Tag internal nuclei scans with authorized-scan UA to aid SIEM filtering

modules/attack-box/files/recon_automation.sh

@@ -11,7 +11,8 @@ if [ $# -eq 0 ]; then
 fi
 
 TARGET="$1"
-WORKSPACE="/root/operator/scans/reachability/$TARGET"
+BASE_DIR="${WORK_DIR:-${WORK_DIR:-/root/workspace}}"
+WORKSPACE="$BASE_DIR/scans/reachability/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)
 
 # Colors for output
@@ -78,7 +79,7 @@ done < live_subdomains.txt
 
 # Vulnerability scanning with Nuclei
 echo -e "${GREEN}[+] Phase 7: Vulnerability Scanning${NC}"
-log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -t ~/nuclei-templates/ -o nuclei_results.txt"
+log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -H 'User-Agent: homelab-security-scan/nuclei' -t ~/nuclei-templates/ -o nuclei_results.txt"
 
 # Summary
 echo -e "${GREEN}[+] Reconnaissance Complete!${NC}"

modules/attack-box/files/trashpanda.py

@@ -207,7 +207,9 @@ def print_banner():
     """
     print(banner)
 
-def create_pentest_structure(base_name="/root/operator"):
+def create_pentest_structure(base_name=None):
+    if base_name is None:
+        base_name = os.environ.get("WORK_DIR", os.environ.get("WORK_DIR", "/root/workspace"))
     """Create a comprehensive penetration testing directory structure."""
     
     # Main engagement directory
@@ -301,7 +303,7 @@ def create_pentest_structure(base_name="/root/operator"):
         f.write(f"TrashPanda Engagement Log\n")
         f.write(f"========================\n")
         f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: {os.environ.get('USER', 'operator')}\n")
         f.write(f"Tool: TrashPanda v2.4\n\n")
 
     # Create initial target file
@@ -2663,7 +2665,7 @@ def run_enhanced_web_enumeration(base_dir, targets, stealth=False, debug=False):
             f"gobuster dir -u {base_url}/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -x txt,html,php,asp,aspx,jsp -t 50",
             f"hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/seclists/Passwords/darkweb2017-top100.txt {ip} http-post-form '/login.php:username=^USER^&password=^PASS^:invalid'",
             f"sqlmap -u '{base_url}/?id=1' --batch --banner",
-            f"nuclei -u {base_url} -t /root/nuclei-templates/"
+            f"nuclei -u {base_url} -H 'User-Agent: homelab-security-scan/nuclei' -t /root/nuclei-templates/"
         ]
         
         add_manual_command(base_dir, f"Web Service {base_url}", manual_commands)
@@ -3044,7 +3046,7 @@ def generate_summary_report(base_dir):
         f.write("TRASHPANDA COMPREHENSIVE PENETRATION TESTING REPORT\n")
         f.write("=" * 80 + "\n\n")
         f.write(f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: {os.environ.get('USER', 'operator')}\n")
         f.write(f"Engagement Directory: {base_dir}\n\n")
 
         # Enhanced directory structure overview
@@ -3153,7 +3155,8 @@ Examples:
     parser.add_argument("targets", nargs='?', help="Target file, IP, IP range, or CIDR")
     
     # Directory options
-    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/operator")
+    parser.add_argument("-d", "--directory", help="Engagement directory name",
+                        default=os.environ.get("WORK_DIR", os.environ.get("WORK_DIR", "/root/workspace")))
     parser.add_argument("-c", "--create-dirs", action="store_true", help="Only create directory structure and exit")
     
     # Scan modes

modules/attack-box/files/web_enum_automation.sh

@@ -14,7 +14,8 @@ fi
 TARGET_URL="$1"
 # Extract domain/IP for workspace naming
 TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
-WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
+BASE_DIR="${WORK_DIR:-${WORK_DIR:-/root/workspace}}"
+WORKSPACE="$BASE_DIR/scans/web/$TARGET_CLEAN"
 DATE=$(date +%Y%m%d_%H%M%S)
 
 # Colors for output
@@ -90,7 +91,7 @@ log_and_run "Nikto scan" "nikto -h $TARGET_URL -o nikto_results.txt"
 
 # Nuclei web templates
 if command -v nuclei &> /dev/null; then
-    log_and_run "Nuclei web vulnerability scan" "nuclei -u $TARGET_URL -t ~/nuclei-templates/http/ -o nuclei_web_results.txt"
+    log_and_run "Nuclei web vulnerability scan" "nuclei -u $TARGET_URL -H 'User-Agent: homelab-security-scan/nuclei' -t ~/nuclei-templates/http/ -o nuclei_web_results.txt"
 fi
 
 # SSL/TLS testing (for HTTPS)