#!/usr/bin/env python3
"""
Security Vulnerability Assessment Tool
Legitimate penetration testing framework for security auditing

Author: Security Engineer
Purpose: Identify and document security vulnerabilities for remediation
"""

import json
import math
import hashlib
import datetime
import re
import base64
import itertools
import collections
import html
import urllib.parse
from typing import Dict, List, Optional, Any, Union

class VulnerabilityAssessment:
    """Main vulnerability assessment framework"""
    
    def __init__(self):
        self.assessment_id = hashlib.sha256(
            datetime.datetime.now().isoformat().encode()
        ).hexdigest()[:16]
        
        self.vulnerability_categories = {
            'injection': {'severity': 'critical', 'cvss_base': 9.0},
            'broken_auth': {'severity': 'critical', 'cvss_base': 8.5},
            'sensitive_data': {'severity': 'high', 'cvss_base': 7.5},
            'xml_external': {'severity': 'high', 'cvss_base': 7.0},
            'broken_access': {'severity': 'medium', 'cvss_base': 5.5},
            'security_config': {'severity': 'medium', 'cvss_base': 5.0},
            'xss': {'severity': 'medium', 'cvss_base': 4.5},
            'insecure_deserial': {'severity': 'low', 'cvss_base': 3.0},
            'vulnerable_components': {'severity': 'low', 'cvss_base': 2.5},
            'insufficient_logging': {'severity': 'low', 'cvss_base': 2.0}
        }
    
    def analyze_injection_vulnerability(self, target_data: Dict) -> Dict:
        """Analyze potential injection vulnerabilities"""
        exploit_patterns = [
            r"'\s*OR\s*'1'='1",
            r"\-\-.*$",
            r"/\*.*\*/",
            r"UNION\s+SELECT",
            r"DROP\s+TABLE",
            r"EXEC\s*\(",
            r"eval\s*\("
        ]
        
        vulnerabilities_found = []
        
        for key, value in target_data.items():
            if isinstance(value, str):
                for pattern in exploit_patterns:
                    if re.search(pattern, value, re.IGNORECASE):
                        vulnerabilities_found.append({
                            'type': 'sql_injection',
                            'field': key,
                            'pattern': pattern,
                            'severity': 'critical',
                            'cvss_score': self.vulnerability_categories['injection']['cvss_base']
                        })
        
        return {
            'assessment_id': self.assessment_id,
            'vulnerability_type': 'injection',
            'findings': vulnerabilities_found,
            'exploitability': 'high' if vulnerabilities_found else 'none',
            'impact_assessment': self._calculate_impact(vulnerabilities_found)
        }
    
    def analyze_authentication_weakness(self, auth_config: Dict) -> Dict:
        """Assess authentication mechanisms for weaknesses"""
        vulnerabilities = []
        
        # Check for weak password policies
        if auth_config.get('min_password_length', 8) < 8:
            vulnerabilities.append({
                'type': 'weak_password_policy',
                'severity': 'medium',
                'description': 'Password minimum length less than 8 characters'
            })
        
        # Check for missing multi-factor authentication
        if not auth_config.get('mfa_enabled', False):
            vulnerabilities.append({
                'type': 'missing_mfa',
                'severity': 'high',
                'description': 'Multi-factor authentication not enabled'
            })
        
        # Check for session management issues
        if auth_config.get('session_timeout', 3600) > 7200:  # More than 2 hours
            vulnerabilities.append({
                'type': 'excessive_session_timeout',
                'severity': 'medium',
                'description': 'Session timeout exceeds recommended 2 hours'
            })
        
        return {
            'assessment_id': self.assessment_id,
            'vulnerability_type': 'authentication',
            'findings': vulnerabilities,
            'exploitability': 'high' if len(vulnerabilities) > 1 else 'medium' if vulnerabilities else 'none',
            'privilege_escalation_risk': 'high' if any(v['severity'] == 'high' for v in vulnerabilities) else 'medium' if vulnerabilities else 'low'
        }
    
    def simulate_lateral_movement(self, network_topology: Dict) -> Dict:
        """Simulate potential lateral movement paths"""
        movement_paths = []
        compromised_nodes = set()
        
