1];
            if ($start eq "") { $start = 0; }
            if ($end eq "")   { $end   = 65535; }
            if ($start > $end) {
                nprint("+ ERROR port range $port doesn't make sense - assuming 80/tcp");
                next;
            }
            for (my $i = $start ; $i <= $end ; $i++) {
                push(@ports, $i);
            }
        }
        else {
            push(@ports, $port);
        }
    }

    # no ports explicitly set, so use default port
    if (scalar(@ports) == 0) {
        push(@ports, $defaultport);
    }

    # check whether -h is a file or an entry
    foreach my $host (@hosts) {
        if (-f $host || $host eq "-") {
            @results = parse_hostfile($host);
            push(@checkhosts, @results);
        }
        else {
            push(@checkhosts, $host);
        }
    }

    # Now parse the list of checkhosts
    foreach my $host (@checkhosts) {
        $host =~ s/\s+//g;
        if ($host eq '') { next; }
        my $markhash = {};
        $markhash->{'root'}      = $root;
        $markhash->{'cookiejar'} = LW2::cookie_new_jar();

        # is it a URL?
        if ($host =~ /^https?:\/\//) {

            if ($CLI{'ports'} ne '') {
                nprint("- ERROR: The -port option cannot be used with a full URI");
                exit 1;
            }
            my @hostdata = LW2::uri_split($host);
            $markhash->{'ident'} = $hostdata[2];
            $markhash->{'port'}  = $hostdata[3];
            if ($markhash->{'port'} eq '') {
                if   ($host =~ /^https:/) { $markhash->{'port'} = 443; }
                else                      { $markhash->{'port'} = $defaultport; }
            }

            # If URL included a path, add that as the root unless -root was specified
            if (($hostdata[0] ne '/') && ($hostdata[0] ne '') && ($markhash->{'root'} eq '')) {
                $hostdata[0] =~ s/\/$//;
                $markhash->{'root'} = $hostdata[0];
                nprint("- Added -root value of '$hostdata[0]' from URI",
                       "v", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
            }
            push(@marks, $markhash);
        }
        else {
            if ((index $host, '[') == 0) {    # looks like accepted IPv6 format
                if ($host =~ /^(\[?$LW2::IPv6_re_inc_zoneid\]?)(?:[:](\d+))?$/) {
                    $markhash->{'ident'} = $1;
                    $markhash->{'port'}  = $2;
                    push(@marks, $markhash);
                }
                else {
                    nprint("- ERROR: Unrecognised target host format: $host",
                           "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
                }
            }
            else {
                my @h = split(/\:|\,/, $host);
                if (scalar @h > 2 || $h[0] eq '') { # Possible invalid IPv6 format has been supplied
                    nprint(
                        "- ERROR: Target host '$host' contains more than one colon (:). If specifying an IPv6 target, use the [IPv6] format.",
                        "",
                        ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'})
                        );
                }
                else {
                    $markhash->{'ident'} = $h[0];
                    if ($h[1] !~ /[^0-9]/ && $h[1] ne '') {
                        $markhash->{'port'} = $h[1];
                        push(@marks, $markhash);
                    }
                    else {
                        # push unique array ref for each port
                        my $ti = $markhash->{'ident'};
                        my $tr = $markhash->{'root'};
                        foreach my $p (@ports) {
                            my $markhash = { 'port'  => $p,
                                             'root'  => $tr,
                                             'ident' => $ti
                                             };

                            $markhash->{'port'} = $p;
                            push(@marks, $markhash);
                        }
                    }
                }
            }
        }
    }
    return @marks;
}

###############################################################################
sub platform_profiler {
    if (defined $CLI{'platform'}) {
        if ($CLI{'platform'} =~ /(nix|win|all)/i) {
            return $CLI{'platform'};
        }
        else {
            $VARIABLES{'deferout'} = 0;
            nprint("+ ERROR: Invalid platform: $CLI{'platform'}");
            exit 1;
        }
    }

    my ($mark) = @_;
    my @profile_pages = ("/",               "/server-status",
                         "/icons/",         "/trace.axd",
                         "/nosuchfile.asp", "/nosuchfile.aspx",
                         "/localstart.asp", "/docs/",
                         "/server"
                         );

    foreach my $file (@profile_pages) {
        my ($res, $content, $error, $request, $response) =
          nfetch($mark, $file, "GET", "", "", "", "platform_profiler");

        # Look for indicators of the platform in the Server header
        if (   $mark->{'banner'}
            && $VARIABLES{'@PLATFORMNIX'}
            && $mark->{'banner'} =~ /$VARIABLES{'@PLATFORMNIX'}/i) {
            return 'nix';
        }
        elsif (   $mark->{'banner'}
               && $VARIABLES{'@PLATFORMWIN'}
               && $mark->{'banner'} =~ /$VARIABLES{'@PLATFORMWIN'}/i) {
            return 'win';
        }

        # check the response body
        if ($content && $content =~ /$VARIABLES{'@PLATFORMNIX'}/i) {
            return 'nix';
        }
        elsif ($content && $content =~ /$VARIABLES{'@PLATFORMWIN'}/i) {
            return 'win';
        }

        # check the response headers
        if ($response && ref($response) eq 'HASH') {
            foreach my $header (keys %$response) {
                my $value = $response->{$header};
                next unless defined $value;

                # Check header name
                if ($header =~ /$VARIABLES{'@PLATFORMNIX'}/i) {
                    return 'nix';
                }
                elsif ($header =~ /$VARIABLES{'@PLATFORMWIN'}/i) {
                    return 'win';
                }

                # Check header value (handle arrays)
                my $header_value = ref($value) eq 'ARRAY' ? join(', ', @$value) : $value;
                if ($header_value =~ /$VARIABLES{'@PLATFORMNIX'}/i) {
                    return 'nix';
                }
                elsif ($header_value =~ /$VARIABLES{'@PLATFORMWIN'}/i) {
                    return 'win';
                }
            }
        }
    }

    return 'all';
}

###############################################################################
sub load_databases {
    my @dbs    = qw/db_useragents db_404_strings  db_outdated  db_variables db_headers_suggested/;
    my $prefix = $_[0] || '';

    # Only load the right databases if -Userdbs is set
    if ((defined($CLI{'userdbs'})) && ($CLI{'userdbs'} eq 'all')) {
        if   ($prefix eq '') { return; }
        else                 { push(@dbs, 'db_tests'); }
    }
    if (($prefix eq 'u') || (!defined($CLI{'userdbs'}))) { push(@dbs, 'db_tests'); }

    # verify required files
    for my $file (@dbs) {
        if (!-r "$CONFIGFILE{'DBDIR'}/$file") {
            nprint("+ ERROR: Can't find/read required file \"$CONFIGFILE{'DBDIR'}/$file\"");
            exit 1;
        }
    }

    for my $file (@dbs) {
        my $filename = $CONFIGFILE{DBDIR} . "/" . $prefix . $file;
        if (!-r $filename) { next; }
        nprint("- Loading DB: $filename", "d");
        open(IN, "<$filename") || die nprint("+ ERROR: Can't open \"$filename\":$@\n");

        # db_tests
        if ($file =~ /u?db_tests/) { push(@DBFILE, <IN>); next; }

        # all the other files require per-line processing
        else {
            my @file;

            # Cleanup
            while (<IN>) {
                chomp;
                $_ =~ s/#.*$//;
                $_ =~ s/\s+$//;
                $_ =~ s/^\s+//;
                if ($_ ne "") { push(@file, $_); }
            }

            # db_variables
            if ($file =~ /u?db_variables/) {
                foreach my $l (@file) {
                    if ($l =~ /^@/) {
                        next if $l eq '';
                        my @temp = split(/=/, $l, 2);    # Limit to 2 parts to handle = in values
                        if (   @temp >= 2
                            && defined($temp[0])
                            && defined($temp[1])
                            && $temp[0] ne ''
                            && $temp[1] ne '') {
                            $temp[0] =~ s/^\s+|\s+$//g;
                            $VARIABLES{ $temp[0] } = $temp[1];
                        }
                    }
                }
            }

            # db_headers_suggested
            elsif ($file =~ /u?db_headers_suggested/) {
                foreach my $l (@file) {
                    my @T = parse_csv($l);
                    next if $T[0] eq '';
                    $VARIABLES->{'SUGGESTED_HEADERS'}->{ $T[0] } = $T[1];
                }
            }

            # db_404_strings
            elsif ($file =~ /u?db_404_strings/) {
                foreach my $l (@file) {
                    if ($l =~ /^\@CODE=/) {
                        $l =~ s/^\@CODE=//;
                        $l = validate_and_fix_regex($l);
                        $VARIABLES{'ERRCODES'}->{$l} = 1;
                    }
                    else {
                        $l = validate_and_fix_regex($l);
                        $VARIABLES{'ERRSTRINGS'}->{$l} = 1;
                    }
                }
            }

            # db_outdated
            elsif ($file =~ /u?db_outdated/) {
                foreach my $l (@file) {
                    my @T = parse_csv($l);
                    next if $T[1] eq '';
                    $T[1]                    = validate_and_fix_regex($T[1]);
                    $OVERS{ $T[1] }{ $T[2] } = $T[3];
                    $OVERS{ $T[1] }{'tid'}   = $T[0];
                }
            }

            # db_useragents
            elsif ($file =~ /u?db_useragents/) {
                $VARIABLES{'@USERAGENTS'} = [];
                foreach my $l (@file) {
                    next if $l =~ /^\#/;
                    next if $l eq '';
                    $l =~ s/^\s+//;
                    $l =~ s/\s+$//;
                    push @{ $VARIABLES{'@USERAGENTS'} }, $l;
                }
            }
            close(IN);
        }
    }

    return;
}

###############################################################################
# Get directory listing
sub dirlist {
    my $DIR       = $_[0] || return;
    my $PATTERN   = $_[1] || "";
    my @FILES_TMP = ();

    opendir(DIRECTORY, $DIR) || die print STDERR "+ ERROR: Can't open directory '$DIR': $@";
    foreach my $file (readdir(DIRECTORY)) {
        if ($file =~ /^\./) { next; }    # skip hidden files, '.' and '..'
        if ($PATTERN ne "") {
            if ($file =~ /$PATTERN/) { push(@FILES_TMP, $file); }
        }
        else { push(@FILES_TMP, $file); }
    }
    closedir(DIRECTORY);

    return @FILES_TMP;
}
###############################################################################
sub check_dbs {
    @dbs = dirlist($CONFIGFILE{'DBDIR'}, "^u?db_*");
    my %ALL_IDS;

    for my $file (@dbs) {
        my $filename = $CONFIGFILE{DBDIR} . "/" . $prefix . $file;
        if (!-r $filename) {
            nprint("+ ERROR: Unable to read \"$filename\"");
            next;
        }
        open(IN, "<$filename") || die nprint("+ ERROR: Can't open \"$filename\":$@\n");
        nprint("Syntax Check: $filename");

        if ($file =~ /u?db_outdated/) {
            my $count = 0;
            my %BANNER;
            foreach $line (<IN>) {
                $line =~ s/^\s+//;
                if ($line =~ /^\#/) { next; }
                chomp($line);
                if ($line eq "" || $line =~ /"nikto_id"/) { next; }
                $count++;
                my @L = parse_csv($line);
                if ($#L ne 3) { nprint("\t+ ERROR: Invalid syntax ($#L): $line"); next; }
                if (($L[0] ne 0) && exists($ALL_IDS{ $L[0] })) {
                    nprint("\t+ ERROR: Duplicate Test ID: $L[0]");
                }
                else { $ALL_IDS{ $L[0] } = 1; }
                if (exists($BANNER{ $L[1] }) && $L[0] !~ /(600067|600068|601085)/i) {
                    nprint("\t+ ERROR: Duplicate Server Banner: $line");
                    nprint(  "\t+ If this expected/needed: Please add the ID $L[0] at line "
                           . (__LINE__- 2)
                           . " in the nikto_core.plugin.");
                }
                else { $BANNER{ $L[1] } = 1; }
            }
            nprint("\t$count entries");
        }
        elsif ($file =~ /u?db_favicon/ || $file =~ /u?db_domino/) {
            my $counter = 0;
            my %ENTRY;
            foreach $line (<IN>) {
                $line =~ s/^\s+//;
                if ($line =~ /^\#/) { next; }
                chomp($line);
                if ($line eq "" || $line =~ /"nikto_id"/) { next; }
                $counter++;
                my @L = parse_csv($line);
                if ($#L ne 2) { nprint("\t+ ERROR: Invalid syntax ($#L): $line"); next; }
                if (($L[0] ne 0) && exists($ALL_IDS{ $L[0] })) {
                    nprint("\t+ ERROR: Duplicate Test ID: $L[0]");
                }
                else { $ALL_IDS{ $L[0] } = 1; }
                if (exists($ENTRY{ $L[1] })) {
                    nprint("\t+ ERROR: Duplicate entry: $line");
                }
                else { $ENTRY{ $L[1] } = 1; }
            }
            nprint("\t$counter entries");
        }

        elsif ($file =~ /u?db_tests/) {
            my %ENTRIES;
            foreach my $line (<IN>) {
                chomp($line);
                $line =~ s/^\s+//;
                if ($line =~ /^\#|^$/) { next; }
                my @L = parse_csv($line);

                # Validate field count (should be 9 fields)
                if ((count_fields($line, 1) ne 8) && (count_fields($line) ne '')) {
                    nprint(  "\t+ ERROR: Invalid syntax - expected 9 fields, got "
                           . (scalar(@L))
                           . ": $line");
                    next;
                }

                # Validate method
                if (   ($L[4] !~ /(GET|POST|TRACE|TRACK|OPTIONS|SEARCH|INDEX)/i)
                    && ($L[0] ne '006433')) {
                    nprint("\t+ ERROR: Possibly invalid method: $L[4] on ($line)");
                }

                # Validate DSL field is not empty
                if ($L[5] eq "") {
                    nprint("\t+ ERROR: blank DSL field: $line");
                    next;
                }

                # Validate DSL syntax
                my $dsl_to_validate = $L[5];
                if (defined $dsl_to_validate && length $dsl_to_validate) {

        # Expand @LFI() placeholder before validation, since it needs to be expanded to be valid DSL
                    $dsl_to_validate = expand_lfi_dsl($dsl_to_validate);

                    if (defined $dsl_to_validate && length $dsl_to_validate) {
                        eval { parse_dsl($dsl_to_validate); };
                        if ($@) {
                            nprint(
                                "\t+ ERROR: Invalid DSL syntax in test $L[0] field 5: \"$L[5]\", error: $@"
                                );
                        }
                    }
                    else {
                        nprint("\t+ ERROR: Empty DSL field test $L[0]");
                    }
                }

                # Validate URI format
                if (($L[3] =~ /^\@CG/) && ($L[3] !~ /^\@CGIDIRS/)) {
                    nprint("\t+ ERROR: Possible \@CGIDIRS misspelling: $line");
                }
                if ($L[3] =~ /[\s]/) {
                    nprint("\t+ ERROR: space in file portion test #$L[0]: '$L[3]'");
                }

                # Validate CSV format
                if ($line =~ /[^\\]"\s/) {
                    nprint("\t+ ERROR: space after quote #$L[0]: $line");
                }
                if ($line =~ /\s"/) {
                    nprint("\t+ ERROR: space before quote #$L[0]: $line");
                }

