#!/bin/bash
#-------------------
#LiveDomains
#SIMPLY CHECKS WHICH DOMAINS ARE LIVE ON THE SERVER AND WHICH ARE NOT
#Apache Only
#Author: Jeremy J Butler
LDVersion=19

#Initial Commit - Jeremy Butler - Version 0.6 - 8/12/2013
#Code Clean up and standerdized - Jeremy Butler - 8/31/2013
#added --short flag - Greg Martin - 4/4/2014
#nginx support and various bug fixes - Jeremy Butler - 7/13/2014
#rev 9  - more bug fixes for nginx support -   Jeremy Butler 7/27/2014
#rev 10 - added --only flag for testing a single domain and getting document root when its apache 7/27/2014
#rev 11 - added --show-hacked option which will additionally check google safe browsing if each site has been reported as comprimised 8/21/2014
#rev 12 - bugfix for issue 100 found solved by Paul, code updated by Jeremy Butler
#rev 13 - bugfix to add support for cent7 by parsing ifconfig differently for checklocalip variables; thanks Ted Duncan
#rev 14 - another c7 bugfix for ifconfig parsing
#rev 15 - changed to use ip addr show instead of ifconfig for checking for ips so in the event multiple ips are on one interface they are still detected (issue #188)
#rev 16 - highlight CloudFlare IPs. requires /mojo/cidr2iplist
#rev 17 - highlight Highwinds/Stackpath IPs.  ASN 20446 - MojoShield
#rev 18 - removed outdated parts and parts that are incompatible with CentOS 8
#rev 19 - improved Apache detection
###########################################################################



if   [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
        echo "LiveDomains Version : $LDVersion";
        echo "--help or -h :   display this help screen";
        echo "--live :   display only live domains";
        echo "--short: display only domain ip. Only works with --live";
        echo "--only: tests just one domain and shows the document root if its apache";
        echo "--show-hacked: checks google safe browsing for reports of compromise";
fi

#################################################################################
#Main
#
##################################################################################
Main() {
declare -a thedoms
local checkforapache=$(pgrep -x 'httpd|/usr/sbin/httpd' | wc -w);
RNDM=${RANDOM}


#######Start check which web daemons are running############
if [ "${checkforapache}" -eq 0 ];
   then
        apacherunning=0;
        echo  "[Critical Error] Apache is not running here or you do not have permission to check the PIDs!"
        exit 1;
fi
if [ "$checkforapache" -gt 0 ];
then
apacherunning=1;
else
apacherunning=0;
fi

checkforothersvcs=$(netstat -lnp| egrep '(lighttpd|named|wowza|nginx)'|wc -l) #check other
######END Check running Web Daemons############################



echo "Warning: domains in servers other than Apache are not currently recognized fully -  lighttpd, named, wowza, nginx, etc...";
echo "Always triple check before pulling any IP addresses!"
if [ "$checkforothersvcs" -gt 0 ];
then
echo "It appears that lighttpd/named/wowza/nginx is in fact running here. Be very cautious!";
fi
echo "-------------------------------------------------------------------------------------"

local APACHE=$(ps aux|awk '{print $11}'|grep -v lightt|grep httpd|head -1)


#if apache is running get  the configured vhost and append to thedoms array
if [ "$apacherunning" -eq 1 ]; then


for x in `netstat -an|grep -qw :443
 if [ $? -gt 0 ];
                then
        $APACHE -S 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                else
        $APACHE -S -DSSL -DHAVE_SSL -DHAVESSL 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                fi`
do
for i in `cat $x|sed 's/^[ \t]*//'|egrep -i 'ServerAlias|servername' | grep -v ^\#|tr 'A-Z' 'a-z' | sed 's/serveralias //' | sed 's/servername //'|sed -e 's/www\.//g'|sort|uniq`;

        do thedoms=("${thedoms[@]}" $i); ##For Bash 3.0 and below (centos 4 compatibillity)

                                         ##we have to do it this way in violation of bashims and at cost of speed

        done
done

        OLDIFS="$IFS" IFS=$'\n' combined=(`for R in "${thedoms[@]}"; do echo "$R" ; done | sort -du`) IFS="$OLDIFS" #just clean up duplicates for apache array and check these

fi

#Get Cloudflare IPs
wget -q -O /tmp/cf_cidr_${RNDM} 'https://www.cloudflare.com/ips-v4' > /dev/null 2>&1
CFGET=$?
if [ ${CFGET} -ne "0" ]; then
    echo "Could not get CloudFlare IPs.  Continuing without CloudFlare identification."
else
    /usr/local/mojo/bin/cidr2iplist -i /tmp/cf_cidr_${RNDM} > /tmp/cf_ips_${RNDM}
fi