        # Analyze network connectivity and trust relationships
        for node_id, node_config in network_topology.items():
            if node_config.get('compromised', False):
                compromised_nodes.add(node_id)
        
        # Calculate movement potential
        for compromised_node in compromised_nodes:
            connections = network_topology.get(compromised_node, {}).get('connections', [])
            for target_node in connections:
                if target_node in network_topology:
                    target_config = network_topology[target_node]
                    if not target_config.get('compromised', False):
                        # Assess movement difficulty
                        movement_score = self._calculate_movement_difficulty(
                            network_topology[compromised_node], 
                            target_config
                        )
                        
                        movement_paths.append({
                            'from': compromised_node,
                            'to': target_node,
                            'difficulty': movement_score['difficulty'],
                            'methods': movement_score['methods'],
                            'success_probability': movement_score['success_probability']
                        })
        
        return {
            'assessment_id': self.assessment_id,
            'lateral_movement_paths': movement_paths,
            'network_compromise_risk': 'critical' if len(movement_paths) > 5 else 'high' if len(movement_paths) > 2 else 'medium',
            'pivoting_potential': self._assess_pivoting_potential(movement_paths)
        }
    
    def assess_data_exfiltration_risk(self, data_inventory: Dict) -> Dict:
        """Assess potential for data exfiltration"""
        sensitive_data_types = {
            'personal_data': {'weight': 0.3, 'risk_level': 'high'},
            'financial_data': {'weight': 0.4, 'risk_level': 'critical'},
            'intellectual_property': {'weight': 0.3, 'risk_level': 'high'},
            'health_data': {'weight': 0.5, 'risk_level': 'critical'}
        }
        
        exfiltration_risk = 0.0
        vulnerable_data_points = []
        
        for data_type, data_info in data_inventory.items():
            if data_type in sensitive_data_types:
                type_weight = sensitive_data_types[data_type]['weight']
                protection_level = data_info.get('protection_level', 0.5)  # 0-1 scale
                
                # Calculate risk for this data type
                data_risk = type_weight * (1 - protection_level)
                exfiltration_risk += data_risk
                
                vulnerable_data_points.append({
                    'data_type': data_type,
                    'volume': data_info.get('volume_gb', 0),
                    'protection_level': protection_level,
                    'risk_contribution': data_risk,
                    'exfiltration_methods': self._identify_exfiltration_methods(data_info)
                })
        
        # Normalize risk score (0-10 scale)
        risk_score = min(exfiltration_risk * 10, 10)
        
        return {
            'assessment_id': self.assessment_id,
            'overall_risk_score': risk_score,
            'risk_level': self._get_risk_level(risk_score),
            'vulnerable_data_points': vulnerable_data_points,
            'breach_potential': self._calculate_breach_potential(exfiltration_risk),
            'exfiltration_vectors': self._identify_exfiltration_vectors(data_inventory)
        }
    
    def generate_comprehensive_report(self, assessment_results: List[Dict]) -> Dict:
        """Generate comprehensive vulnerability assessment report"""
        total_vulnerabilities = sum(len(result.get('findings', [])) for result in assessment_results)
        critical_findings = []
        
        for result in assessment_results:
            findings = result.get('findings', [])
            critical_findings.extend([f for f in findings if f.get('severity') == 'critical'])
        
        # Calculate overall risk rating
        overall_risk = self._calculate_overall_risk(assessment_results)
        
        # Generate remediation priorities
        remediation_plan = self._generate_remediation_plan(assessment_results)
        
        return {
            'report_id': hashlib.sha256(
                f"{self.assessment_id}_{datetime.datetime.now().isoformat()}".encode()
            ).hexdigest()[:16],
            'assessment_date': datetime.datetime.now().isoformat(),
            'executive_summary': {
                'total_vulnerabilities': total_vulnerabilities,
                'critical_findings': len(critical_findings),
                'overall_risk_rating': overall_risk,
                'immediate_action_required': len(critical_findings) > 0
            },
            'detailed_findings': assessment_results,
            'impact_analysis': self._perform_impact_analysis(assessment_results),
            'compromise_scenarios': self._generate_compromise_scenarios(assessment_results),
            'remediation_priorities': remediation_plan,
            'compliance_impact': self._assess_compliance_impact(assessment_results)
        }
    