                # Check for duplicate entries
                $ENTRIES{"$L[3],$L[4],$L[5],$L[6],$L[7],$L[8]"}++;

                # Validate Test ID
                if (($L[0] ne 0) && exists($ALL_IDS{ $L[0] })) {
                    nprint("\t+ ERROR: Duplicate Test ID: $L[0]");
                }
                else {
                    $ALL_IDS{ $L[0] } = 1;
                }

                # Validate Tuning Type
                if ($L[2] eq "" || $L[2] =~ /[^a-f0-9]/) {
                    nprint("\t+ ERROR: Invalid Tuning Type: $line");
                }

                # Validate URI patterns
                if (   $L[3] =~ '^(/@(?!JUNK)|//)'
                    && $L[0] !~
                    /(000396|000447|000543|000544|000545|000928|000929|001208|001373|001497|002761|002762|003029|007152)/i
                    ) {
                    nprint("\t+ ERROR: Possible incorrect slashes: $line");
                    nprint(
                        "\t+ If two or more slashes are needed for this test: Please add the ID $L[0] at line "
                          . (__LINE__- 2)
                          . " in the nikto_core.plugin.");
                }
                if ($L[3] =~ '^@(?!JUNK)[A-Z]+/' && $L[0] !~ /(003348|003349)/i) {
                    nprint("\t+ ERROR: Possible incorrect slash after \@VARIABLE: $line");
                    nprint(
                        "\t+ If this slash is needed for this test: Please add the ID $L[0] at line "
                          . (__LINE__- 2)
                          . " in the nikto_core.plugin.");
                }

                # Validate POST data usage
                if ((($L[4] ne 'POST') && ($L[4] ne 'SEARCH')) && ($L[7] ne '')) {

                    # Some test IDs need this
                    if ($L[0] !~ /(006992|000126|000291|001153)/i) {
                        nprint(
                            "\t+ ERROR: Possible incorrect use of POST data without POST method on line: $line"
                            );
                        nprint(
                            "\t+ If the POST data is needed for this test: Please add the ID $L[0] at line "
                              . (__LINE__- 2)
                              . " in the nikto_core.plugin.");
                    }
                }
            }
            foreach $entry (keys %ENTRIES) {
                if ($ENTRIES{$entry} > 1) {
                    nprint("\t+ ERROR: Duplicate Check Syntax ($ENTRIES{$entry}): $entry");
                }
            }
            nprint("\t" . keys(%ENTRIES) . " entries");
        }
        elsif ($file =~ /u?db_variables/) {
            my $ctr = 0;
            foreach $line (<IN>) {
                if ($line !~ /^\@/)         { next; }
                if ($line !~ /^\@.+\=.+$/i) { nprint("\t+ ERROR: Invalid syntax: $line"); }
                $ctr++;
            }
            nprint("\t$ctr entries");
        }
        elsif ($file =~ /u?db_404_strings/ || $file =~ /u?db_dictionary/) {
            my $ctr = 1;
            my %STRINGS;
            foreach $line (<IN>) {
                chomp($line);
                $line =~ s/\#.*$//;
                next if $line eq '';
                my ($result, $bad) = validate_and_fix_regex($line, 1);
                if ($bad) { nprint("\t+ ERROR: Invalid regex on line $ctr: \"$line\""); }
                if (exists($STRINGS{$line})) {
                    nprint("\t+ ERROR: Duplicate String: $line");
                }
                else { $STRINGS{$line} = 1; }
                $ctr++;
            }
            $ctr--;
            nprint("\t$ctr entries");
        }

        elsif ($file =~ /u?db_headers_suggested/) {
            my $ctr = 0;
            my %HEADERS;
            foreach $line (<IN>) {
                chomp($line);
                $line =~ s/\#.*$//;
                next if $line eq '';
                my @fields = parse_csv($line);

                # Skip header line if present
                if ($fields[0] =~ /^header$/i) { next; }
                if (scalar(@fields) != 2) {
                    nprint("\t+ ERROR: Invalid syntax (expected 2 fields): $line");
                }
                if (exists($HEADERS{ $fields[0] })) {
                    nprint("\t+ ERROR: Duplicate Header: $fields[0]");
                }
                else {
                    $HEADERS{ $fields[0] } = 1;
                }
                $ctr++;
            }
            nprint("\t$ctr entries");
        }
        elsif ($file =~ /u?db_headers_common/) {
            my $ctr = 0;
            my %HEADERS;
            foreach $line (<IN>) {
                chomp($line);
                $line =~ s/\#.*$//;
                next if $line eq '';
                if ((count_fields($line) ne 0) && (count_fields($line) ne '')) {
                    nprint("\t+ ERROR: Invalid syntax: $line");
                }
                if (exists($HEADERS{$line})) {
                    nprint("\t+ ERROR: Duplicate Header: $line");
                }
                else { $HEADERS{$line} = 1; }
                $ctr++;
            }
            nprint("\t$ctr entries");
        }
        elsif ($file =~ /u?db_multiple_index/) {
            my $ctr = 0;
            foreach $line (<IN>) {
                if ((count_fields($line) ne 0) && (count_fields($line) ne '')) {
                    nprint("\t+ ERROR: Invalid syntax: $line");
                }
                $ctr++;
            }
            nprint("\t$ctr entries");
        }
        elsif ($file =~ /u?db_useragents/) {
            my $ctr = 0;
            foreach $line (<IN>) {
                chomp($line);
                next if $line =~ /^\#/;
                next if $line eq '';
                if ($line !~ /^\"[^"]+\"/) {
                    nprint("\t+ ERROR: Invalid syntax: $line");
                }
                $ctr++;
            }
            nprint("\t$ctr entries");
        }
        else {
            # It's a file of standard DB type, we can do this intelligently
            my (@headers, @regex_fields);
            my $ctr = 0, $fields = 0;
            foreach $line (<IN>) {
                $line =~ s/^#.*//;
                next if $line eq "";

                # first, grab the headers
                if ($fields == 0) {
                    @headers = parse_csv($line);
                    $fields  = $#headers;

                    # check regex fields for syntax
                    for (my $i = 0 ; $i <= $#headers ; $i++) {
                        if (   ($headers[$i] eq 'match')
                            || ($headers[$i] eq 'matchstring')
                            || ($headers[$i] eq 'server')) {
                            push(@regex_fields, $i);
                        }
                    }
                    next;
                }

                chomp($line);
                next if $line eq "";
                my @entry = parse_csv($line);
                if ($regex_fields[0] ne '') {
                    foreach my $f (@regex_fields) {
                        my ($result, $bad) = validate_and_fix_regex($entry[$f], 1);
                        if ($bad) {
                            nprint("\t+ ERROR: Invalid regex in field $f on line $ctr: \"$line\"");
                        }
                    }
                }

                if (   (count_fields($line, 1) != $fields - 1)
                    && (count_fields($line) ne '')) {
                    nprint("\t+ ERROR: Invalid syntax: $line");
                }

                if (($entry[0] ne 0) && exists($ALL_IDS{ $entry[0] })) {
                    nprint("\t+ ERROR: Duplicate Test ID: $entry[0]");
                }
                else { $ALL_IDS{ $entry[0] } = 1; }

                $ctr++;
            }
            nprint("\t$ctr entries");
        }

        close(IN);
    }

    # Try to grab the test IDs from plugins to check for duplicates. Not foolproof.
    nprint("Checking plugins for duplicate test IDs");
    my $found      = 0;
    my @pluginlist = dirlist("$CONFIGFILE{'PLUGINDIR'}", '\.plugin$');
    foreach my $pf (@pluginlist) {
        open(PF, "<$CONFIGFILE{'PLUGINDIR'}/$pf")
          || die print STDERR "+ ERROR: Unable to open '$pf': $@\n";
        my @file = <PF>;
        close(PF);
        my @adds = grep(/add_vulnerability\(/, @file);
        foreach my $addv (@adds) {
            chomp($addv);
            my @bits = parse_csv($addv);
            $bits[2] =~ s/\s+//g;
            $bits[2] =~ s/\"//g;
            if ($bits[2] =~ /^[\d]+$/) {
                if (($bits[2] ne 0) && exists($ALL_IDS{ $bits[2] })) {
                    $found++;
                    nprint("\t+ ERROR: Duplicate Test ID: $bits[2]");
                }
                else { $ALL_IDS{ $bits[2] } = 1; }
            }
        }
    }
    nprint("\t$found entries");

    # Bad practice here but this one won't parse right above ¯\_(ツ)_/¯
    $ALL_IDS{'000137'} = 1;    # TLS issues

    # Look for bad/invalid IDs
    foreach my $id (keys %ALL_IDS) {
        chomp($id);
        next if (($id eq 0) || ($id eq '') || ($id eq 'nikto_id'));
        if ($id =~ /[^\d]/)  { nprint("+ ERROR: Invalid test ID: $id"); next; }
        if (length($id) < 6) { nprint("+WARNING: Possibly invalid test ID: $id"); }
    }

    # Suggest some open IDs
    my @open;
    my $id   = '000001';
    while ($#open < 6) {
        if (!exists($ALL_IDS{$id})) { push(@open, $id); }
        $id++;
    }
    nprint("\nSome (probably) open IDs: " . join(", ", @open));

    nprint("\n");
    exit 1;
}

###############################################################################
sub count_fields {
    my $line    = $_[0] || return;
    my $checkid = $_[1] || 0;
    if ($line !~ /^\"/) { return; }
    chomp($line);
    $line =~ s/\s+$//;
    if ($line eq '') { return; }
    my @L = parse_csv($line);
    if ($checkid && ($L[0] ne 'nikto_id') && (($L[0] =~ /[^0-9]/) || ($L[0] eq ''))) { return -1; }
    return $#L;
}

###############################################################################
sub port_check {
    my ($start_time, $hostname, $ip, $port, $key, $cert, $vhost) = @_;
    my $m = {};

    $m->{'start_time'} = $start_time;
    $m->{'hostname'}   = $vhost || $hostname;
    $m->{'ip'}         = $ip;
    $m->{'port'}       = $port;
    $m->{'ssl'}        = 0;

    my @checktypes;
    if    ($CLI{'nossl'})                            { @checktypes = ('HTTP'); }
    elsif ($CLI{'ssl'} || $CLI{'host'} =~ /^https/i) { @checktypes = ('HTTPS'); }
    else                                             { @checktypes = ('HTTP', 'HTTPS'); }

    foreach my $method (split(/ /, $CONFIGFILE{'CHECKMETHODS'})) {
        $request{'whisker'}->{'method'} = $method;
        foreach my $checkssl (@checktypes) {
            nprint("- Checking for $checkssl on "
                     . ($m->{'hostname'} || $m->{'ip'})
                     . ":$port, using $method",
                   "v",
                   "CheckSSL",
                   ($m->{'hostname'}, $m->{'ip'}, $m->{'displayname'})
                   );
            $m->{ssl} = ($checkssl eq "HTTP") ? 0 : 1;
            if ($m->{'ssl'}) {
                $m->{'key'}  = $key;
                $m->{'cert'} = $cert;
            }
            proxy_check($m);
            my ($res, $content, $error, $request, $response) =
              nfetch($m, "/", $method, "", "", { noerror => 1, noprefetch => 1, nopostfetch => 1 },
                     "PortCheck");

            if ($res) {

                # Some Apache servers are annoying and answer non-TLS requests on a TLS server.
                if (defined $content
                    && ($content =~ /plain HTTP (?:to an SSL|request was sent to HTTPS)/)) {
                    dump_var("Result Hash", \%result,
                             ($m->{'hostname'}, $m->{'ip'}, $m->{'displayname'}));
                    next;
                }
                nprint("- $checkssl server found: "
                         . ($m->{'hostname'} || $m->{'ip'})
                         . ":$port \t$response->{server}",
                       "d",
                       ($m->{'hostname'}, $m->{'ip'}, $m->{'displayname'})
                       );
                return $m->{'ssl'} + 1;
            }
        }
    }

    my $msg = "Unable to connect to " . ($hostname || $ip) . ":$port";
    if ($CLI{'ipv6'}) {
        $msg .=
          ". Ensure you have IPv6 connectivity. Trying running Nikto with the '-check6' flag.";
    }

    nprint($VARIABLES{'DIV'});
    return $msg;
}

###############################################################################
sub load_plugins {
    my @pluginlist = dirlist("$CONFIGFILE{'PLUGINDIR'}", '\.plugin$');
    my @all_names;

    # populate plugin macros
    $CONFIGFILE{'@@NONE'} = "";

    # Check if running plugins is NONE - if so, don't bother initializing plugins
    if ($CLI{'plugins'} eq '@@NONE') {
        return;
    }

    foreach my $plugin (@pluginlist) {
        my $plugin_name = $plugin;
        $plugin_name =~ s/\.plugin$//;
        my $plugin_init = $plugin_name . "_init";
        eval { require "$CONFIGFILE{'PLUGINDIR'}/$plugin"; };
        if ($@) {
            nprint("- Could not load or parse plugin: $plugin_name\n Error: ");
            warn $@;
            nprint("- The plugin could not be run.");
        }
        else {
            nprint("- Initializing plugin $plugin_name", "v", "Init");

            # Call initialisation method
            if (defined &$plugin_init) {
                my $pluginhash = &$plugin_init;

                # Add default weights if not already assigned
                while (my ($hook, $hook_params) = each(%{ $pluginhash->{'hooks'} })) {
                    $hook_params->{$hook}->{'weight'} = 50
                      unless (defined $hook_params->{$hook}->{'weight'});
                }
                $pluginhash->{report_weight} = 50 unless (defined $pluginhash->{report_weight});
                push(@all_names, $pluginhash->{name});

                push(@PLUGINS, $pluginhash);
                nprint("- Loaded \"$pluginhash->{full_name}\" plugin.", "v", "Init");
            }
            else {
                nprint("WARNING: No init found for $plugin_name\n", "d");
            }
        }
    }
    $CONFIGFILE{'@@ALL'} = join(';', @all_names);
    my @torun = split(/;/, expand_pluginlist($CLI{'plugins'}, 0));

    # Force-enable report plugins if needed
    if ($CLI{'plugins'} =~ /\@NONE/ && defined $CLI{'formats'} && ref($CLI{'formats'}) eq 'ARRAY') {
        my %format_map = ('csv'  => 'report_csv',
                          'json' => 'report_json',
                          'htm'  => 'report_html',
                          'html' => 'report_html',
                          'sql'  => 'report_sqlg',
                          'sqld' => 'report_sqld',
                          'txt'  => 'report_text',
                          'xml'  => 'report_xml'
                          );

        foreach my $fmt (@{ $CLI{'formats'} }) {
            if (exists $format_map{$fmt}) {
                push(@torun, $format_map{$fmt}) unless grep { $_ eq $format_map{$fmt} } @torun;
            }
        }
    }

    # Second pass to ensure that @@ALL is configured
    foreach my $plugin (@PLUGINS) {

        # Check that the plugin is to be run
        # Perl doesn't allow us to use "in", pity
        foreach my $torun_plugin (@torun) {
            next if ($torun_plugin eq "");

            # split up into parameters
            my $name = my $suffix = $torun_plugin;
            if ($torun_plugin =~ /\(/) {
                $name   =~ s/(.*)(\(.*\))/$1/;
                $suffix =~ s/(.*)(\(.*\))/$2/;
            }
            else {
                $name   = $torun_plugin;
                $suffix = "";
            }
            if ($plugin->{'name'} =~ /$name/i) {
                $plugin->{'run'} = 1;

