#!/usr/bin/env bash

# shellcheck shell=bash

# ``````````````````````````````````````````````````````````````````````````````
# Function name: DomainScanNmapNse()
#
# Description:
#   Scan domain with Nmap NSE Library.
#
# Usage:
#   DomainScanNmapNse domain port
#
# Examples:
#   DomainScanNmapNse example.com 443
#

function DomainScanNmapNse() {

  # shellcheck disable=SC2034
  local _FUNCTION_ID="DomainScanNmapNse"
  local _STATE=0

  local _host="$1"
  local _port="$2"

  # shellcheck disable=SC2034
  _scan_type="active"

  # shellcheck disable=SC2034
  _destination_host="$_host"

  local _nmap_nse_scripts="+dns-brute,\
                           +hostmap-crtsh,\
                           +http-auth-finder,\
                           +http-chrono,\
                           +http-cookie-flags,\
                           +http-cors,\
                           +http-cross-domain-policy,\
                           +http-csrf,\
                           +http-default-accounts,\
                           +http-dombased-xss,\
                           +http-enum,\
                           +http-errors,\
                           +http-git,\
                           +http-grep,\
                           +http-internal-ip-disclosure,\
                           +http-jsonp-detection,\
                           +http-malware-host,\
                           +http-methods,\
                           +http-passwd,\
                           +http-phpself-xss,\
                           +http-php-version,\
                           +http-referer-checker,\
                           +http-robots.txt,\
                           +http-security-headers,\
                           +http-shellshock,\
                           +http-sitemap-generator,\
                           +http-stored-xss,\
                           +http-title,\
                           +http-traceroute,\
                           +http-unsafe-output-escaping,\
                           +http-useragent-tester,\
                           +http-vhosts,\
                           +http-waf-detect,\
                           +http-waf-fingerprint,\
                           +http-xssed,\
                           +traceroute-geolocation.nse,\
                           +ssl-enum-ciphers,\
                           +whois-domain,\
                           +whois-ip"

  if [[ -d "/usr/share/nmap/scripts/vulscan" ]] ; then

    local _nmap_nse_scripts+=", +vulscan/vulscan.nse"

  fi

  local _nmap_nse_scripts_args="dns-brute.domain=${_host},"
        _nmap_nse_scripts_args+="http-cross-domain-policy.domain-lookup=true,"
        _nmap_nse_scripts_args+="http-waf-detect.aggro,"
        _nmap_nse_scripts_args+="http-waf-detect.detectBodyChanges,"
        _nmap_nse_scripts_args+="http-waf-fingerprint.intensive=1"
        _nmap_nse_scripts_args+="$NMAP_SCRIPT_ARGS"

  local _nmap_nse_desc="Scan with Nmap NSE library:"
        _nmap_nse_desc+="https://nmap.org/book/nse.html"

  # shellcheck disable=SC2034,SC2154
  local _nmap_nse_cmd="eval nmap $NMAP_OPT --script=\"$_nmap_nse_scripts\""
        _nmap_nse_cmd+=" --script-args=\"$_nmap_nse_scripts_args\""
        _nmap_nse_cmd+=" -p \"$_port\" \"$_host\""

  _msg_args+=(\
              "$_nmap_nse_desc")

  _cmd_args+=(\
              "$_nmap_nse_cmd")

  return $_STATE

}