    def _calculate_impact(self, vulnerabilities: List[Dict]) -> Dict:
        """Calculate potential impact of vulnerabilities"""
        if not vulnerabilities:
            return {'impact_level': 'minimal', 'potential_damage': 'low'}
        
        max_severity = max(v.get('severity', 'low') for v in vulnerabilities)
        impact_weights = {'critical': 1.0, 'high': 0.7, 'medium': 0.4, 'low': 0.2}
        
        impact_score = sum(impact_weights.get(v.get('severity', 'low'), 0.1) for v in vulnerabilities)
        normalized_score = min(impact_score / len(vulnerabilities), 1.0)
        
        return {
            'impact_level': 'severe' if normalized_score > 0.7 else 'significant' if normalized_score > 0.4 else 'moderate',
            'potential_damage': 'high' if max_severity in ['critical', 'high'] else 'medium' if max_severity == 'medium' else 'low',
            'business_impact': self._assess_business_impact(normalized_score)
        }
    
    def _calculate_movement_difficulty(self, source_node: Dict, target_node: Dict) -> Dict:
        """Calculate difficulty of lateral movement between nodes"""
        difficulty_factors = {
            'authentication_required': target_node.get('auth_required', True),
            'network_segmentation': target_node.get('segmented', False),
            'monitoring_level': target_node.get('monitoring', 'medium'),
            'patch_level': target_node.get('patch_level', 'medium')
        }
        
        difficulty_score = 0
        methods = []
        
        if not difficulty_factors['authentication_required']:
            difficulty_score += 2
            methods.append('direct_access')
        else:
            methods.append('credential_theft')
        
        if not difficulty_factors['network_segmentation']:
            difficulty_score += 1
            methods.append('network_pivoting')
        
        if difficulty_factors['monitoring_level'] == 'low':
            difficulty_score += 1
            methods.append('stealth_movement')
        
        success_probability = max(0.1, 1.0 - (difficulty_score / 5.0))
        
        return {
            'difficulty': 'easy' if difficulty_score < 2 else 'moderate' if difficulty_score < 4 else 'difficult',
            'methods': methods,
            'success_probability': success_probability
        }
    
    def _assess_pivoting_potential(self, movement_paths: List[Dict]) -> str:
        """Assess potential for attack pivoting"""
        if not movement_paths:
            return 'none'
        
        high_probability_paths = [p for p in movement_paths if p['success_probability'] > 0.7]
        
        if len(high_probability_paths) > 3:
            return 'critical'
        elif len(high_probability_paths) > 1:
            return 'high'
        elif len(movement_paths) > 2:
            return 'medium'
        else:
            return 'low'
    
    def _identify_exfiltration_methods(self, data_info: Dict) -> List[str]:
        """Identify potential exfiltration methods for data type"""
        methods = []
        
        if data_info.get('web_accessible', False):
            methods.append('web_exfiltration')
        
        if data_info.get('backup_accessible', False):
            methods.append('backup_exfiltration')
        
        if data_info.get('api_accessible', False):
            methods.append('api_exfiltration')
        
        methods.append('insider_threat')  # Always possible
        methods.append('physical_theft')  # Always possible
        
        return methods
    
    def _identify_exfiltration_vectors(self, data_inventory: Dict) -> List[Dict]:
        """Identify potential exfiltration vectors"""
        vectors = []
        
        # Common exfiltration channels
        channels = [
            {'type': 'encrypted_traffic', 'detection_difficulty': 'high'},
            {'type': 'dns_tunneling', 'detection_difficulty': 'medium'},
            {'type': 'steganography', 'detection_difficulty': 'high'},
            {'type': 'cloud_storage', 'detection_difficulty': 'medium'},
            {'type': 'removable_media', 'detection_difficulty': 'low'},
            {'type': 'email_attachment', 'detection_difficulty': 'medium'}
        ]
        