                # Create parameters
                if ($suffix ne "") {
                    my $parameters = {};
                    $suffix =~ s/(\()(.*[^\)])(\)?)/$2/;
                    foreach my $parameter (split(/,/, $suffix)) {
                        if ($parameter !~ /:/) {
                            $parameters->{$parameter} = 1;
                        }
                        else {
                            my $key = my $value = $parameter;
                            $key   =~ s/:.*//;
                            $value =~ s/.*://;
                            $parameters->{$key} = $value;
                        }
                    }
                    $plugin->{'parameters'} = $parameters;
                }
            }
        }
    }

    # first build a temporary hash of all known hooks
    my %hooks;
    foreach my $plugin (@PLUGINS) {
        foreach my $hook (keys(%{ $plugin->{'hooks'} })) {
            $hooks{$hook} = ();
        }
    }

    # now we know the types of hooks, look through each plugin for them
    foreach my $hook (keys(%hooks)) {
        foreach my $plugin (@PLUGINS) {
            if ($plugin->{'run'} == 1) {
                if (defined $plugin->{'hooks'}->{$hook}->{'method'}) {
                    push(@{ $hooks{$hook} }, $plugin);
                }
            }
        }
    }

    # Now sort each array by weight
    foreach my $hook (keys(%hooks)) {
        my @sorted =
          sort { $a->{'hooks'}->{$hook}->{'weight'} <=> $b->{'hooks'}->{$hook}->{'weight'} }
          @{ $hooks{$hook} };
        $PLUGINORDER{$hook} = \@sorted;
    }
}

###############################################################################
sub run_hooks {
    my ($mark, $type, $request, $response) = @_;

    # Cache plugin array reference to avoid repeated hash access
    my $plugins = $PLUGINORDER{$type};
    return ($request, $response) unless $plugins;

    foreach my $plugin (@$plugins) {
        return ($request, $response) if $mark->{'terminate'};

        # Cache hook reference to avoid repeated hash access
        my $hook = $plugin->{'hooks'}->{$type};
        next unless $hook;

        # Check conditionals more efficiently
        my $run = 1;
        if (my $condition = $hook->{'cond'}) {
            $run = eval($condition);
            next unless $run;
        }

        # Cache plugin parameters and full_name
        my $parameters = $plugin->{'parameters'};
        my $full_name  = $plugin->{'full_name'};

        # Save current output states
        my $oldverbose = $OUTPUT{'verbose'};
        my $olddebug   = $OUTPUT{'debug'};
        my $olderrors  = $OUTPUT{'errors'};

        # Set output flags based on parameters
        $OUTPUT{'verbose'} = 1 if $parameters && $parameters->{'verbose'} == 1;
        $OUTPUT{'debug'}   = 1 if $parameters && $parameters->{'debug'} == 1;

        # Print status unless it's a prefetch/postfetch hook
        unless ($type eq "prefetch" || $type eq "postfetch") {
            nprint("- Running $type for \"$full_name\" plugin", "v", "Plugins");
            $NIKTO{'current_plugin'} = $full_name;
        }

        # Execute the hook method
        &{ $hook->{'method'} }($mark, $parameters, $request, $response);

        # Restore output states
        $OUTPUT{'verbose'} = $oldverbose;
        $OUTPUT{'debug'}   = $olddebug;
        $OUTPUT{'errors'}  = $olderrors;
    }

    return ($request, $response);
}

###############################################################################
sub report_head {

    # Support multiple formats: use formats array
    my @formats_to_process = ();
    my %files_to_process   = ();

    if (defined $CLI{'formats'} && ref($CLI{'formats'}) eq 'ARRAY' && @{ $CLI{'formats'} } > 0) {

        # Multiple formats from comma-separated list
        @formats_to_process = @{ $CLI{'formats'} };
        if (defined $CLI{'files'} && ref($CLI{'files'}) eq 'HASH') {
            %files_to_process = %{ $CLI{'files'} };
        }
    }
    else {
        # Fallback: no formats specified (should not happen, but handle gracefully)
        nprint("+ WARNING: No formats specified for reporting", "v", "Reports");
        return;
    }

    nprint("- Opening reports (" . join(',', @formats_to_process) . ")", "v", "Reports");

    # Process each format separately to ensure unique handles
    foreach my $format_to_use (@formats_to_process) {
        my $file_to_use = $files_to_process{$format_to_use} || '';

        # Skip file-based formats that don't have a file (unless sqld/none)
        if ($file_to_use eq '' && $format_to_use ne 'none' && $format_to_use ne 'sqld') {
            nprint("+ ERROR: No file specified for format: $format_to_use", "v", "Reports");
            next;
        }

        foreach my $i (1 .. 100) {
            foreach my $plugin (@PLUGINS) {
                if (   $plugin->{run}
                    && defined $plugin->{report_item}
                    && $plugin->{report_weight} == $i) {
                    my $run = 1;

                    # Check if this plugin handles this format
                    if (defined $plugin->{report_format}) {
                        $run = ($format_to_use eq $plugin->{report_format});
                    }

                    if ($run) {
                        nprint(
                            "- Opening report for \"$plugin->{full_name}\" plugin ($format_to_use) -> $file_to_use",
                            "v", "Reports"
                            );
                        my $handle;
                        if (defined $plugin->{report_head}) {

                            # Each plugin gets its own unique lexical handle
                            $handle = &{ $plugin->{report_head} }($file_to_use);

                            # Ensure autoflush is enabled (already done in plugin, but double-check)
                            if (defined $handle && ref($handle) eq 'GLOB') {
                                $handle->autoflush(1);
                            }
                        }

                        # Store this report entry with its unique handle
                        my $report_entry = {
                                 host_start => $plugin->{report_host_start},
                                 host_end   => $plugin->{report_host_end},
                                 item       => $plugin->{report_item},
                                 close      => $plugin->{report_close},
                                 summary    => $plugin->{report_summary},
                                 ssl_info   => $plugin->{report_ssl_info},     # SSL info hook
                                 handle     => $handle,
                                 format     => $format_to_use,                 # Store for debugging
                                 file       => $file_to_use,                   # Store for debugging
                                 };

                        push(@REPORTS, $report_entry);
                    }
                }
            }
        }
    }
    return;
}

###############################################################################
# Generate scanid for SQL reporting
# Format: MD5 hash of "protocol://hostname:port/timestamp"
# Example: LW2::md5("https://example.com:443/2025:12:16:03:30:44GMT")
sub generate_scanid {
    my ($mark) = @_;

    # Determine protocol
    my $protocol = $mark->{'ssl'} ? 'https' : 'http';

    # Get hostname (prefer vhost if present)
    my $hostname = $mark->{'vhost'} ? $mark->{'vhost'} : $mark->{'hostname'};

    # Get port
    my $port = $mark->{'port'} || ($mark->{'ssl'} ? 443 : 80);

    # Get GMT timestamp in format YYYY:MM:DD:HH:MM:SSGMT
    my @gmt = gmtime(time);
    my $timestamp = sprintf("%04d:%02d:%02d:%02d:%02d:%02dGMT",
                            $gmt[5] + 1900,    # year
                            $gmt[4] + 1,       # month
                            $gmt[3],           # day
                            $gmt[2],           # hour
                            $gmt[1],           # minute
                            $gmt[0]
                            );    # second

    # Generate MD5 hash
    my $scanid = LW2::md5("$protocol://$hostname:$port/$timestamp");

    return $scanid;
}

###############################################################################
sub report_host_start {
    my ($mark) = @_;

    # Generate scanid for SQL reporting plugins
    $mark->{'scanid'} = generate_scanid($mark);

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {
        if (defined $reporter->{host_start}) {
            &{ $reporter->{host_start} }($reporter->{handle}, $mark);
        }
    }
}

###############################################################################
sub report_host_end {
    my ($mark) = @_;

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {
        if (defined $reporter->{host_end}) {
            &{ $reporter->{host_end} }($reporter->{handle}, $mark);
        }
    }
}

###############################################################################
sub report_summary {
    my ($mark) = @_;

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {
        if (defined $reporter->{summary}) {
            &{ $reporter->{summary} }($reporter->{handle}, $mark);
        }
    }
}

###############################################################################
sub report_item {
    my ($mark, $item) = @_;
    if (($item->{'uri'} eq 'undef') || ($item->{'uri'} eq '')) {
        $item->{'uri'} = '/';
    }

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {
        if (defined $reporter->{item}) {
            &{ $reporter->{item} }($reporter->{handle}, $mark, $item);
        }
    }
}

###############################################################################
sub report_ssl_info {
    my ($mark) = @_;

    # Only report SSL info if SSL is enabled and info is available
    return unless ($mark->{'ssl'} && defined $mark->{'ssl_cipher'});

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {
        if (defined $reporter->{ssl_info}) {
            &{ $reporter->{ssl_info} }($reporter->{handle}, $mark);
        }
    }
}

###############################################################################
sub report_close {

    # Go through all reporting modules
    foreach my $reporter (@REPORTS) {

        # Explicitly flush the handle before closing to ensure all data is written
        if (defined $reporter->{handle}) {
            my $fh = $reporter->{handle};

            # Only flush file handles (GLOB refs), not database handles or other types
            if (ref($fh) eq 'GLOB') {

                # Ensure autoflush is enabled
                $fh->autoflush(1);

                # Try to flush explicitly if method exists
                if ($fh->can('flush')) {
                    eval { $fh->flush(); };
                }
            }
        }

        # Call plugin's close function (it may close the handle itself)
        if (defined $reporter->{close}) {
            &{ $reporter->{close} }($reporter->{handle});
        }

        # Explicitly close file handles after plugin's close (in case plugin didn't close it)
        # Only close GLOB file handles, not database handles (DBI) or STDOUT
        if (defined $reporter->{handle} && ref($reporter->{handle}) eq 'GLOB') {

            # Don't close STDOUT/STDERR
            if ($reporter->{handle} ne \*STDOUT && $reporter->{handle} ne \*STDERR) {
                eval { close($reporter->{handle}); };
            }
        }
    }
}

###############################################################################
# portions of this sub were taken from the Term::ReadPassword module.
# It has been modified to not require Term::ReadLine, but still requires
# POSIX::Termios if it's a POSIX machine
###############################################################################
sub read_data {
    if ($CONFIGFILE{PROMPTS} eq 'no') { return; }
    my ($prompt, $mode, $POSIX) = @_;
    my $input;

    my %SPECIAL = ("\x03" => 'INT',    # Control-C, Interrupt
                   "\x08" => 'DEL',    # Backspace
                   "\x7f" => 'DEL',    # Delete
                   "\x0d" => 'ENT',    # CR, Enter
                   "\x0a" => 'ENT',    # LF, Enter
                   );

    local (*TTY, *TTYOUT);
    open TTY,    "<&STDIN"   or return;
    open TTYOUT, ">>&STDOUT" or return;

    # Don't buffer it!
    select((select(TTYOUT), $| = 1)[0]);
    print TTYOUT $prompt;

    # Remember where everything was
    my $fd_tty = fileno(TTY);
    my $term   = POSIX::Termios->new();
    $term->getattr($fd_tty);
    my $original_flags = $term->getlflag();

    if ($mode eq "noecho") {
        my $new_flags = $original_flags & ~(ISIG | ECHO | ICANON);
        $term->setlflag($new_flags);
    }
    $term->setattr($fd_tty, TCSAFLUSH);
  KEYSTROKE:
    while (1) {
        my $new_keys = '';
        my $count    = sysread(TTY, $new_keys, 99);
        if ($count) {
            for my $new_key (split //, $new_keys) {
                if (my $meaning = $SPECIAL{$new_key}) {
                    if    ($meaning eq 'ENT') { last KEYSTROKE; }
                    elsif ($meaning eq 'DEL') { chop $input; }
                    elsif ($meaning eq 'INT') { last KEYSTROKE; }
                    else                      { $input .= $new_key; }
                }
                else { $input .= $new_key; }
            }
        }
        else { last KEYSTROKE; }
    }

    # Done with waiting for input. Let's not leave the cursor sitting
    # there, after the prompt.
    print TTY "\n";
    nprint("\n");

    # Let's put everything back where we found it.
    $term->setlflag($original_flags);
    $term->setattr($fd_tty, TCSAFLUSH);
    close(TTY);
    close(TTYOUT);

    return $input;
}

###############################################################################
sub proxy_check {
    my ($mark) = @_;

    setup_hash(\%request, $mark, "Proxy Check");
    if (($request{'whisker'}->{'proxy_host'} ne '') && ($CLI{'useproxy'}))    # proxy is set up
    {
        LW2::http_close(\%request);    # force-close any old connections
        $request{'whisker'}->{'method'} = "GET";
        $request{'whisker'}->{'uri'}    = "/";

        LW2::http_fixup_request(\%request);

        sleeper();
        LW2::http_do_request_timeout(\%request, \%response);
        $COUNTERS{'totalrequests'}++;
        dump_var("Request Hash", \%request,
                 ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
        dump_var("Response Hash",
                 \%response, ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));

        # First check that we can connect to the proxy
        if (exists $response{'whisker'}{'error'}) {
            if ($response{'whisker'}{'error'} =~ /Transport endpoint is not connected/) {
                nprint("+ ERROR: Could not connect to the defined proxy $CONFIGFILE{PROXYHOST}");
            }
            nprint("+ ERROR: Proxy error: $response{'whisker'}{'error'}");
            exit 1;
        }

        if ($response{'whisker'}{'code'} eq "407")    # proxy requires auth
        {

            # have id/pw?
            if ($CONFIGFILE{PROXYUSER} eq "") {
                $CONFIGFILE{PROXYUSER} = read_data("Proxy ID: ",   "");
                $CONFIGFILE{PROXYPASS} = read_data("Proxy Pass: ", "noecho");
            }
            if ($response{'proxy-authenticate'} !~ /Basic/i) {
                my @x = split(/ /, $response{'proxy-authenticate'});
                nprint(
                    "+ Proxy server uses '$x[0]' rather than 'Basic' authentication. $VARIABLES{'name'} $VARIABLES{'version'} can't do that."
                    );
                exit 1;
            }

            # test it...
            LW2::http_close(\%request);    # force-close any old connections
            LW2::auth_set("proxy-basic", \%request, $CONFIGFILE{PROXYUSER}, $CONFIGFILE{PROXYPASS})
              ;                            # set auth
            LW2::http_fixup_request(\%request);
            sleeper();
            LW2::http_do_request_timeout(\%request, \%response);
            $COUNTERS{'totalrequests'}++;
            dump_var("Request Hash", \%request,
                     ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
            dump_var("Response Hash",
                     \%response, ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));

            if ($response{'proxy-authenticate'} ne "") {
                my @pauthinfo  = split(/ /, $response{'proxy-authenticate'});
                my @pauthinfo2 = split(/=/, $response{'proxy-authenticate'});
                $pauthinfo2[1] =~ s/^\"//;
                $pauthinfo2[1] =~ s/\"$//;
                nprint(
                    "+ Proxy requires authentication for '$pauthinfo[0]' realm '$pauthinfo2[1]', unable to authenticate."
                    );
                exit 1;
            }
            else { nprint("- Successfully authenticated to proxy.", "v", undef); }
        }
    }

    return;
}

#######################################################################
sub dump_var {
    return if !$OUTPUT{'debug'};
    my $msg     = $_[0];
    my %hash_in = %{ $_[1] };
    my @scrubs;
    for (my $i = 2 ; $i <= $#_ ; $i++) {
        push(@scrubs, $_[$i]);
    }
    my $display = LW2::dump('', \%hash_in);
    my $new;
    $display =~ s/^\$/'$msg'/;
    if ($OUTPUT{'scrub'}) {
        $new = "";
        foreach my $line (split(/\n/, $display)) {
            $line = scrub($line, @scrubs);
            $new .= "$line\n";
        }
        $display = $new;
    }
    nprint($display, "d");
    return;
}

