#!/bin/bash
# Ghaymah Security Auto-Checker Script

TARGET="ghaymah.systems"
PORT_CHECK_RANGE="80 443 22 8080 3306"

echo "=========================================="
echo "  Ghaymah Security Audit Tool - SecOps   "
echo "=========================================="
echo "Target: $TARGET"
echo "------------------------------------------"

# 1. Check Ports
echo "[+] 1. Checking Open Ports..."
for port in $PORT_CHECK_RANGE; do
    timeout 2 nc -z -v $TARGET $port 2>&1 | grep -E "open|succeeded" && echo "  - Port $port is OPEN" || echo "  - Port $port is CLOSED"
done

echo "------------------------------------------"

# 2. Check SSL/TLS
echo "[+] 2. Checking SSL/TLS Certificate..."
SSL_INFO=$(echo | openssl s_client -servername $TARGET -connect $TARGET:443 2>/dev/null | openssl x509 -noout -dates 2>/dev/null)
if [ -n "$SSL_INFO" ]; then
    echo "$SSL_INFO"
else
    echo "  [!] Failed to retrieve SSL Certificate info for $TARGET"
fi

echo "------------------------------------------"

# 3. Check Security Headers
echo "[+] 3. Checking Security Headers..."
HEADERS=$(curl -sI https://$TARGET)

check_header() {
    HEADER_NAME=$1
    echo "$HEADERS" | grep -iq "$HEADER_NAME" && echo "  [✓] $HEADER_NAME Enabled" || echo "  [✗] $HEADER_NAME Missing!"
}

check_header "Strict-Transport-Security"
check_header "X-Content-Type-Options"
check_header "X-Frame-Options"
check_header "Content-Security-Policy"

echo "=========================================="
echo "Audit Execution Completed."