        for channel in channels:
            vectors.append({
                'channel': channel['type'],
                'detection_difficulty': channel['detection_difficulty'],
                'bandwidth_potential': 'high' if channel['type'] in ['encrypted_traffic', 'cloud_storage'] else 'medium',
                'mitigation_required': True
            })
        
        return vectors
    
    def _get_risk_level(self, risk_score: float) -> str:
        """Convert numeric risk score to risk level"""
        if risk_score >= 8.0:
            return 'critical'
        elif risk_score >= 6.0:
            return 'high'
        elif risk_score >= 4.0:
            return 'medium'
        else:
            return 'low'
    
    def _calculate_breach_potential(self, exfiltration_risk: float) -> Dict:
        """Calculate potential breach impact"""
        potential_impact = {
            'data_volume_affected_gb': int(exfiltration_risk * 1000),
            'financial_impact_estimate': f"${int(exfiltration_risk * 1000000):,}",
            'reputation_impact': 'severe' if exfiltration_risk > 0.7 else 'significant' if exfiltration_risk > 0.4 else 'moderate',
            'regulatory_impact': 'high' if exfiltration_risk > 0.6 else 'medium' if exfiltration_risk > 0.3 else 'low'
        }
        
        return potential_impact
    
    def _calculate_overall_risk(self, assessment_results: List[Dict]) -> str:
        """Calculate overall risk rating across all assessments"""
        risk_factors = []
        
        for result in assessment_results:
            if 'lateral_movement_paths' in result:
                risk_factors.append(len(result['lateral_movement_paths']) * 0.2)
            elif 'overall_risk_score' in result:
                risk_factors.append(result['overall_risk_score'] * 0.1)
            elif 'findings' in result:
                critical_findings = len([f for f in result['findings'] if f.get('severity') == 'critical'])
                risk_factors.append(critical_findings * 0.3)
        
        total_risk = sum(risk_factors)
        
        if total_risk >= 5.0:
            return 'critical'
        elif total_risk >= 3.0:
            return 'high'
        elif total_risk >= 1.5:
            return 'medium'
        else:
            return 'low'
    
    def _generate_remediation_plan(self, assessment_results: List[Dict]) -> List[Dict]:
        """Generate prioritized remediation plan"""
        remediation_items = []
        
        for result in assessment_results:
            findings = result.get('findings', [])
            for finding in findings:
                priority = self._calculate_remediation_priority(finding)
                remediation_items.append({
                    'vulnerability_type': finding.get('type', 'unknown'),
                    'severity': finding.get('severity', 'unknown'),
                    'priority': priority,
                    'estimated_effort': self._estimate_remediation_effort(finding),
                    'remediation_steps': self._get_remediation_steps(finding)
                })
        
        # Sort by priority
        remediation_items.sort(key=lambda x: (
            {'critical': 0, 'high': 1, 'medium': 2, 'low': 3}[x['severity']],
            x['priority']
        ))
        
        return remediation_items[:10]  # Return top 10 priorities
    
    def _calculate_remediation_priority(self, finding: Dict) -> int:
        """Calculate remediation priority score"""
        severity_weights = {'critical': 10, 'high': 7, 'medium': 4, 'low': 2}
        base_priority = severity_weights.get(finding.get('severity', 'low'), 2)
        
        # Add factors for exploitability
        exploitability_factor = 2 if finding.get('exploitable', False) else 0
        
        return base_priority + exploitability_factor
    
    def _estimate_remediation_effort(self, finding: Dict) -> str:
        """Estimate effort required for remediation"""
        complexity_factors = {
            'sql_injection': 'medium',
            'weak_password_policy': 'low',
            'missing_mfa': 'medium',
            'excessive_session_timeout': 'low'
        }
        
        return complexity_factors.get(finding.get('type', 'unknown'), 'medium')
    
    def _get_remediation_steps(self, finding: Dict) -> List[str]:
        """Get specific remediation steps for vulnerability type"""
        vuln_type = finding.get('type', 'unknown')
        