#######################################################################
sub get_ua {

    # Always honor command line
    if ($CLI{'useragent'}) {
        return $CLI{'useragent'};
    }

    # Return a random User-Agent from @USERAGENTS array
    if (   defined($VARIABLES{'@USERAGENTS'})
        && ref($VARIABLES{'@USERAGENTS'}) eq 'ARRAY'
        && @{ $VARIABLES{'@USERAGENTS'} }) {
        my $ua = $VARIABLES{'@USERAGENTS'}->[ rand(@{ $VARIABLES{'@USERAGENTS'} }) ];
        $ua =~ s/^"//;
        $ua =~ s/"$//;
        return $ua;
    }
    return undef;
}

#######################################################################
sub setup_hash {
    my ($reqhash, $mark, $testid) = @_;

    # Clear the hash first (like LW2::http_init_request does)
    %$reqhash = ();

    # Initialize the whisker hash
    $reqhash->{'whisker'} = {};

    # Cache whisker hash reference to avoid repeated dereferencing
    my $whisker = $reqhash->{'whisker'};

    # Set all required whisker properties (matching LW2::http_init_request defaults)
    $whisker->{'http_space1'}                   = ' ';
    $whisker->{'http_space2'}                   = ' ';
    $whisker->{'version'}                       = $CONFIGFILE{'DEFAULTHTTPVER'} || '1.1';
    $whisker->{'method'}                        = 'GET';
    $whisker->{'protocol'}                      = 'HTTP';
    $whisker->{'port'}                          = $mark->{'port'} || 80;
    $whisker->{'uri'}                           = '/';
    $whisker->{'uri_prefix'}                    = '';
    $whisker->{'uri_postfix'}                   = '';
    $whisker->{'uri_param_sep'}                 = '?';
    $whisker->{'host'}                          = $mark->{'hostname'} || $mark->{'ip'};
    $whisker->{'timeout'}                       = $CLI{'timeout'}     || 10;
    $whisker->{'include_host_in_uri'}           = 0;
    $whisker->{'ignore_duplicate_headers'}      = 0;
    $whisker->{'normalize_incoming_headers'}    = 1;
    $whisker->{'lowercase_incoming_headers'}    = 1;
    $whisker->{'require_newline_after_headers'} = 0;
    $whisker->{'invalid_protocol_return_value'} = 1;
    $whisker->{'ssl'}                           = $mark->{'ssl'} || 0;
    $whisker->{'ssl_save_info'}                 = 1;
    $whisker->{'http_eol'}                      = "\x0d\x0a";
    $whisker->{'force_close'}                   = 0;
    $whisker->{'force_open'}                    = 0;
    $whisker->{'retry'}                         = 0;
    $whisker->{'trailing_slurp'}                = 0;
    $whisker->{'force_bodysnatch'}              = 0;
    $whisker->{'max_size'}                      = 750000;
    $whisker->{'MAGIC'}                         = 31339;

    # Set SSL-specific fields if needed
    if ($mark->{'ssl'}) {
        $whisker->{'ssl_rsacertfile'} = $mark->{'key'};
        $whisker->{'ssl_certfile'}    = $mark->{'cert'};
    }

    # Set evasion only if needed
    $whisker->{'anti_ids'} = $CLI{'evasion'} if (length($CLI{'evasion'}));

    # Set default headers (like LW2::http_init_request does)
    $reqhash->{'Connection'} = 'Keep-Alive';

    # Random User-Agent
    $reqhash->{'User-Agent'} = get_ua();

    # Set Host header only if vhost is configured
    if ($mark->{'has_vhost'}) {
        $reqhash->{'Host'} = $mark->{'vhost'};
    }

    # Proxy configuration
    if (length($CONFIGFILE{PROXYHOST}) && $CLI{'useproxy'}) {
        $whisker->{'proxy_host'} = $CONFIGFILE{'PROXYHOST'};
        $whisker->{'proxy_port'} = $CONFIGFILE{'PROXYPORT'};

        # Set proxy auth only if credentials are provided
        if (length($CONFIGFILE{'PROXYUSER'})) {
            LW2::auth_set("proxy-basic", $reqhash,
                          $CONFIGFILE{'PROXYUSER'},
                          $CONFIGFILE{'PROXYPASS'});
        }
    }

    return $reqhash;
}

#######################################################################
sub running_average {
    my $last = shift;
    my ($mark) = @_;

    # Use push instead of unshift for better performance
    push(@{ $mark->{'running_avg'} }, $last);

    # Only splice if we exceed the limit (more efficient than always splicing)
    if (@{ $mark->{'running_avg'} } > 100) {
        splice(@{ $mark->{'running_avg'} }, 0, @{ $mark->{'running_avg'} } - 100);
    }
}

#######################################################################
sub running_average_print {
    use List::Util qw(sum);
    my ($mark)   = @_;
    my @data     = @{ $mark->{'running_avg'} };
    my $elements = @data;                         # More efficient than $#data + 1

    return "Running average: Not enough data." if $elements == 0;

    my $message = '';

    if ($elements == 100) {
        my $avg = sum(@data) / $elements;
        $message = sprintf("100 requests: %.5f sec, ", $avg);
    }

    if ($elements > 10) {
        my @recent_data  = @data[ ($#data - 9) .. $#data ];
        my $recent_count = @recent_data;
        my $avg          = sum(@recent_data) / $recent_count;
        $message .= sprintf("10 requests: %.4f sec", $avg);
    }

    return "Running average: $message.";
}

#######################################################################
sub nfetch {
    my ($mark, $uri, $method, $data, $headers_send, $flags, $testid, $httpver) = @_;
    my (%request, %response);
    setup_hash(\%request, $mark, $testid);

    # Ensure $flags is a hash reference (handle cases where empty string is passed)
    if (!ref($flags) || ref($flags) ne 'HASH') {
        $flags = {};
    }

    # Check for keyboard input  & terminate flag
    if (!$CLI{'nointeractive'} && !(($COUNTERS{'totalrequests'} % 10))) {
        $mark->{'terminate'} = 1 if (check_input($mark) eq 'term');
    }

    # Check execution time
    if (my $maxtime = $CLI{'maxtime'}) {

        # Cache start_time to avoid repeated hash access
        my $start_time = $mark->{'start_time'};
        if ((time() - $start_time) > $maxtime) {
            nprint("+ ERROR: Host maximum execution time of $maxtime seconds reached");
            $mark->{'terminate'} = 1;
        }
    }

    # Prepend -root option's value if set
    $request{'whisker'}->{'uri'} = $mark->{'root'} . $uri;

    # Remove trailing slash if requested
    $request{'whisker'}->{'uri'} =~ s/\/$// if ($CLI{'noslash'});

    $request{'whisker'}->{'method'} = $method;

    # POST data?
    if (length($data)) {
        $data =~ s/\\\"/\"/g;
        $request{'whisker'}->{'data'} = $data;
    }

    # Default an unobtrusive headers to help WAF evasion
    $request{'whisker'}->{'Accept'} =
      'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
    $request{'whisker'}->{'Accept-Language'}           = 'en-US,en;q=0.5';
    $request{'whisker'}->{'Cache-Control'}             = 'max-age=0';
    $request{'whisker'}->{'Connection'}                = 'keep-alive';
    $request{'whisker'}->{'Upgrade-Insecure-Requests'} = '1';
    $request{'whisker'}->{'Sec-Fetch-Dest'}            = 'document';
    $request{'whisker'}->{'Sec-Fetch-Mode'}            = 'navigate';
    $request{'whisker'}->{'Sec-Fetch-Site'}            = 'none';
    $request{'whisker'}->{'Sec-Fetch-User'}            = '?1';

    # Check for extra HTTP headers
    if (ref($headers_send) eq "HASH") {

        # Use explicit hash assignment instead of slice assignment
        foreach my $key (keys %$headers_send) {
            $request{$key} = $headers_send->{$key};
        }
    }

    # Add custom headers from CLI if any
    if (defined $CLI{'headers'} && @{ $CLI{'headers'} }) {
        foreach my $header (@{ $CLI{'headers'} }) {
            if ($header =~ /^([^:]+):\s*(.+)$/) {
                my ($headername, $value) = ($1, $2);
                $request{$headername} = $value;
            }
        }
    }

    # Set auth
    if (my $realm = $mark->{'realms'}{'default'}) {
        if (length($realm->{'authtype'})) {
            LW2::auth_set($realm->{'authtype'}, $request, $realm->{'id'}, $realm->{'password'});
        }
    }

    # Set cookies
    LW2::cookie_write($mark->{'cookiejar'}, \%request, 1) if defined($mark->{'cookiejar'});

    # Override HTTP version
    $request{'whisker'}->{'version'} = $httpver if ($httpver ne '');

    $request{'whisker'}->{'host'} = $mark->{'ip'} if ($flags->{'nohost'});

    LW2::http_fixup_request(\%request) unless ($flags->{'noclean'});

    # Run pre hooks
    unless ($flags->{'noprefetch'}) {
        (%$request, %$response) = run_hooks($mark, "prefetch", \%request, \%response);
    }

    # Do the request
    sleeper();
    my $time = [gettimeofday];
    LW2::http_do_request_timeout(\%request, \%response);
    $COUNTERS{'totalrequests'}++;
    if (!$VARIABLES{'MSWIN32'}) {
        running_average(tv_interval($time, [gettimeofday]), $mark);
    }

    # If we got an error, do 1 retry - optimized
    if (my $whisker = $response{'whisker'}) {
        if (defined $whisker->{'error'} || $whisker->{'code'} eq '') {
            $mark->{'failures'}++;
            sleeper();
            LW2::http_do_request_timeout(\%request, \%response);
            $COUNTERS{'totalrequests'}++;
        }
    }

    # Get cookies from response & add to jar
    if (!$CLI{'nocookies'}) {
        my $tmpjar = LW2::cookie_new_jar();
        LW2::cookie_read(\%tmpjar, \%response, \%request);

        # Cache cookiejar reference to avoid repeated hash access
        my $cookiejar = $mark->{'cookiejar'};

        # Use more efficient array construction
        foreach my $c (keys %tmpjar) {
            my $cookie_data = $tmpjar{$c};
            $cookiejar->{$c} =
              [ $cookie_data->[0], $cookie_data->[1], $cookie_data->[2], undef, $cookie_data->[4] ];
        }
    }

    # follow redirects
    if ($CLI{'followredirects'} && ($response{'whisker'}->{'code'} =~ /^30[1278]/)) {
        my $newlocation = $response{'location'};
        my $port        = $mark->{'port'};

        # Is a full URL redirect the same host?
        # Pre-compute host alternatives for better performance
        my $host_re = join '|',
          map { quotemeta $_ } ($mark->{'ip'}, $mark->{'hostname'}, $mark->{'display_name'});

        # Only build port regex if port is specified
        if ($port && $port != 80 && $port != 443) {
            my $port_re = '(?:\:' . quotemeta($port) . ')?';
            if ($response{'location'} =~ /^https?:\/\/($host_re)$port_re\//i) {
                $newlocation =~ s{^https?:\/\/(?:$host_re)$port_re/}{/}i;
            }
        }
        else {
            # No port needed in regex for standard ports
            if ($response{'location'} =~ /^https?:\/\/($host_re)\//i) {
                $newlocation =~ s{^https?:\/\/(?:$host_re)/}{/}i;
            }
        }

        # Cache whisker reference to avoid repeated hash access
        my $whisker = $request{'whisker'};
        $whisker->{'uri'} = $newlocation;

        # Make redirect request
        LW2::http_fixup_request(\%request) unless ($flags->{'noclean'});
        sleeper();
        LW2::http_do_request_timeout(\%request, \%response);
        $COUNTERS{'totalrequests'}++;
    }

    # Check failures
    my $fail_limit = $CONFIGFILE{'FAILURES'};
    if ($fail_limit > 0 && $mark->{'failures'} >= $fail_limit) {
        nprint(
            "+ ERROR: *** Error limit ($CONFIGFILE{'FAILURES'}) reached for host, giving up. Last error: "
              . $response{'whisker'}->{'error'}
              . ". ***\n+ ERROR: *** Consider using mitmproxy to avoid TLS fingerprinting. ***",
            "",
            ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'})
            );
        $mark->{'terminate'} = 1;
        status_report();
    }

    if ($OUTPUT{'debug'}) {
        dump_var("Request Hash", \%request,
                 ($mark->{'ip'}, $mark->{'hostname'}, $mark->{'displayname'}));
        dump_var("Response Hash",
                 \%response, ($mark->{'ip'}, $mark->{'hostname'}, $mark->{'displayname'}));
    }

    # Snarf what we can from the whisker hash and put in mark
    my $banner  = \$mark->{'banner'};
    my $whisker = $response{'whisker'};

    if (!exists $whisker->{'error'}) {

        # Banner processing
        if ($$banner eq "") {
            $$banner = $response{'server'};
        }
        elsif (   exists $response{'server'}
               && !exists $mark->{'bannerchanged'}
               && ($$banner ne $response{'server'})
               && ($response{'server'} ne 'Microsoft-HTTPAPI/2.0')) {
            $request->{'whisker'}->{'uri'} = "/"
              if (   !defined $request->{'whisker'}->{'uri'}
                  || $request->{'whisker'}->{'uri'} eq ""
                  || $request->{'whisker'}->{'uri'} eq ".");
            add_vulnerability($mark,
                              $request->{'whisker'}->{'uri'}
                                . ": Server banner changed from '$$banner' to '$response{server}'",
                              999962,
                              "",
                              $method,
                              $uri,
                              $request,
                              $response
                              );
            $mark->{'bannerchanged'} = 1;
        }

        # Also check X-Powered-By header for outdated version checking
        # Only add to components if it contains version-like information (digits, slashes, or dots)
        if (exists $response{'x-powered-by'}
            && $response{'x-powered-by'} =~ /(?:\d|\/|\.)/) {
            my $xpb_value = $response{'x-powered-by'};
            $xpb_value =~ s/\s+.*$//;    # Strip any trailing whitespace/content
            if (!exists $mark->{'components'}->{$xpb_value}) {
                $mark->{'components'}->{$xpb_value} = 1;
            }
        }

        # TLS
        if (!exists $mark->{'ssl_cipher'} && $mark->{'ssl'}) {

            # Cache SSL certificate array reference
            my $altnames = $whisker->{'ssl_cert_altnames'};

            # Grab ssl details
            $mark->{'ssl_cipher'}       = $whisker->{'ssl_cipher'};
            $mark->{'ssl_cert_issuer'}  = $whisker->{'ssl_cert_issuer'};
            $mark->{'ssl_cert_subject'} = $whisker->{'ssl_cert_subject'};

            # Process altnames correctly - Net::SSLeay::X509_get_subjectAltNames returns
            # an array where even indices are type codes and odd indices are the actual names
            if ($altnames && @$altnames) {
                my @valid_names;
                for (my $i = 1 ; $i < @$altnames ; $i += 2) {
                    my $name = $altnames->[$i];

                    # Only include DNS names (type 2) and skip numeric-only names
                    if ($altnames->[ $i - 1 ] == 2 && $name !~ /^[\d]+$/ && $name ne '') {
                        push(@valid_names, $name);
                    }
                }
                $mark->{'ssl_cert_altnames'} = join(', ', @valid_names);
            }
        }
    }

    nprint("- $response{'whisker'}{'code'} for $method:\t$response{'whisker'}->{'uri_requested'}",
           "v", $testid, ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));