for r in "${!combined[@]}"
do
                      ##Check if its a CNAME or not to determine how we will parse the output of dig
        if [ `dig cname @8.8.8.8 "${combined[$r]}" +short|wc -l` -gt 0 ]; #If its a cname
                then
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|tail -n1|sed -e 's/^[ \t]*//'|sed '/^$/d');
                ##its a cname so instead of first line from dig +short we grab the last(the destination A record)
                else
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|head -n1|sed -e 's/^[ \t]*//'|sed '/^$/d')
                fi ##else parse dig normally

local checkdigger=$(echo "${thedigger}"|wc -l)
local checklocalip=$(ip addr show|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|grep "${thedigger}"|wc -l)
if [ ${CFGET} -ne "0" ]; then
    local checkcfip=0
else
    checkcfip=0
    if [ -f /tmp/cf_ips_${RNDM} ]; then local checkcfip=$(grep "${thedigger}" /tmp/cf_ips_${RNDM}|wc -l); fi
fi

#Check that we have actually gotten a valid IP Address
        if [[ "${thedigger}" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
                then
                checkdigger2=1;
                else
                checkdigger2=2;
                fi
        if [ "${checkdigger}" -eq 0 ] || [ "${checkdigger2}" -eq 2 ];
                then
                        printf "\e[31m%20s - \e[1m %s\e[0m\n" "[ERROR] "${combined[$r]}" is not resolving returned" "${thedigger}" ;
          ##If we don't have a valid IP or dig returned nothing at all then call it a day before we do anything else
                elif [ $checkcfip -gt "0" ] && [ "${checkdigger2}" -eq 1 ];
                        then
                          printf "\e[33m%20s -  %s\e[0m\n" ""${combined[$r]}" is using CloudFlare @" "${thedigger}";
                elif [ $checklocalip -gt "0" ] && [ "${checkdigger2}" -eq 1 ];
                        then
                          printf "\e[36m%20s -  %s\e[0m\n" ""${combined[$r]}" is live here @" "${thedigger}";
                  elif [ $checklocalip -eq "0" ] && [ "${checkdigger2}" -eq 1 ];
                then
                 printf "\e[0m%20s - \e[1m %s\e[0m\n" ""${combined[$r]}" is NOT live here its  @" "${thedigger}";
                else
                ##Not sure how someone can make it this far with all the checks and sedding the crap out of everything
                ##only plausible reason I can come up with
                echo "a severe error has occured for "${combined[$r]}", by some Miracle you made it to this Error, You have attained the GoatWizard level of 99"
                fi
done

rm -f /tmp/cf_cidr_${RNDM}
rm -f /tmp/cf_ips_${RNDM}

}

function onlylive()
{
declare -a thedoms
local checkforapache=$(pgrep -x 'httpd|/usr/sbin/httpd' | wc -w)
if [ "${checkforapache}" -eq 0 ];
   then
        echo  "Apache is not running here, I am too dumb to figure this out, quitting..."
        exit 1;
fi

echo "Warning: domains in servers other than Apache are not currently recognized fully - lighttpd, named, wowza, nginx, etc...";
echo "Always check before pulling any IP addresses!"
checkforothersvcs=$(netstat -lnp| egrep '(lighttpd|named|wowza|nginx)'|wc -l)
if [ $checkforothersvcs -gt 0 ];
then
echo "It appears that lighttpd/named/wowza/nginx is in fact running here be very cautious";
fi
echo "-------------------------------------------------------------------------------------"

local APACHE=$(ps aux|awk '{print $11}'|grep -v lightt|grep httpd|head -1)

for x in `netstat -an|grep -qw :443
 if [ $? -gt 0 ];
                then
        $APACHE -S 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                else
        $APACHE -S -DSSL -DHAVE_SSL -DHAVESSL 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                fi`
do
for i in `cat $x|sed 's/^[ \t]*//'|egrep -i 'ServerAlias|servername' | grep -v ^\#|tr 'A-Z' 'a-z' | sed 's/serveralias //' | sed 's/servername //'|sed -e 's/www\.//g'|sort|uniq`;

        do thedoms=("${thedoms[@]}" $i); ##For Bash 3.0 and below (centos 4 compatibillity)

                                         ##we have to do it this way in violation of bashims and at cost of speed

        done
done

OLDIFS="$IFS" IFS=$'\n' combined=(`for R in "${thedoms[@]}"; do echo "$R" ; done | sort -du`) IFS="$OLDIFS"

for r in "${!combined[@]}"
do


                      ##Check if its a CNAME or not to determine how we will parse the output of dig
        if [ `dig cname @8.8.8.8 "${combined[$r]}" +short|wc -l` -gt 0 ]; #If its a cname
                then
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|tail -n1|sed -e 's/^[ \t]*//'|sed '/^$/d');
                ##its a cname so instead of first line from dig +short we grab the last(the destination A record)
                else
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|head -n1|sed -e 's/^[ \t]*//'|sed '/^$/d')
                fi ##else parse dig normally

local checkdigger=$(echo "${thedigger}"|wc -l)
local checklocalip=$(ip addr show|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|grep "${thedigger}"|wc -l)