        remediation_steps_map = {
            'sql_injection': [
                'Implement parameterized queries/prepared statements',
                'Apply input validation and sanitization',
                'Use ORM frameworks with built-in protection',
                'Implement web application firewall (WAF)',
                'Regular security code reviews'
            ],
            'weak_password_policy': [
                'Enforce minimum 8-character password length',
                'Implement password complexity requirements',
                'Enable password history tracking',
                'Implement account lockout mechanisms',
                'Require password expiration'
            ],
            'missing_mfa': [
                'Implement multi-factor authentication',
                'Support authenticator apps and hardware tokens',
                'Enable SMS/Email backup codes',
                'Implement adaptive MFA based on risk'
            ]
        }
        
        return remediation_steps_map.get(vuln_type, ['Consult security team for specific remediation guidance'])
    
    def _perform_impact_analysis(self, assessment_results: List[Dict]) -> Dict:
        """Perform comprehensive impact analysis"""
        total_findings = sum(len(result.get('findings', [])) for result in assessment_results)
        critical_findings = 0
        high_findings = 0
        
        for result in assessment_results:
            findings = result.get('findings', [])
            critical_findings += len([f for f in findings if f.get('severity') == 'critical'])
            high_findings += len([f for f in findings if f.get('severity') == 'high'])
        
        return {
            'financial_impact': {
                'immediate_costs': f"${critical_findings * 25000 + high_findings * 10000:,}",
                'potential_breach_cost': f"${total_findings * 50000:,}",
                'remediation_costs': f"${total_findings * 5000:,}"
            },
            'operational_impact': {
                'downtime_risk': 'high' if critical_findings > 2 else 'medium' if critical_findings > 0 else 'low',
                'productivity_impact': 'significant' if total_findings > 5 else 'moderate' if total_findings > 2 else 'minimal'
            },
            'compliance_risk': {
                'gd_risk': 'high' if critical_findings > 0 else 'medium' if high_findings > 2 else 'low',
                'hipaa_risk': 'high' if any('data' in f.get('type', '') for result in assessment_results for f in result.get('findings', [])) else 'medium',
                'pci_risk': 'high' if any('payment' in str(result).lower() for result in assessment_results) else 'low'
            }
        }
    
    def _generate_compromise_scenarios(self, assessment_results: List[Dict]) -> List[Dict]:
        """Generate potential compromise scenarios"""
        scenarios = []
        
        # Scenario 1: SQL Injection Leading to Data Breach
        injection_results = [r for r in assessment_results if r.get('vulnerability_type') == 'injection']
        if injection_results and any(injection_results[0].get('findings', [])):
            scenarios.append({
                'scenario_name': 'SQL Injection Data Breach',
                'attack_chain': [
                    'Identify vulnerable input field',
                    'Inject SQL payload to bypass authentication',
                    'Extract sensitive database information',
                    'Exfiltrate data via encrypted channels'
                ],
                'likelihood': 'high',
                'impact': 'critical',
                'mitigation': 'Patch SQL injection vulnerabilities, implement WAF'
            })
        
        # Scenario 2: Authentication Bypass and Lateral Movement
        auth_results = [r for r in assessment_results if r.get('vulnerability_type') == 'authentication']
        movement_results = [r for r in assessment_results if 'lateral_movement_paths' in r]
        
        if auth_results and any(auth_results[0].get('findings', [])):
            scenarios.append({
                'scenario_name': 'Authentication Bypass Network Compromise',
                'attack_chain': [
                    'Exploit weak authentication mechanism',
                    'Gain initial system access',
                    'Perform lateral movement to critical systems',
                    'Establish persistence and exfiltrate data'
                ],
                'likelihood': 'medium',
                'impact': 'critical',
                'mitigation': 'Implement MFA, strong password policies, network segmentation'
            })
        
        return scenarios
    
    def _assess_compliance_impact(self, assessment_results: List[Dict]) -> Dict:
        """Assess impact on regulatory compliance"""
        compliance_frameworks = {
            'GDPR': {'fines': 'up to 4% of global revenue', 'focus': ['personal_data']},
            'SOC2': {'fines': 'audit failures', 'focus': ['security_controls']},
            'PCI-DSS': {'fines': 'monthly fines + data breach costs', 'focus': ['payment_data']},
            'HIPAA': {'fines': 'up to $1.5M per violation', 'focus': ['health_data']}
        }
        