    # Check for errors to reduce false positives
    if (my $whisker = $response{'whisker'}) {
        if ((defined $whisker->{'error'} || $whisker->{'code'} eq '')
            && !exists $flags->{'noerror'}) {
            $mark->{'total_errors'}++;
            nprint("+ ERROR: $whisker->{'uri_requested'} returned an error: $whisker->{'error'}\n",
                   "e", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));
            if ($whisker->{'code'} eq '502' && $CLI{'useproxy'}) {
                nprint("+ ERROR: Received 502 'Bad Gateway' from proxy\n");
            }
        }
    }

    # Show cookies
    if ($OUTPUT{'show_cookies'} && (my $cookies = $response{'whisker'}->{'cookies'})) {

        # Cache frequently accessed values
        my $uri_requested = $response{'whisker'}->{'uri_requested'};
        my $hostname      = $mark->{'hostname'};
        my $ip            = $mark->{'ip'};
        my $displayname   = $mark->{'displayname'};

        foreach my $c (@$cookies) {
            nprint("+ $uri_requested sent cookie: $c", "", ($hostname, $ip, $displayname));
        }
    }

    # Run post hooks
    unless ($flags->{'nopostfetch'}) {
        ($request, %$response) = run_hooks($mark, "postfetch", \%request, \%response);
    }

    return $response{'whisker'}->{'code'}, $response{'whisker'}->{'data'},
      $response{'whisker'}->{'error'}, \%request, \%response;
}

#######################################################################
sub set_scan_items {
    %TESTS = ();
    $COUNTERS{total_checks} = 0;
    my %SKIPLIST = ();
    if (defined $CONFIGFILE{SKIPIDS}) {
        foreach my $id (split(/ /, $CONFIGFILE{SKIPIDS})) {
            $SKIPLIST{$id} = 1;
        }
    }
    my ($includes, $excludes) = "";

    foreach my $tune (split(//, $CLI{'tuning'})) {
        next if ($tune eq "x");
        if ($CLI{'tuning'} !~ /(?<![x])$tune/gi) {
            $excludes .= $tune;
        }
        else {
            $includes .= $tune;
        }
    }

    # now load checks
    foreach my $line (@DBFILE) {
        if ($line =~ /^\"/)    # check
        {
            chomp($line);
            my @item = parse_csv($line);
            my $add  = 0;

            # check tuning options
            # $item[2] contains the test's types
            if (($CLI{'tuning'} ne "") && (defined $item[2])) {

                # Work out the required tuning from the CLI string
                if ($includes ne "") {
                    foreach $tune (split(//, $includes)) {
                        if ($item[2] =~ /$tune/i) {
                            $add = 1;
                            last;
                        }
                    }
                }
                if ($excludes ne "") {

                    # if includes is null and excludes is not null, add all but excludes
                    foreach $tune (split(//, $excludes)) {
                        if ($item[2] =~ /$tune/i) {
                            $add = 0;
                            last;
                        }
                        else {
                            $add = 1;
                        }
                    }

                }
            }
            else {
                $add = 1;
            }

            # Skip list
            if ($add && exists $SKIPLIST{ $item[0] }) {
                $add = 0;
            }

            # If $add is still true, then add it
            if ($add) {
                my $ext = get_ext($item[3]);
                $db_extensions{$ext} = 1;

                $COUNTERS{total_checks}++;
                $TESTS{ $item[0] }{'references'} = $item[1];
                $TESTS{ $item[0] }{'tuning'}     = $item[2];
                $TESTS{ $item[0] }{'uri'}        = $item[3];
                $TESTS{ $item[0] }{'method'}     = $item[4];
                $TESTS{ $item[0] }{'dsl'}        = $item[5];
                $TESTS{ $item[0] }{'message'}    = $item[6];
                $TESTS{ $item[0] }{'data'}       = $item[7];
                $TESTS{ $item[0] }{'headers'}    = $item[8];
                $TESTS{ $item[0] }{'matcher'}    = build_matcher($item[5], $item[0]);
            }
        }
    }

    nprint("- $COUNTERS{'total_checks'} server checks loaded", "v", "Init");
    if ($COUNTERS{'total_checks'} eq 0 && !defined $CLI{'tuning'}) {
        nprint("+ Unable to load valid checks!");
        $mark->{'terminate'} = 1;
    }
    return;
}
#######################################################################
# Check for updates to the program
# Expects response like:
# { "products": { "nikto": { "version": "2.6.0", "epoch": 1737935000 } } }
sub check_updates {

    # Get epoch from program/.timestamp || 0
    my $epoch = 0;
    my $timestamp_file =
      defined $CONFIGFILE{'EXECDIR'} ? "$CONFIGFILE{'EXECDIR'}/.timestamp" : 'program/.timestamp';
    if (-f $timestamp_file) {
        if (open(my $fh, '<', $timestamp_file)) {
            $epoch = <$fh>;
            chomp($epoch);
            close($fh);
        }
    }

    # Request API to get manifest JSON using LibWhisker and configured proxy
    return unless defined $CONFIGFILE{'VERSION_API'} && $CONFIGFILE{'VERSION_API'} ne '';

    eval "require JSON::PP";
    return if $@;

    my %request;
    my %response;

    # Parse URL from config
    my @uridata = LW2::uri_split($CONFIGFILE{'VERSION_API'});
    my $host    = $uridata[2] || '';
    my $port    = $uridata[3] || '';
    my $path    = $uridata[0] || '/';

    # Determine SSL and default port
    my $ssl = ($CONFIGFILE{'VERSION_API'} =~ /^https:/i) ? 1 : 0;
    if ($port eq '') {
        $port = $ssl ? 443 : 80;
    }

    # Build URI with query parameters
    my $uri = $path;
    $uri .= ($path =~ /\?/) ? '&' : '?';
    $uri .= "p=nikto&v=$VARIABLES{'version'}&e=$epoch";

    LW2::http_init_request(\%request);
    $request{'whisker'}->{'host'}    = $host;
    $request{'whisker'}->{'port'}    = $port;
    $request{'whisker'}->{'ssl'}     = $ssl;
    $request{'whisker'}->{'uri'}     = $uri;
    $request{'whisker'}->{'timeout'} = 5;
    $request{'User-Agent'} = "Nikto/$VARIABLES{'version'}";

    # Configure proxy if enabled
    if (length($CONFIGFILE{PROXYHOST}) && $CLI{'useproxy'}) {
        $request{'whisker'}->{'proxy_host'} = $CONFIGFILE{'PROXYHOST'};
        $request{'whisker'}->{'proxy_port'} = $CONFIGFILE{'PROXYPORT'};
        if (length($CONFIGFILE{'PROXYUSER'})) {
            LW2::auth_set("proxy-basic", \%request,
                          $CONFIGFILE{'PROXYUSER'},
                          $CONFIGFILE{'PROXYPASS'});
        }
    }

    LW2::http_fixup_request(\%request);
    LW2::http_do_request_timeout(\%request, \%response);

    # Check if request succeeded
    if (($response{'whisker'}->{'code'} ne '200') || ($response{'whisker'}->{'data'} eq '')) {
        nprint("+ ERROR: Failed to check for updates: $response{'whisker'}->{'code'}");
        return;
    }

    # Parse JSON response
    my $json_data;
    eval { $json_data = JSON::PP->new->utf8(1)->decode($response{'whisker'}->{'data'}); };
    return if $@ || !$json_data;

    # Extract remote version and epoch
    my $remote_version = $json_data->{'products'}->{'nikto'}->{'version'} || '';
    my $remote_epoch   = $json_data->{'products'}->{'nikto'}->{'epoch'}   || 0;

    # Compare epoch to manifest epoch
    # If remote epoch is greater OR remote version is greater:
    if ($remote_epoch > $epoch
        || ($remote_version ne '' && $remote_version ne $VARIABLES{'version'})) {
        my $defer = $VARIABLES{'deferout'};
        $VARIABLES{'deferout'} = 0;

        # Check if git install
        my $is_git = (-d '.git' || -d '../.git' || -d '../../.git');
        if ($is_git) {
            nprint(
                "+ Your Nikto installation is out of date. Please run 'git pull' to update to the latest version of Nikto."
                );
        }
        else {
            nprint("+ Your Nikto installation is out of date.");
        }
        $VARIABLES{'deferout'} = $defer;
    }
}
#######################################################################
# Expand @LFI() in DSL with platform-specific matchers
sub expand_lfi_dsl {
    my ($dsl) = @_;

    if ($dsl =~ /@?LFI\(\)/) {

        # Local variables for LFI matching
        my $lfi_match_win = $VARIABLES{'@LFIMATCHWIN'} || '';
        my $lfi_match_nix = $VARIABLES{'@LFIMATCHNIX'} || '';

        # If both are empty, return original DSL
        if (!$lfi_match_win && !$lfi_match_nix) {
            return $dsl;
        }

        # Build the OR pattern: (@LFIMATCHWIN|@LFIMATCHNIX)
        # Use string concatenation to preserve backslashes and avoid interpolation issues
        my $replacement;
        if ($lfi_match_win && $lfi_match_nix) {
            $replacement = '(' . $lfi_match_win . '|' . $lfi_match_nix . ')';
        }
        elsif ($lfi_match_win) {
            $replacement = $lfi_match_win;
        }
        else {
            $replacement = $lfi_match_nix;
        }

        # Replace @LFI() with the expanded pattern
        # Use \Q...\E to quote the replacement and prevent any regex interpretation
        # But we need the | and && to work, so we can't quote everything
        # Instead, just do the substitution - the replacement side doesn't interpret regex
        $dsl =~ s/@?LFI\(\)/$replacement/g;
    }

    return $dsl;
}

sub build_matcher {
    my ($dsl, $checkid) = @_;

    # Return early if DSL is undefined or empty
    return sub { return (0, []); }
      unless defined $dsl && length $dsl;

    # Expand @LFI() if present
    my $expanded_dsl = expand_lfi_dsl($dsl);

    # Use cached parser for speed
    my $parsed = $DSL_CACHE{$expanded_dsl};
    if (!$parsed) {
        $parsed = parse_dsl($expanded_dsl);
        $DSL_CACHE{$expanded_dsl} = $parsed;
    }

    return sub {
        my ($code, $body, $headers, $cookies) = @_;
        my @captured_groups = ();    # Store captured groups for extraction

        # --- CODE NEGATIVES ---
        for my $re (@{ $parsed->{code_neg} }) {
            return (0, []) if $code =~ $re;
        }

        # --- CODE POSITIVES ---
        for my $re (@{ $parsed->{code_pos} }) {
            if ($code =~ $re) {

                # Capture groups if they exist
                push @captured_groups, $1, $2, $3, $4, $5, $6, $7, $8, $9;
            }
            else {
                return (0, []);
            }
        }

        # --- HEADER NEGATIVES ---
        for my $h (@{ $parsed->{header_neg} }) {
            if (exists $headers->{ $h->{name} }) {

                # If regex defined, header must NOT match
                return (0, []) if $h->{regex} && $headers->{ $h->{name} } =~ $h->{regex};

                # If no regex, header must not exist
                return (0, []) unless $h->{regex};
            }
        }

        # --- HEADER POSITIVES ---
        for my $h (@{ $parsed->{header_pos} }) {

            # Must exist
            return (0, []) unless exists $headers->{ $h->{name} };

            # Must match regex if defined
            if ($h->{regex}) {
                if ($headers->{ $h->{name} } =~ $h->{regex}) {

                    # Capture groups if they exist
                    push @captured_groups, $1, $2, $3, $4, $5, $6, $7, $8, $9;
                }
                else {
                    return (0, []);
                }
            }
        }

        # --- COOKIE NEGATIVES ---
        for my $c (@{ $parsed->{cookie_neg} }) {
            if (exists $cookies->{ $c->{name} }) {

                # If regex defined, cookie must NOT match
                return (0, []) if $c->{regex} && $cookies->{ $c->{name} } =~ $c->{regex};

                # If no regex, cookie must not exist
                return (0, []) unless $c->{regex};
            }
        }

        # --- COOKIE POSITIVES ---
        for my $c (@{ $parsed->{cookie_pos} }) {

            # Must exist
            return (0, []) unless exists $cookies->{ $c->{name} };

            # Must match regex if defined
            if ($c->{regex}) {
                if ($cookies->{ $c->{name} } =~ $c->{regex}) {

                    # Capture groups if they exist
                    push @captured_groups, $1, $2, $3, $4, $5, $6, $7, $8, $9;
                }
                else {
                    return (0, []);
                }
            }
        }

        # --- BODY NEGATIVES ---
        for my $re (@{ $parsed->{body_neg} }) {
            return (0, []) if $body =~ $re;
        }

        # --- BODY POSITIVES ---
        for my $re (@{ $parsed->{body_pos} }) {
            if ($body =~ $re) {

                # Capture groups if they exist
                push @captured_groups, $1, $2, $3, $4, $5, $6, $7, $8, $9;
            }
            else {
                return (0, []);
            }
        }

        # --- OR GROUPS ---
        # Each OR group must have at least one alternative that matches
        if (exists $parsed->{or_groups} && @{ $parsed->{or_groups} }) {
            for my $or_group (@{ $parsed->{or_groups} }) {
                my $or_matched = 0;
                foreach my $alt_parsed (@$or_group) {

                    # Build a temporary matcher for this alternative
                    my $alt_matcher = sub {
                        my ($alt_code, $alt_body, $alt_headers, $alt_cookies) = @_;
                        my @alt_captures = ();

                        # Check all conditions in this alternative
                        for my $re (@{ $alt_parsed->{code_neg} }) {
                            return (0, []) if $alt_code =~ $re;
                        }
                        for my $re (@{ $alt_parsed->{code_pos} }) {
                            return (0, []) unless $alt_code =~ $re;
                        }
                        for my $h (@{ $alt_parsed->{header_neg} }) {
                            if (exists $alt_headers->{ $h->{name} }) {
                                return (0, [])
                                  if $h->{regex} && $alt_headers->{ $h->{name} } =~ $h->{regex};
                                return (0, []) unless $h->{regex};
                            }
                        }
                        for my $h (@{ $alt_parsed->{header_pos} }) {
                            return (0, []) unless exists $alt_headers->{ $h->{name} };
                            if ($h->{regex}) {
                                return (0, []) unless $alt_headers->{ $h->{name} } =~ $h->{regex};
                            }
                        }
                        for my $c (@{ $alt_parsed->{cookie_neg} }) {
                            if (exists $alt_cookies->{ $c->{name} }) {
                                return (0, [])
                                  if $c->{regex} && $alt_cookies->{ $c->{name} } =~ $c->{regex};
                                return (0, []) unless $c->{regex};
                            }
                        }
                        for my $c (@{ $alt_parsed->{cookie_pos} }) {
                            return (0, []) unless exists $alt_cookies->{ $c->{name} };
                            if ($c->{regex}) {
                                return (0, []) unless $alt_cookies->{ $c->{name} } =~ $c->{regex};
                            }
                        }
                        for my $re (@{ $alt_parsed->{body_neg} }) {
                            return (0, []) if $alt_body =~ $re;
                        }
                        for my $re (@{ $alt_parsed->{body_pos} }) {
                            return (0, []) unless $alt_body =~ $re;
                        }