#Check that we have actually gotten a valid IP Address
        if [[ "${thedigger}" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
                then
                checkdigger2=1;
                else
                checkdigger2=2;
                fi
                if [ $checklocalip -gt "0" ] && [ "${checkdigger2}" -eq 1 ];
                        then
                                if [ $SHORT ]
                                then
                                        echo ""${combined[$r]}"  "${thedigger}""  #dig returned valid Ip and its on the box
                                else
                                        echo ""${combined[$r]}" is live here @ "${thedigger}""  #dig returned valid Ip and its on the box
                                fi

                fi
done

}

function onlyonedomain()
{
local APACHE=$(ps aux|awk '{print $11}'|grep -v lightt|grep httpd|head -1)
for x in `netstat -an|grep -qw :443
 if [ $? -gt 0 ];
                then
        $APACHE -S 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                else
        $APACHE -S -DSSL -DHAVE_SSL -DHAVESSL 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                fi`
do
for i in `cat $x|sed 's/^[ \t]*//'|egrep -i 'ServerAlias|servername' | grep -v ^\#|tr 'A-Z' 'a-z' | sed 's/serveralias //' | sed 's/servername //'|sed -e 's/www\.//g'|grep "${1}"| sort|uniq`;

        do thedoms=("${thedoms[@]}" $i); ##For Bash 3.0 and below (centos 4 compatibillity)

                                         ##we have to do it this way in violation of bashims and at cost of speed

        done
done

OLDIFS="$IFS" IFS=$'\n' combined=(`for R in "${thedoms[@]}"; do echo "$R" ; done | sort -du`) IFS="$OLDIFS"

if [ "${#combined[@]}" -ne 0 ];
then
        for r in "${!combined[@]}"

        do


                      ##Check if its a CNAME or not to determine how we will parse the output of dig
        if [ `dig cname @8.8.8.8 "${combined[$r]}" +short|wc -l` -gt 0 ]; #If its a cname
                then
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|tail -n1|sed -e 's/^[ \t]*//'|sed '/^$/d');
                ##its a cname so instead of first line from dig +short we grab the last(the destination A record)
                else
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|head -n1|sed -e 's/^[ \t]*//'|sed '/^$/d')
                fi ##else parse dig normally

local checkdigger=$(echo "${thedigger}"|wc -l)
local checklocalip=$(ip addr show|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|grep "${thedigger}"|wc -l)

#Check that we have actually gotten a valid IP Address
        if [[ "${thedigger}" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
                then
                checkdigger2=1;
                else
                checkdigger2=2;
                fi
        if [ "${checkdigger}" -eq 0 ] || [ "${checkdigger2}" -eq 2 ];
                then
                        printf "\e[31m%20s - \e[1m %s\e[0m\n" "[ERROR] "${combined[$r]}" is not resolving returned" "${thedigger}" ;
          ##If we don't have a valid IP or dig returned nothing at all then call it a day before we do anything else
                elif [ $checklocalip -gt "0" ] && [ "${checkdigger2}" -eq 1 ];
                        then
                          printf "\e[36m%20s -  %s\e[0m\n" ""${combined[$r]}" is live here @" "${thedigger}";
                  elif [ $checklocalip -eq "0" ] && [ "${checkdigger2}" -eq 1 ];
                then
                 printf "\e[0m%20s - \e[1m %s\e[0m\n" ""${combined[$r]}" is NOT live here its  @" "${thedigger}";
                else
                ##Not sure how someone can make it this far with all the checks and sedding the crap out of everything
                ##only plausible reason I can come up with
                echo "a severe error has occured for "${combined[$r]}", by some Miracle you made it to this Error, You have attained the GoatWizard level of 99"
                fi

done
else
echo ""${1}" does not appear to be live here but double check";
fi

#run getdocroot if its a live apache domain and getdocroot is on the box
if [ -f "/mojo/getdocroot" ] && [ "${#thedoms[@]}" -ne 0 ];
then
        /mojo/getdocroot "${1}" "${thedigger}"
fi

}

ShowHacked() {
declare -a thedoms
local checkforapache=$(pgrep -x 'httpd|/usr/sbin/httpd' | wc -w);