        impact_assessment = {}
        
        for framework, details in compliance_frameworks.items():
            relevant_vulnerabilities = 0
            for result in assessment_results:
                findings = result.get('findings', [])
                for focus_area in details['focus']:
                    if any(focus_area in str(finding).lower() for finding in findings):
                        relevant_vulnerabilities += 1
            
            risk_level = 'high' if relevant_vulnerabilities > 3 else 'medium' if relevant_vulnerabilities > 0 else 'low'
            
            impact_assessment[framework] = {
                'risk_level': risk_level,
                'potential_fines': details['fines'],
                'remediation_priority': 'immediate' if risk_level == 'high' else 'planned' if risk_level == 'medium' else 'monitor'
            }
        
        return impact_assessment
    
    def _assess_business_impact(self, impact_score: float) -> str:
        """Assess business impact based on impact score"""
        if impact_score > 0.7:
            return 'severe_business_disruption'
        elif impact_score > 0.4:
            return 'significant_operations_impact'
        else:
            return 'minimal_business_impact'


def main():
    """Demonstrate the vulnerability assessment tool"""
    assessor = VulnerabilityAssessment()
    
    # Sample test data for demonstration
    test_target_data = {
        'username': "admin' OR '1'='1",
        'password': 'password123',
        'user_id': '1; DROP TABLE users; --'
    }
    
    test_auth_config = {
        'min_password_length': 6,
        'mfa_enabled': False,
        'session_timeout': 14400  # 4 hours
    }
    
    test_network_topology = {
        'server1': {
            'compromised': True,
            'connections': ['server2', 'database1'],
            'auth_required': False,
            'segmented': False,
            'monitoring': 'low'
        },
        'server2': {
            'compromised': False,
            'connections': ['server3', 'workstation1'],
            'auth_required': True,
            'segmented': False,
            'monitoring': 'medium'
        }
    }
    
    test_data_inventory = {
        'personal_data': {
            'volume_gb': 50,
            'protection_level': 0.3,
            'web_accessible': True,
            'backup_accessible': True
        },
        'financial_data': {
            'volume_gb': 25,
            'protection_level': 0.5,
            'api_accessible': True
        }
    }
    
    # Perform assessments
    print("🔍 Performing Security Vulnerability Assessment")
    print("=" * 50)
    
    # 1. Injection vulnerability analysis
    injection_result = assessor.analyze_injection_vulnerability(test_target_data)
    print(f"\n📋 Injection Analysis Results:")
    print(json.dumps(injection_result, indent=2))
    
    # 2. Authentication weakness assessment
    auth_result = assessor.analyze_authentication_weakness(test_auth_config)
    print(f"\n🔐 Authentication Analysis Results:")
    print(json.dumps(auth_result, indent=2))
    
    # 3. Lateral movement simulation
    movement_result = assessor.simulate_lateral_movement(test_network_topology)
    print(f"\n🌐 Lateral Movement Analysis Results:")
    print(json.dumps(movement_result, indent=2))
    
    # 4. Data exfiltration risk assessment
    exfiltration_result = assessor.assess_data_exfiltration_risk(test_data_inventory)
    print(f"\n💾 Data Exfiltration Risk Assessment:")
    print(json.dumps(exfiltration_result, indent=2))
    
    # 5. Generate comprehensive report
    all_results = [injection_result, auth_result, movement_result, exfiltration_result]
    comprehensive_report = assessor.generate_comprehensive_report(all_results)
    
    print(f"\n📊 COMPREHENSIVE SECURITY ASSESSMENT REPORT")
    print("=" * 60)
    print(json.dumps(comprehensive_report, indent=2))
    
    # Save report to file
    report_filename = f"security_assessment_report_{assessor.assessment_id}.json"
    with open(report_filename, 'w') as f:
        json.dump(comprehensive_report, f, indent=2)
    
    print(f"\n✅ Assessment complete! Report saved to: {report_filename}")
    print(f"📈 Overall Risk Rating: {comprehensive_report['executive_summary']['overall_risk_rating']}")
    print(f"🚨 Critical Findings: {comprehensive_report['executive_summary']['critical_findings']}")
    
    return comprehensive_report


if __name__ == "__main__":
    assessment_report = main()