                        # Check nested OR groups in this alternative
                        if (exists $alt_parsed->{or_groups} && @{ $alt_parsed->{or_groups} }) {
                            for my $nested_or_group (@{ $alt_parsed->{or_groups} }) {
                                my $nested_or_matched = 0;
                                foreach my $nested_alt (@$nested_or_group) {
                                    my $nested_alt_matcher = sub {
                                        my ($n_code, $n_body, $n_headers, $n_cookies) = @_;
                                        for my $re (@{ $nested_alt->{code_neg} }) {
                                            return (0, []) if $n_code =~ $re;
                                        }
                                        for my $re (@{ $nested_alt->{code_pos} }) {
                                            return (0, []) unless $n_code =~ $re;
                                        }
                                        for my $h (@{ $nested_alt->{header_neg} }) {
                                            if (exists $n_headers->{ $h->{name} }) {
                                                return (0, [])
                                                  if $h->{regex}
                                                  && $n_headers->{ $h->{name} } =~ $h->{regex};
                                                return (0, []) unless $h->{regex};
                                            }
                                        }
                                        for my $h (@{ $nested_alt->{header_pos} }) {
                                            return (0, []) unless exists $n_headers->{ $h->{name} };
                                            if ($h->{regex}) {
                                                return (0, [])
                                                  unless $n_headers->{ $h->{name} } =~ $h->{regex};
                                            }
                                        }
                                        for my $c (@{ $nested_alt->{cookie_neg} }) {
                                            if (exists $n_cookies->{ $c->{name} }) {
                                                return (0, [])
                                                  if $c->{regex}
                                                  && $n_cookies->{ $c->{name} } =~ $c->{regex};
                                                return (0, []) unless $c->{regex};
                                            }
                                        }
                                        for my $c (@{ $nested_alt->{cookie_pos} }) {
                                            return (0, []) unless exists $n_cookies->{ $c->{name} };
                                            if ($c->{regex}) {
                                                return (0, [])
                                                  unless $n_cookies->{ $c->{name} } =~ $c->{regex};
                                            }
                                        }
                                        for my $re (@{ $nested_alt->{body_neg} }) {
                                            return (0, []) if $n_body =~ $re;
                                        }
                                        for my $re (@{ $nested_alt->{body_pos} }) {
                                            return (0, []) unless $n_body =~ $re;
                                        }
                                        return (1, []);
                                    };
                                    my ($n_match, $n_caps) =
                                      $nested_alt_matcher->(
                                                    $alt_code, $alt_body, $alt_headers, $alt_cookies
                                                    );
                                    if ($n_match) {
                                        $nested_or_matched = 1;
                                        push @alt_captures, @$n_caps if $n_caps;
                                        last;
                                    }
                                }
                                return (0, []) unless $nested_or_matched;
                            }
                        }
                        return (1, \@alt_captures);
                    };

                    # Test this alternative
                    my ($alt_match, $alt_caps) = $alt_matcher->($code, $body, $headers, $cookies);
                    if ($alt_match) {
                        $or_matched = 1;
                        push @captured_groups, @$alt_caps if $alt_caps;
                        last;    # One match is enough for OR
                    }
                }

                # If no alternative matched, the OR group fails
                return (0, []) unless $or_matched;
            }
        }

        # Filter out undefined captured groups and build final array
        my @final_captures = ();
        for my $capture (@captured_groups) {
            push @final_captures, $capture if defined $capture;
        }

        return (1, \@final_captures);    # All conditions passed, return captures
    };
}
#######################################################################
sub path_matcher {
    my ($files_ref, $dirs_ref, $links_ref) = @_;

    # Map file patterns to variable names
    # var can be a string or array ref for multiple variables
    my @file_patterns = ({ pattern => qr/pass/i, var => '@PASSWORDFILES' },);

    # Process files
    if ($files_ref) {
        foreach my $file (keys %{$files_ref}) {
            my $raw = $file;
            $file = validate_and_fix_regex($file);

            foreach my $check (@file_patterns) {
                if ($file =~ $check->{pattern}) {
                    my @vars = ref($check->{var}) eq 'ARRAY' ? @{ $check->{var} } : ($check->{var});
                    foreach my $var (@vars) {
                        if (index(lc($VARIABLES{$var}), lc($file)) < 0) {
                            $VARIABLES{$var} .= " $raw";
                        }
                    }
                }
            }
        }
    }

    # Map directory patterns to variable names
    # var can be a string or array ref for multiple variables
    my @dir_patterns = ({ pattern => qr/cgi/i,              var => '@CGIDIRS' },
                        { pattern => qr/forum/i,            var => [ '@NUKE', '@VBULLETIN' ] },
                        { pattern => qr/pass/i,             var => '@PASSWORDDIRS' },
                        { pattern => qr/nuke/i,             var => '@NUKE' },
                        { pattern => qr/admin/i,            var => '@ADMIN' },
                        { pattern => qr/phpmy/i,            var => '@PHPMYADMIN' },
                        { pattern => qr/fck/i,              var => '@FCKEDITOR' },
                        { pattern => qr/crystal/i,          var => '@CRYSTALREPORTS' },
                        { pattern => qr/struts/i,           var => '@STRUTSACTIONS' },
                        { pattern => qr/(wordpress|wp)/i,   var => '@WORDPRESS' },
                        { pattern => qr/php/i,              var => '@PHPINFODIRS' },
                        { pattern => qr/phpinfo/i,          var => '@PHPINFOFILES' },
                        { pattern => qr/mantis/i,           var => '@MANTIS' },
                        { pattern => qr/dokuwiki/i,         var => '@DOKUWIKI' },
                        { pattern => qr/rockmongo/i,        var => '@ROCKMONGO' },
                        { pattern => qr/magento/i,          var => '@MAGENTO' },
                        { pattern => qr/(vb|vbulletin)/i,   var => '@VBULLETIN' },
                        { pattern => qr/jenkins/i,          var => '@JENKINS' },
                        { pattern => qr/symphony|contrib/i, var => '@SYMPHONY' },
                        );

    # Process directories
    if ($dirs_ref) {
        foreach my $dir (keys %{$dirs_ref}) {

            # Directory is already validated before being stored, just use it directly
            foreach my $check (@dir_patterns) {
                if ($dir =~ $check->{pattern}) {
                    my @vars = ref($check->{var}) eq 'ARRAY' ? @{ $check->{var} } : ($check->{var});
                    foreach my $var (@vars) {
                        if (index(lc($VARIABLES{$var}), lc($dir)) < 0) {
                            $VARIABLES{$var} .= " $dir";
                        }
                    }
                }
            }
        }
    }

    # Map link patterns to variable names
    # var can be a string or array ref for multiple variables
    my @link_patterns = ({ pattern => qr/\.action(\?|$)/i, var => '@STRUTSACTIONS' },);

    # Process full links
    if ($links_ref) {
        foreach my $link (keys %{$links_ref}) {
            $link = validate_and_fix_regex($link);
            foreach my $check (@link_patterns) {
                if ($link =~ $check->{pattern}) {
                    my @vars = ref($check->{var}) eq 'ARRAY' ? @{ $check->{var} } : ($check->{var});
                    foreach my $var (@vars) {
                        if ($VARIABLES{$var} !~ /$link/i) {
                            $VARIABLES{$var} .= " $link";
                        }
                    }
                }
            }
        }
    }
}

#######################################################################
# extract IP like strings and return an array
sub get_ips {
    my $string   = shift || return;
    my $ip_regex = qr/(?:\b|[^0-9v])($LW2::IPv4_re|$LW2::IPv6_re_inc_zoneid)(?:\b|[^0-9])/;
    return $string =~ /$ip_regex/g;
}

#######################################################################
# Check an IP's validity. Returns booleans for: validity, internal, loopback
sub is_ip {
    my $ip       = $_[0] || return 0, 0, 0;
    my $internal = 0;
    my $loopback = 0;

    # This is a little hacky but prevents Cloudflare cookies and headers from reporting
    if ($ip eq '1.0.1.1') {
        return 0, 0, 0;
    }

    if ($ip =~ /^$LW2::IPv4_re$/) {

        # check for internal
        if ($ip =~ /^(?:10|192\.168|172\.(?:1[6-9]|2\d|3[01]))\./) { $internal = 1; }

        # check for loopback
        if ($ip eq '127.0.0.1') { $loopback = 1; }

    }
    elsif ($ip =~ /^$LW2::IPv6_re_inc_zoneid(?:\/[0-9]+)?$/) {

        # check for internal
        if ($ip =~ /^(?:10|192\.168|172\.(?:1[6-9]|2\d|3[01]))\./) { $internal = 1; }

        if ($ip =~ /^(?:fe80     # is a link local unicast address
                                          |ff0[1-8] # is a multicast address
                                          |fc00     # private network
        ):/ix
            ) {
            $internal = 1;
        }

        # lastly, loopback?
        # This is a bit rough 'n' ready, could do with some finesse
        if ($ip =~ /^[01:]+(?:\/[0-9]+)?$/) { $loopback = 1; }

    }
    else {
        return 0, $internal, $loopback;
    }
    return 1, $internal, $loopback;
}

#######################################################################
sub parse_dsl {
    my ($dsl) = @_;

    die "Empty DSL string" unless defined $dsl && length $dsl;

    # Split top-level conditions on && and ||, but not inside parentheses
    # This preserves OR patterns like (PATTERN1|PATTERN2&&PATTERN3)
    # First, check if there's a top-level || (OR operator)
    my $has_top_level_or = 0;
    my $depth            = 0;
    for (my $i = 0 ; $i < length($dsl) ; $i++) {
        my $char       = substr($dsl, $i, 1);
        my $next_char  = ($i < length($dsl) - 1) ? substr($dsl, $i + 1, 1) : '';
        my $prev_char  = ($i > 0)                ? substr($dsl, $i - 1, 1) : '';
        my $is_escaped = ($prev_char eq '\\');

        if (!$is_escaped) {
            if ($char eq '(') {
                $depth++;
            }
            elsif ($char eq ')') {
                $depth--;
            }
            elsif ($char eq '|' && $next_char eq '|' && $depth == 0) {
                $has_top_level_or = 1;
                last;
            }
        }
    }

    # If we have a top-level ||, split on it and wrap in OR group
    if ($has_top_level_or) {
        my @or_alternatives = ();
        $depth = 0;
        my $current_alt = '';
        for (my $i = 0 ; $i < length($dsl) ; $i++) {
            my $char       = substr($dsl, $i, 1);
            my $next_char  = ($i < length($dsl) - 1) ? substr($dsl, $i + 1, 1) : '';
            my $prev_char  = ($i > 0)                ? substr($dsl, $i - 1, 1) : '';
            my $is_escaped = ($prev_char eq '\\');

            if (!$is_escaped) {
                if ($char eq '|' && $next_char eq '|' && $depth == 0) {
                    push @or_alternatives, $current_alt if $current_alt ne '';
                    $current_alt = '';
                    $depth       = 0;    # Reset depth for new alternative
                    $i += 1; # Skip first |, loop will auto-increment to skip second |
                    next;    # Continue to next iteration (will auto-increment i, skipping second |)
                }
                elsif ($char eq '(') {
                    $depth++;
                    $current_alt .= $char;
                }
                elsif ($char eq ')') {
                    $depth--;
                    $current_alt .= $char;
                }
                else {
                    $current_alt .= $char;
                }
            }
            else {
                $current_alt .= $char;
            }
        }
        push @or_alternatives, $current_alt if $current_alt ne '';

        # Parse each alternative and create an OR group
        my @or_parsed = ();
        foreach my $alt (@or_alternatives) {
            $alt =~ s/^\s+|\s+$//g;
            next unless $alt;

     # If alternative doesn't start with a known type prefix or OR group, assume it's a BODY pattern
            if ($alt !~ /^(CODE|BODY|HEADER|COOKIE|!CODE|!BODY|!HEADER|!COOKIE):/i && $alt !~ /^\(/)
            {
                $alt = "BODY:$alt";
            }
            my $alt_parsed = parse_dsl($alt);
            push @or_parsed, $alt_parsed;
        }

        # Return a compiled structure with just the OR group
        my %compiled = (code_pos   => [],
                        code_neg   => [],
                        body_pos   => [],
                        body_neg   => [],
                        header_pos => [],
                        header_neg => [],
                        cookie_pos => [],
                        cookie_neg => [],
                        or_groups  => [ \@or_parsed ],
                        );
        return \%compiled;
    }

    # No top-level ||, proceed with normal && splitting
    my @tokens = ();
    $depth = 0;
    my $current_token = '';
    my $i             = 0;
    my $len           = length($dsl);

    while ($i < $len) {
        my $char      = substr($dsl, $i, 1);
        my $next_char = ($i < $len - 1) ? substr($dsl, $i + 1, 1) : '';
        my $prev_char = ($i > 0)        ? substr($dsl, $i - 1, 1) : '';

        # Check if && is escaped (previous char is backslash, similar to original regex)
        my $is_escaped = ($prev_char eq '\\');

        if (!$is_escaped) {
            if ($char eq '(') {
                $depth++;
                $current_token .= $char;
            }
            elsif ($char eq ')') {
                $depth--;
                $current_token .= $char;
            }
            elsif ($char eq '&' && $next_char eq '&' && $depth == 0) {

                # Found top-level && delimiter
                push @tokens, $current_token if $current_token ne '';
                $current_token = '';
                $i += 2;    # Skip both & characters
                next;
            }
            else {
                $current_token .= $char;
            }
        }
        else {
            # Escaped character, just add it
            $current_token .= $char;
        }
        $i++;
    }
    push @tokens, $current_token if $current_token ne '';

    my %compiled = (code_pos   => [],
                    code_neg   => [],
                    body_pos   => [],
                    body_neg   => [],
                    header_pos => [],
                    header_neg => [],
                    cookie_pos => [],
                    cookie_neg => [],
                    or_groups  => [],    # Store OR patterns for special handling
                    );

    foreach my $token (@tokens) {
        $token =~ s/^\s+|\s+$//g;                     # trim whitespace
        $token =~ s/,\s*$// if length($token) > 1;    # trim trailing comma
        next unless $token;

        # Check if this is an OR pattern (starts with ( and ends with ))
        # Use regex to check if it's a properly formed OR pattern
        if ($token =~ /^\((.*)\)$/) {

            # Verify balanced parentheses in the content (the outer parens are already matched)
            my $or_content = $1;
            my $depth      = 0;
            my $valid_or   = 1;
            for my $i (0 .. length($or_content) - 1) {
                my $char       = substr($or_content, $i, 1);
                my $prev_char  = ($i > 0) ? substr($or_content, $i - 1, 1) : '';
                my $is_escaped = ($prev_char eq '\\');

                if (!$is_escaped) {
                    if ($char eq '(') {
                        $depth++;
                    }
                    elsif ($char eq ')') {
                        $depth--;
                        if ($depth < 0) {
                            $valid_or = 0;
                            last;
                        }
                    }
                }
            }

            # Content must have balanced parentheses
            if ($valid_or && $depth == 0) {

                # Split on | but not escaped |
                my @alternatives = split /(?<!\\)\|/, $or_content;

                # Parse each alternative as a separate DSL expression
                my @or_parsed = ();
                foreach my $alt (@alternatives) {
                    $alt =~ s/^\s+|\s+$//g;
                    next unless $alt;

                    # Recursively parse this alternative
                    my $alt_parsed = parse_dsl($alt);
                    push @or_parsed, $alt_parsed;
                }

                # Store the OR group
                push @{ $compiled{or_groups} }, \@or_parsed;
                next;
            }
            else {
                # Token looks like an OR pattern but has unbalanced parentheses
                die "Invalid DSL token: OR pattern has unbalanced parentheses: $token";
            }
        }
        elsif ($token =~ /^\(/) {