#######Start check which web daemons are running############
if [ "${checkforapache}" -eq 0 ];
   then
        apacherunning=0;
        echo  "[Critical Error] Apache is not running here or you do not have permission to check the PIDs!"
        exit 1;
fi
if [ "$checkforapache" -gt 0 ];
then
apacherunning=1;
else
apacherunning=0;
fi

checkforothersvcs=$(netstat -lnp| egrep '(lighttpd|named|wowza|nginx)'|wc -l) #check other
######END Check running Web Daemons############################



echo "Warning: domains in servers other than Apache are not currently recognized fully -  lighttpd, wowza, named, nginx etc...";
echo "Always triple check before pulling any IP addresses!"
echo "Domains reported as [Hacked] indicate Google reports the site as unsafe"
if [ "$checkforothersvcs" -gt 0 ];
then
echo "It appears that lighttpd/named/wowza/nginx is in fact running here. Be very cautious!";
fi
echo "-------------------------------------------------------------------------------------"

local APACHE=$(ps aux|awk '{print $11}'|grep -v lightt|grep httpd|head -1)



#if apache is running get  the configured vhost and append to thedoms array
if [ "$apacherunning" -eq 1 ]; then


for x in `netstat -an|grep -qw :443
 if [ $? -gt 0 ];
                then
        $APACHE -S 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                else

        $APACHE -S -DSSL -DHAVE_SSL -DHAVESSL 2>&1 | grep -oP '\(.+\)' | tr -d '()' | cut -d: -f1 | sort | uniq
                fi`
do
for i in `cat $x|sed 's/^[ \t]*//'|egrep -i 'ServerAlias|servername' | grep -v ^\#|tr 'A-Z' 'a-z' | sed 's/serveralias //' | sed 's/servername //'|sed -e 's/www\.//g'|sort|uniq`;

        do thedoms=("${thedoms[@]}" $i); ##For Bash 3.0 and below (centos 4 compatibillity)

                                         ##we have to do it this way in violation of bashims and at cost of speed

        done
done

fi

for r in "${!combined[@]}"
do
                      ##Check if its a CNAME or not to determine how we will parse the output of dig
        if [ `dig cname @8.8.8.8 "${combined[$r]}" +short|wc -l` -gt 0 ]; #If its a cname
                then
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|tail -n1|sed -e 's/^[ \t]*//'|sed '/^$/d');
                ##its a cname so instead of first line from dig +short we grab the last(the destination A record)
                else
                local thedigger=$(dig @8.8.8.8 "${combined[$r]}" +short|head -n1|sed -e 's/^[ \t]*//'|sed '/^$/d')
                fi ##else parse dig normally

local checkdigger=$(echo "${thedigger}"|wc -l)
local checklocalip=$(ip addr show|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|grep "${thedigger}"|wc -l)

#Check that we have actually gotten a valid IP Address
        if [[ "${thedigger}" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
                then
                checkdigger2=1;
                else
                checkdigger2=2;
                fi
        if [ "${checkdigger}" -eq 0 ] || [ "${checkdigger2}" -eq 2 ];
                then
                        printf "\e[31m%20s - \e[1m %s\e[0m\n" "[ERROR] "${combined[$r]}" is not resolving returned" "${thedigger}" ;
          ##If we don't have a valid IP or dig returned nothing at all then call it a day before we do anything else
                elif [ $checklocalip -gt "0" ] && [ "${checkdigger2}" -eq 1 ];
                        then
                          if [ `wget -qO- http://www.google.com/safebrowsing/diagnostic?site="${combined[$r]}"|grep "This site is not currently listed as suspicious"|wc -l` -gt 0 ]
                                then
                                    printf "\e[36m%20s -  %s\e[0m\n" ""${combined[$r]}" is live here @" "${thedigger}";
                                else
                                    printf "\e[36m%20s -  %s\e[0m\n" ""${combined[$r]}" [HACKED] is live here @" "${thedigger}";
                                fi
                  elif [ $checklocalip -eq "0" ] && [ "${checkdigger2}" -eq 1 ];
                then
                 printf "\e[0m%20s - \e[1m %s\e[0m\n" ""${combined[$r]}" is NOT live here its  @" "${thedigger}";
                else
                ##Not sure how someone can make it this far with all the checks and sedding the crap out of everything
                ##only plausible reason I can come up with
                echo "a severe error has occured for "${combined[$r]}", by some Miracle you made it to this Error, You have attained the GoatWizard level of 99"
                fi
done
}



if [ "$#" -eq 0 ]
then
Main
fi

if [ "$1" == "--live" ];
then
if [ "$2" == "--short" ]
then
SHORT=true
fi
onlylive
fi

if [ "$1" == "--only" ];
then
onlyonedomain "$2"
fi

if [ "$1" == "--show-hacked" ];
then
ShowHacked
fi