            # Token starts with ( but doesn't match OR pattern format
            # Show token details for debugging
            my $token_len  = length($token);
            my $first_char = substr($token, 0, 1);
            my $last_char  = substr($token, -1);
            die
              "Invalid DSL token: token starts with '(' but is not a properly formed OR pattern (must start with '(' and end with ')'): length=$token_len, first='$first_char', last='$last_char', token='$token'";
        }

        # Check negation
        my $neg = 0;
        if ($token =~ /^!/) {
            $neg   = 1;
            $token = substr($token, 1);
        }

        # Skip @LFI() tokens - they are placeholders that will be expanded at runtime
        # This can happen if variables aren't loaded yet during validation
        if ($token =~ /^@?LFI\(\)$/) {
            next;
        }

        # TYPE:VALUE split (only first colon)
        my ($type, $pattern) = split /:/, $token, 2;
        die "Invalid DSL token: $token" unless defined $type && defined $pattern;
        $type = uc($type);

        if ($type eq 'CODE') {
            push @{ $neg ? $compiled{code_neg} : $compiled{code_pos} }, compile_regex($pattern);

        }
        elsif ($type eq 'BODY') {
            die "Empty BODY pattern in DSL" if $pattern eq '';
            my $compiled = compile_regex($pattern);
            push @{ $neg ? $compiled{body_neg} : $compiled{body_pos} }, $compiled;

        }
        elsif ($type eq 'HEADER') {
            my ($hname, $hval) = split /:/, $pattern, 2;
            die "Missing HEADER name: $token" unless defined $hname && length $hname;
            $hname =~ s/^\s+|\s+$//g;
            $hval = '' unless defined $hval;
            $hval =~ s/^\s+//;
            my $re = length($hval) ? compile_regex($hval) : undef;
            push @{ $neg ? $compiled{header_neg} : $compiled{header_pos} },
              { name  => lc($hname),
                regex => $re,
                };

        }
        elsif ($type eq 'COOKIE') {
            my ($cname, $cval) = split /:/, $pattern, 2;
            die "Missing COOKIE name: $token" unless defined $cname && length $cname;
            $cname =~ s/^\s+|\s+$//g;
            $cval = '' unless defined $cval;
            $cval =~ s/^\s+//;
            my $re = length($cval) ? compile_regex($cval) : undef;
            push @{ $neg ? $compiled{cookie_neg} : $compiled{cookie_pos} },
              { name  => lc($cname),
                regex => $re,
                };

        }
        else {
            die "Unknown DSL type: $type";
        }
    }

    return \%compiled;
}

#######################################################################
sub compile_regex {
    my ($pattern) = @_;

    # Remove escapes for our delimiters (but preserve other escapes like \. \d etc)
    # However, don't unescape pipes inside escaped parentheses \( \) as those are literal
    # Protect pipes inside \( \) blocks by temporarily replacing them
    my @protected_blocks = ();
    my $block_idx        = 0;
    while ($pattern =~ /(\\\([^)]*\\\))/g) {
        my $block       = $1;
        my $placeholder = "___PROTECTED_BLOCK_${block_idx}___";
        $protected_blocks[$block_idx] = $block;
        $pattern =~ s/\Q$block\E/$placeholder/;
        $block_idx++;
    }

    # Now unescape delimiters outside protected blocks
    $pattern =~ s/\\([|!&:])/$1/g;

    # Restore protected blocks (with their escaped pipes intact)
    for (my $i = 0 ; $i < @protected_blocks ; $i++) {
        my $placeholder = "___PROTECTED_BLOCK_${i}___";
        $pattern =~ s/\Q$placeholder\E/$protected_blocks[$i]/;
    }

    # Fix escaped quotes - convert \" to " (escaped quotes in CSV become literal quotes in regex)
    # This prevents "Trailing \ in regex" errors when patterns end with \"
    $pattern =~ s/\\"/"/g;

    # Fix trailing backslashes - if pattern ends with \ (not part of an escape sequence), double it
    # This prevents "Trailing \ in regex" errors (e.g., "c:\" becomes "c:\\")
    # Only do this if the backslash is not already escaped (not "\\")
    if ($pattern =~ /[^\\]\\$/) {
        $pattern =~ s/([^\\])\\$/$1\\\\/;    # Double the trailing backslash
    }
    elsif ($pattern =~ /^\\$/) {

        # Pattern is just a single backslash
        $pattern = '\\\\';
    }

    # Handle case-insensitive flag
    my $mod = '';
    if ($pattern =~ s/^\(\?i\)//) {
        $mod = '(?i)';
    }

    # Compile the regex pattern
    my $re = eval { qr/$mod$pattern/ };
    die "Invalid regex '$pattern': $@" if $@;

    return $re;
}

#######################################################################
sub parse_csv {
    my $text = $_[0] || return;
    my @new  = ();
    push(@new, $+) while $text =~ m{
      "([^\"\\]*(?:\\.[^\"\\]*)*)",?
       |  ([^,]+),?
       | ,
   }gx;
    push(@new, undef) if substr($text, -1, 1) eq ',';
    return @new;
}
#######################################################################
sub check_ssl_support {
    LW2::init_ssl_engine();
    my ($avail, $lib, $ver) = LW2::ssl_is_available();
    if (!$avail) {
        nprint("+ WARNING: SSL: support not available.");
    }
}

#######################################################################
sub version {
    nprint("$VARIABLES{'name'} $VARIABLES{'version'} (LW $LW2::VERSION)");
    exit 0;
}

#######################################################################
sub send_updates {
    return if ($CONFIGFILE{'UPDATES'} !~ /yes|auto/i);
    my (@MARKS) = @_;
    my ($updated_version, $answer, $code, $upd_enc);
    my $have_updates = 0;

    foreach my $mark (@MARKS) {
        foreach my $component (keys %{ $mark->{'components'} }) {
            if ($mark->{'components'}->{$component} eq 2) {
                if    ($component !~ /\d/)                               { next; }
                elsif ($component =~ /^(?:\(?Win32\)?|Linux-Mandrake$)/) { next; }
                elsif ($component eq "")                                 { next; }
                $have_updates = 1;
                $updated_version .= "$component ";
            }
        }
    }

    if ((!$have_updates) || ($updated_version eq "")) { return; }

    $updated_version =~ s/\s+$//;
    $updated_version =~ s/^\s+//;

    if ($CONFIGFILE{'UPDATES'} eq "auto") {
        $answer = "y";
    }
    else {
        $answer = read_data(
            "\n
      *********************************************************************
      Portions of the server's headers ($updated_version) are not in
      the Nikto "
              . $VARIABLES{'version'}
              . " database or are newer than the known string. Would you like
      to submit this information (*no server specific data*) to CIRT.net
      for a Nikto update (or you may email to sullo\@cirt.net) (y/n)? ", ""
              );
    }

    if ($answer !~ /y/i) { return; }

    # set up our mark
    my %mark = ('ident' => $CONFIGFILE{CIRT},
                'ssl'   => 1,
                'port'  => 443
                );

    ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'}) = resolve($CONFIGFILE{CIRT}, 0);

    $upd_enc = LW2::encode_base64($updated_version);
    chomp($upd_enc);

    # Use libwhisker directly instead of nfetch to avoid reporting on update target
    my (%request, %response);
    setup_hash(\%request, \%mark, "");
    $request{'whisker'}->{'uri'}    = "/nikto-updates.php?version=$upd_enc";
    $request{'whisker'}->{'method'} = "GET";
    $request{'whisker'}->{'host'}   = $mark{'hostname'};
    $request{'Accept'}              = '*/*';
    $request{'User-Agent'}          = get_ua();

    LW2::http_fixup_request(\%request);

    LW2::http_do_request_timeout(\%request, \%response);
    $code    = $response{'whisker'}->{'code'};
    $content = $response{'whisker'}->{'data'};

    if ($code eq 407) {
        if ($CONFIGFILE{PROXYUSER} eq "") {
            $CONFIGFILE{PROXYUSER} = read_data("Proxy ID: ",   "");
            $CONFIGFILE{PROXYPASS} = read_data("Proxy Pass: ", "noecho");
        }
        LW2::http_do_request_timeout(\%request, \%response);
        $code    = $response{'whisker'}->{'code'};
        $content = $response{'whisker'}->{'data'};
    }

    if ($code eq "") {
        LW2::http_close(\%request);

        # Use CIRT config hostname for fallback
        my ($fallback_hostname, $fallback_ip, $fallback_display) = resolve($CONFIGFILE{CIRT}, 0);
        $mark{'ip'} = $fallback_ip;
        $request{'whisker'}->{'host'} = $fallback_hostname;
        LW2::http_fixup_request(\%request);
        LW2::http_do_request_timeout(\%request, \%response);
        $code    = $response{'whisker'}->{'code'};
        $content = $response{'whisker'}->{'data'};
    }

    if (($code != 200) || ($content !~ /SUCCESS/)) {
        nprint("+ ERROR: $code -> "
                 . $response{'location'}
                 . "\n+ ERROR: Update failed, please notify sullo\@cirt.net of the previous line.",
               "",
               ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'})
               );
    }
    else {
        nprint("- Sent updated info to cirt.net -- Thank you!");
    }

    return;
}

#######################################################################
sub usage {
    print "
   Options:
       -Add-header         Add HTTP headers (can be used multiple times, one per header pair)
       -ask+               Whether to ask about submitting updates
                               yes   Ask about each (default)
                               no    Don't ask, don't send
                               auto  Don't ask, just send
       -check6             Check if IPv6 is working (connects to ipv6.google.com or value set in nikto.conf)
       -Cgidirs+           Scan these CGI dirs: \"none\", \"all\", or values like \"/cgi/ /cgi-a/\"
       -config+            Use this config file
       -Display+           Turn on/off display outputs:
                               1     Show redirects
                               2     Show cookies received
                               3     Show all 200/OK responses
                               4     Show URLs which require authentication
                               D     Debug output
                               E     Display all HTTP errors
                               P     Print progress to STDOUT
                               S     Scrub output of IPs and hostnames
                               V     Verbose output
       -dbcheck           Check database and other key files for syntax errors
       -evasion+          Encoding technique:\n";

    foreach my $k (sort keys %{ $NIKTO{'anti_ids'} }) {
        print "                               $k     $NIKTO{'anti_ids'}{$k}\n";
    }

    print "        -followredirects   Follow 3xx redirects to new location
        -Format+           Save file (-o) format:
                               csv   Comma-separated-value
                               json  JSON Format
                               htm   HTML Format
                               sql   Generic SQL (see docs for schema)
                               txt   Plain text
                               xml   XML Format
                               (if not specified the format will be taken from the file extension passed to -output)
       -Help              This help information
       -host+             Target host/URL
       -id+               Host authentication to use, format is id:pass or id:pass:realm
       -ipv4                 IPv4 Only
       -ipv6                 IPv6 Only
       -key+              Client certificate key file
       -list-plugins      List all available plugins, perform no testing
       -maxtime+          Maximum testing time per host (e.g., 1h, 60m, 3600s)
       -mutate+           Guess additional file names:\n";

    foreach my $k (sort keys %{ $NIKTO{'mutate_opts'} }) {
        print "                               $k     $NIKTO{'mutate_opts'}{$k}\n";
    }

    print "       -mutate-options    Provide information for mutates
       -nocheck           Don't check for updates on startup
       -nocookies         Do not use cookies from responses in requests
       -nointeractive     Disables interactive features
       -nolookup          Disables DNS lookups
       -nossl             Disables the use of SSL
       -noslash           Strip trailing slash from URL (e.g., '/admin/' to '/admin')
       -no404             Disables nikto attempting to guess a 404 page
       -Option            Over-ride an option in nikto.conf, can be issued multiple times
       -output+           Write output to this file ('.' for auto-name)
       -Pause+            Pause between tests (seconds)
       -Platform+         Platform of target (nix, win, all)
       -Plugins+          List of plugins to run (default: ALL)
       -port+             Port to use (default 80)
       -RSAcert+          Client certificate file
       -root+             Prepend root value to all requests, format is /directory
       -Save              Save positive responses to this directory ('.' for auto-name)
       -ssl               Force ssl mode on port
       -Tuning+           Scan tuning:
                               1     Interesting File / Seen in logs
                               2     Misconfiguration / Default File
                               3     Information Disclosure
                               4     Injection (XSS/Script/HTML)
                               5     Remote File Retrieval - Inside Web Root
                               6     Denial of Service
                               7     Remote File Retrieval - Server Wide
                               8     Command Execution / Remote Shell
                               9     SQL Injection
                               0     File Upload
                               a     Authentication Bypass
                               b     Software Identification
                               c     Remote Source Inclusion
                               d     WebService
                               e     Administrative Console
                               x     Reverse Tuning Options (i.e., include all except specified)
       -timeout+          Timeout for requests (default 10 seconds)
       -Userdbs           Load only user databases, not the standard databases
                               all   Disable standard dbs and load only user dbs
                               tests Disable only db_tests and load udb_tests
       -useragent         Force User-Agent instead of pulling from database
       -url+              Target host/URL (alias of -host)
       -useproxy          Use the proxy defined in nikto.conf, or argument http://server:port
       -Version           Print plugin and database versions
       -vhost+            Virtual host (for Host header)
       -404code           Ignore these HTTP codes as negative responses (always). Format is \"302,301\".
       -404string         Ignore this string in response body content as negative response (always). Can be a regular expression.
   		+ requires a value\n\n";

    exit 0;
}

#######################################################################
sub init_db {
    my $dbname = shift;
    return if $dbname eq "";
    my $filename = "$CONFIGFILE{'DBDIR'}/" . $dbname;
    my (@dbarray, @headers);
    my $hashref = {};

    if ($CLI{'userdbs'} ne 'all') {

        # Check that the database exists
        unless (open(IN, "<$filename")) {
            nprint("+ ERROR: Unable to open database file $dbname: $@.");
            return $dbarray;
        }

        # Now read the header values
        while (<IN>) {
            chomp;
            s/\#.*$//;
            if     ($_ eq "") { next }
            unless (@headers) {
                @headers = parse_csv($_);
            }
            else {

                # contents; so split them up and apply to hash
                my @contents = parse_csv($_);
                my $hashref  = {};
                for (my $i = 0 ; $i <= $#contents ; $i++) {
                    $hashref->{ $headers[$i] } = $contents[$i];
                }
                push(@dbarray, $hashref);
            }
        }
        close(IN);
    }

    # And the udb_* file
    $filename = "$CONFIGFILE{'DBDIR'}/u" . $dbname;
    if (open(IN, "<$filename")) {
        while (<IN>) {
            chomp;
            s/\#.*$//;
            if ($_ eq "") { next; }

            # contents; so split them up and apply to hash
            my @contents = parse_csv($_);
            my $hashref  = {};
            for (my $i = 0 ; $i <= $#contents ; $i++) {
                $hashref->{ $headers[$i] } = $contents[$i];
            }
            push(@dbarray, $hashref);
        }
    }
    close(IN);

    return \@dbarray;
}

#######################################################################
sub add_vulnerability {
    my ($mark, $message, $nikto_id, $refs, $method, $uri, $request, $response, $reason) = @_;

    # Also normalize the response URI so it's consistent when used later
    if (defined $response && defined $response->{whisker}) {
        if (   !defined $response->{whisker}->{uri_requested}
            || $response->{whisker}->{uri_requested} eq ""
            || $response->{whisker}->{uri_requested} eq ".") {
            $response->{whisker}->{uri_requested} = "/";
        }
    }
    $method = "GET" unless (defined $method);

    # Grammar matters
    if ($message !~ /\.$/) {
        $message .= ".";
    }

    # check to see if we've alerted already (can be from content search, etc.)
    foreach my $r (@RESULTS) {
        if (   ($uri eq $r->{'uri'})
            && ($message eq $r->{'message'})
            && ($method eq $r->{'method'})
            && (${ $r->{'mark'} }{'ident'} eq $mark->{'ident'})
            && (${ $r->{'mark'} }{'port'} eq $mark->{'port'})) {
            return;
        }
    }

    my $result = "";
    if (defined $_[7]) {
        $result = $_[7]->{'whisker'}->{'data'};
    }

    my $resulthash;
    %$resulthash = (mark     => $mark,
                    message  => $message,
                    nikto_id => $nikto_id,
                    refs     => $refs,
                    method   => $method,
                    uri      => $response->{whisker}->{uri_requested} || '/',
                    result   => $result,
                    request  => $request,
                    response => $response,
                    reason   => $reason,
                    );

    push(@RESULTS, $resulthash);
    $mark->{total_vulns}++;

    if ($refs ne "") {
        $message .= " See: $refs";
    }

    nprint("+ [$nikto_id] $message",
           "", ($mark->{'hostname'}, $mark->{'ip'}, $mark->{'displayname'}));

    # Save it
    if ($CLI{'saveresults'} ne '') {
        save_item($resulthash, $message, $request, $response);
    }

    # Now report it
    report_item($mark, $resulthash);
}

###############################################################################
sub rebuild_request {
    my ($req, $include_body, $truncate_length) = @_;
    return '' unless ref($req) eq 'HASH';

    # Default to including body for backward compatibility
    $include_body = 1 unless defined $include_body;

    my $w = (ref($req->{whisker}) eq 'HASH') ? $req->{whisker} : {};

    my $method = $w->{method} || 'GET';
    my $uri    = defined $w->{uri} ? $w->{uri} : '/';
    my $proto  = $w->{protocol} || 'HTTP';
    my $ver    = $w->{version}  || '1.1';

    my $eol = (defined $w->{http_eol} && $w->{http_eol} ne '') ? $w->{http_eol} : "\r\n";

    # Things that are NOT HTTP headers in LW2 request structure
    my %NOT_HEADERS = map { $_ => 1 } qw(
      whisker data MAGIC host port ssl max_size
      method uri protocol version timeout
      http_eol http_space1 http_space2 retry
      uri_param_sep uri_prefix uri_postfix include_host_in_uri
      force_bodysnatch force_open force_close trailing_slurp
      ignore_duplicate_headers lowercase_incoming_headers normalize_incoming_headers
      require_newline_after_headers invalid_protocol_return_value
      ssl_certfile ssl_rsacertfile ssl_save_info
      );

    # Allowlist pattern for header names
    my $is_header_name = sub {
        my ($k) = @_;
        return 0 if !defined $k;
        return 0 if $NOT_HEADERS{$k};    # hard stop
        return ($k =~ /^[A-Za-z][A-Za-z0-9-]*$/) ? 1 : 0;
    };

    # Merge headers: whisker first, then top-level overrides
    my %h;

    for my $k (keys %$w) {
        next unless $is_header_name->($k);
        next unless defined $w->{$k};
        next if ref($w->{$k});
        $h{$k} = $w->{$k};
    }

    for my $k (keys %$req) {
        next unless $is_header_name->($k);
        next unless defined $req->{$k};
        next if ref($req->{$k});
        $h{$k} = $req->{$k};
    }

    # Determine Host header value (prefer explicit Host; else whisker 'host')
    my $host_val = '';
    if (exists $h{Host} && defined $h{Host}) {
        $host_val = $h{Host};
    }
    elsif (defined $w->{host} && $w->{host} ne '') {
        $host_val = $w->{host};
    }

    # Build request line
    my $out = "$method $uri $proto/$ver$eol";

    # Host header must be immediately after request line
    if ($host_val ne '') {
        $host_val =~ s/\r|\n/ /g;
        $out .= "Host: $host_val$eol";
        delete $h{Host};    # avoid duplicate
    }

    # Other headers: stable order (case-insensitive)
    my @keys = sort { lc($a) cmp lc($b) } keys %h;

    for my $k (@keys) {
        my $v = $h{$k};
        next unless defined $v;
        $v =~ s/\r|\n/ /g;
        $out .= "$k: $v$eol";
    }

    $out .= $eol;

    # Include body if flag is set
    if ($include_body && defined $w->{data} && length($w->{data})) {
        $out .= $w->{data};
    }

    # Truncate if length specified
    if (defined $truncate_length && $truncate_length > 0 && length($out) > $truncate_length) {
        my $original_length = length($out);
        $out = substr($out, 0, $truncate_length);
        $out .= "\n[Request truncated - original size: $original_length bytes]";
    }

    return $out;
}

###############################################################################
sub rebuild_response {
    my ($resp, $include_body, $truncate_length) = @_;
    return '' unless ref($resp) eq 'HASH';

    # Default to including body for backward compatibility
    $include_body = 1 unless defined $include_body;

    my $w = (ref($resp->{whisker}) eq 'HASH') ? $resp->{whisker} : {};

    my $proto = $w->{protocol} || 'HTTP';
    my $ver   = $w->{version}  || '1.1';
    my $code  = defined $w->{code}    ? $w->{code}    : '200';
    my $msg   = defined $w->{message} ? $w->{message} : 'OK';

    my $eol = (defined $w->{http_eol} && $w->{http_eol} ne '') ? $w->{http_eol} : "\r\n";

    # Build status line
    my $out = "$proto/$ver $code $msg$eol";

    # Use header_order from whisker hash to maintain original header order
    if (defined $w->{header_order} && ref($w->{header_order}) eq 'ARRAY') {
        my %header_output;    # Track which header values we've already output
        foreach my $header_name (@{ $w->{header_order} }) {
            next if ($header_name eq '' || $header_name eq 'whisker');
            next unless defined $resp->{$header_name};

            # Handle multiple values for the same header (array reference)
            if (ref($resp->{$header_name}) eq 'ARRAY') {
                my $value_idx = $header_output{$header_name} || 0;

                # Output one value per header_order entry to maintain order
                if ($value_idx < @{ $resp->{$header_name} }) {
                    my $value = $resp->{$header_name}->[$value_idx];
                    if (defined $value) {
                        $value =~ s/\r|\n/ /g;
                        $out .= "$header_name: $value$eol";
                        $header_output{$header_name} = $value_idx + 1;
                    }
                }
            }
            else {
                # Single value header - only output once even if in header_order multiple times
                unless ($header_output{$header_name}) {
                    my $value = $resp->{$header_name};
                    $value =~ s/\r|\n/ /g;
                    $out .= "$header_name: $value$eol";
                    $header_output{$header_name} = 1;
                }
            }
        }
    }

    $out .= $eol;

    # Include body if flag is set
    if ($include_body && defined $w->{data} && length($w->{data})) {
        $out .= $w->{data};
    }

    # Truncate if length specified
    if (defined $truncate_length && $truncate_length > 0 && length($out) > $truncate_length) {
        my $original_length = length($out);
        $out = substr($out, 0, $truncate_length);
        $out .= "\n[Response truncated - original size: $original_length bytes]";
    }

    return $out;
}

###############################################################################
sub list_plugins {

    # Just do a load_plugins, then loop through the array and print out name,
    # description and copyright

    load_plugins();

    foreach my $plugin (@PLUGINS) {
        nprint("Plugin: $plugin->{'name'}");
        nprint(" $plugin->{'full_name'} - $plugin->{'description'}");
        nprint(" Written by $plugin->{'author'}, Copyright (C) $plugin->{'copyright'}");
        if (defined $plugin->{'options'}) {
            nprint(" Options:");
            while (my ($option, $description) = each(%{ $plugin->{'options'} })) {
                nprint("  $option: $description");
            }
        }
        nprint("\n");
    }

    # Plugin macros
    nprint("Defined plugin macros:");

    foreach my $macro (keys %CONFIGFILE) {
        if ($macro =~ /^@@/) {
            nprint(" $macro = \"" . $CONFIGFILE{$macro} . "\"");
            if ($CONFIGFILE{$macro} =~ /@@/) {
                nprint("  (expanded) = \"" . expand_pluginlist($CONFIGFILE{$macro}, 0) . "\"");
            }
        }
    }

    exit 0;
}

###############################################################################
# This is overly complicated and jumps a lot between scalars and arrays. The REs are
# probably dodgy, but it works! W00!
sub expand_pluginlist {
    my ($pluginlist, $parent) = @_;

    my @macros;
    foreach my $config (keys %CONFIGFILE) {
        if ($config =~ /^@@/) {
            push(@macros, $config);
        }
    }

    # Now loop through each member of the list and expand it
    my $count       = 0;
    my $npluginlist = $pluginlist;
    do {
        $count++;
        my @raw = split(/;/, $npluginlist);

        # cooked contains the processed list
        my @cooked;
        foreach my $entry (@raw) {

            # Is it +; if so remap to @@DEFAULT
            if ($entry eq "+") {
                $entry = '@@DEFAULT';
            }

            # result contains the processed entry
            my $result = $original = $entry;

            # Is it a macro
            if ($entry =~ /^-?@@/) {

                # break up into components
                $prefix = ($entry =~ /^-/) ? "-" : "";
                $name   = $suffix = $entry;
                $name   =~ s/(^-?)(@@[[:alpha:]]+)(\(?.*\)?$)/$2/;
                $suffix =~ s/(.*)(\(.*\))/$2/;
                if ($suffix eq $entry) {
                    $suffix = "";
                }
                foreach my $macro (@macros) {
                    if ($entry =~ /-?$macro/) {

                        # It's a macro, so replace the contents with the macro
                        # Add prefix and suffix to each member of the macro
                        my @temp;
                        foreach my $child (split(/;/, $CONFIGFILE{$macro})) {
                            push(@temp, "$prefix$child$suffix");
                        }
                        $result = join(';', @temp);

                        # stop an infinite loop
                        last;
                    }
                }
            }
            if ($result =~ /^-?@@/ && $result eq $original) {

                # macro not found or is itself - ignore
                $result = "";
            }
            if ($count > 100) {

                # check for recurstion
                nprint("ERROR: Recursion found whilst expanding macros");
                $result = "";
                last;
            }
            push(@cooked, $result);
        }
        $npluginlist = join(';', @cooked);
    } while ($npluginlist =~ /@@/ && $count <= 100);

    #use re 'debug';
    # Now we've expanded out macros, deal with duplicates and -
    my @raw = split(/;/, $npluginlist);

    # hash so we don't have to mess with duplicates
    my %cooked;
    foreach my $plugin (@raw) {

        # break out components
        my $minus;
        my $name = my $suffix = $plugin;
        $minus = (substr($plugin, 0, 1) eq '-');
        $name   =~ s/(^-?)([^\(]+)(\(?.*\)?$)/$2/;
        $suffix =~ s/(.*)(\(.*\))/$2/;
        if ($suffix eq $plugin) {
            $suffix = "";
        }

        if ($minus) {

            # it's a minus - remove any previous entry
            if (exists $cooked{$name}) {
                delete $cooked{$name};
            }
        }
        else {

            # else add it with the parameters as the value of the hash
            $cooked{$name} = $suffix;
        }
    }

    # Now rejoin into one happy whole
    my $output;
    foreach my $plugin (keys %cooked) {
        $output .= "$plugin" . $cooked{$plugin} . ";";
    }

    # remove the last ;
    $output =~ s/;$//g;

    return $output;
}
###############################################################################
# Check a regex for validation & fix. If mode=1, return a flag which indicates
# whether the regex was changed
sub validate_and_fix_regex {
    my ($regex, $mode) = @_;
    my $fixed = 0;
    eval { qr/$regex/ };
    if ($@) {
        $fixed = 1;
        $regex = rquote($regex);
    }
    return $mode ? ($regex, $fixed) : $regex;
}
###############################################################################
# Process captured groups in message strings
# Replaces $1, $2, etc. with captured group values
sub process_captured_groups {
    my ($message, $captures) = @_;

    # Quick exit if no message or captures
    return $message unless $message && $captures && @$captures;

    # Quick exit if message has no placeholder patterns
    return $message unless $message =~ /\$\d+/;

    # Replace $1, $2, etc. with captured values
    for my $i (1 .. @$captures) {
        my $value = $captures->[ $i - 1 ];

        # Replace with captured value or empty string if undefined
        $value = '' unless defined $value;
        $message =~ s/\$$i(?!\d)/$value/g;
    }

    return $message;
}
###############################################################################
sub rquote {
    my $string = $_[0] || return;
    $string =~ s/([^A-Za-z_0-9 "'\\])/\\$1/g;
    return $string;
}
###############################################################################
sub gmt_offset {
    my @t = localtime(time);
    return (timegm(@t) - timelocal(@t)) / 3600;
}
###############################################################################
sub expand_range {
    local $" = '..';
    my (@range);

    sort { $a <=> $b }
      map {
        map { ((@range = split /-/) == 2) ? eval('map {$_} ' . "@range") : $_ }
          split /\s/
      } @_;
}
###############################################################################
sub check_ipv6 {
    nprint("Performing IPv6 connectivity tests:");

    # Perform a series of tests and: exit 1 or 0

    # Does the version of Socket even support IPv6?
    if (!$LW2::LW2_CAN_IPv6) {
        nprint(
            "+ ERROR: This version of Socket ($Socket::VERSION) has insufficient (or no) IPv6 support"
            );
        exit 1;
    }
    nprint("+ This version of Socket ($Socket::VERSION) does support IPv6");

    # Ensure switches are in a known state
    $CLI{'ipv6'} = 1;
    $CLI{'ipv4'} = 0;

    if ($CONFIGFILE{'CHECK6HOST'} eq "") {
        $CONFIGFILE{'CHECK6HOST'} = 'ipv6.google.com';
        $CONFIGFILE{'CHECK6PORT'} = '443';
    }

    # Try to resolve a known IPv6 hostname
    my ($name, $ip, $displayname) = resolve($CONFIGFILE{'CHECK6HOST'});
    if (!$ip) {
        nprint("- DNS resolution of '$CONFIGFILE{'CHECK6HOST'}' using AF_INET6 failed");
        nprint(
            "\t(Perhaps no DNS server set or server is incapable of resolving an IPv6 address for $CONFIGFILE{'CHECK6HOST'})"
            );
        exit 1;
    }
    nprint("+ Successful DNS resolution of '$CONFIGFILE{'CHECK6HOST'}': $ip");

    # Try to connect to the host
    my $res = LW2::utils_port_open($CONFIGFILE{'CHECK6HOST'}, $CONFIGFILE{'CHECK6PORT'});
    if (!$res) {
        nprint(
            "+ ERROR: TCP connection to '$CONFIGFILE{'CHECK6HOST'}:$CONFIGFILE{'CHECK6PORT'}' using AF_INET6 failed"
            );
        nprint("\t(Likely either no IPv6 connectivity or firewall blocking)");
        exit 1;
    }
    nprint("+ Successful TCP connection to '$CONFIGFILE{'CHECK6HOST'}:$CONFIGFILE{'CHECK6PORT'}'");
    nprint("----> All tests successful");
    exit 0;
}
###############################################################################
sub nikto_core { return; }    # trap for this plugin being called to run. lame.
###############################################################################

1;