# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install required production-grade libraries
pip install requests pydantic python-dotenv colorama

# Initialize project
mkdir atlassian-monitor && cd atlassian-monitor
npm init -y

# Install dependencies
npm install axios dotenv zod colorama
# For TypeScript users
npm install --save-dev typescript ts-node @types/node

import requests
import os
import logging
from typing import List, Dict
from dotenv import load_dotenv
from pydantic import BaseModel, HttpUrl

# Load environment variables from .env file
load_dotenv()

# Configure Logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s'
)
logger = logging.getLogger(__name__)

class ScanResult(BaseModel):
    url: HttpUrl
    vulnerable: bool
    payload_used: str
    status_code: int

class AtlassianScanner:
    def __init__(self, target_url: str, webhook_url: str = None):
        self.target_url = target_url.rstrip('/')
        self.webhook_url = webhook_url
        # Common patterns found in recent Atlassian CVE PoCs (e.g., path traversal)
        self.malicious_payloads = [
            "/rest/api/latest/content/../../etc/passwd",
            "/setup/setup-servlet.jsp?action=...", # Placeholder for specific CVE path
            "'; EXEC xp_cmdshell..." 
        ]

    def _send_alert(self, result: ScanResult):
        """Sends a high-priority alert to Slack/Discord."""
        if not self.webhook_url:
            return

        payload = {
            "text": f"🚨 *CRITICAL VULNERABILITY DETECTED* 🚨\n"
                    f"*Target:* {result.url}\n"
                    f"*Payload:* `{result.payload_used}`\n"
                    f"*Status Code:* {result.status_code}\n"
                    f"Action Required: Isolate the instance immediately!"
        }
        try:
            requests.post(self.webhook_url, json=payload, timeout=5)
        except Exception as e:
            logger.error(f"Failed to send alert: {e}")

    def scan(self) -> List[ScanResult]:
        results = []
        logger.info(f"Starting scan on {self.target_url}...")

        for payload in self.malicious_payloads:
            test_url = f"{self.target_url}{payload}"
            try:
                # We use allow_redirects=False to catch raw 404/403/500 behavior 
                # which often indicates a successful bypass or error leakage
                response = requests.get(test_url, timeout=10, allow_redirects=False)
                
                # Logic: If a payload that should be blocked returns 200 OK 
                # or a specific error signature, it's a high-risk finding.
                is_vulnerable = response.status_code == 200 
                
                res = ScanResult(
                    url=test_url,
                    vulnerable=is_vulnerable,
                    payload_used=payload,
                    status_code=response.status_code
                )
                results.append(res)

                if is_vulnerable:
                    logger.warning(f"VULNERABILITY FOUND: {test_url}")
                    self._send_alert(res)
                else:
                    logger.info(f"Payload {payload} blocked (Status: {response.status_code})")

            except requests.exceptions.RequestException as e:
                logger.error(f"Connection error during scan: {e}")
        
        return results

if __name__ == "__main__":
    # In production, these would be loaded from environment variables
    TARGET = os.getenv("ATLASSIAN_TARGET_URL", "http://localhost:8080")
    WEBHOOK = os.getenv("ALERT_WEBHOOK_URL")

    scanner = AtlassianScanner(TARGET, WEBHOOK)
    scan_report = scanner.scan()
    print(f"\nScan Complete. Findings: {len([r for r in scan_report if r.vulnerable])}")

import axios, { AxiosError } from 'axios';
import * as dotenv from 'dotenv';

dotenv.config();

// Define strict types for our scanner
interface ScanResult {
    url: string;
    vulnerable: boolean;
    payloadUsed: string;
    statusCode: number;
}

class AtlassianScanner {
    private targetUrl: string;
    private webhookUrl?: string;
    private maliciousPayloads: string[] = [
        "/rest/api/latest/content/../../etc/passwd",
        "/setup/setup-servlet.jsp?action=..."
    ];

    constructor(targetUrl: string, webhookUrl?: string) {
        this.targetUrl = targetUrl.replace(/\/$/, "");
        this.webhookUrl = webhookUrl;
    }

    private async sendAlert(result: ScanResult): Promise<void> {
        if (!this.webhookUrl) return;

        try {
            await axios.post(this.webhookUrl, {
                text: `🚨 *CRITICAL VULNERABILITY DETECTED* 🚨\nTarget: ${result.url}\nPayload: \`${result.payloadUsed}\``
            });
        } catch (error) {
            console.error("Failed to send webhook alert:", error);
        }
    }

    public async scan(): Promise<ScanResult[]> {
        const results: ScanResult[] = [];
        console.log(`🚀 Starting scan on ${this.targetUrl}...`);

        for (const payload of this.malicious_payloads) {
            const fullUrl = `${this.targetUrl}${payload}`;
            
            try {
                const response = await axios.get(fullUrl, { 
                    maxRedirects: 0, 
                    validateStatus: false, // Allow us to inspect 4xx and 5xx
                    timeout: 5000 
                });

                const isVulnerable = response.status === 200;
                const result: ScanResult = {
                    url: fullUrl,
                    vulnerable: isVulnerable,
                    payloadUsed: payload,
                    statusCode: response.status
                };

                results.push(result);

                if (isVulnerable) {
                    console.warn(`⚠️ VULNERABILITY DETECTED: ${fullUrl}`);
                    await this.sendAlert(result);
                } else {
                    console.log(`✅ Payload blocked: ${payload} (Status: ${response.status})`);
                }

            } catch (error) {
                const err = error as AxiosError;
                console.error(`❌ Error scanning ${payload}: ${err.message}`);
            }
        }
        return results;
    }
}

// Execution block
const TARGET = process.env.ATLASSIAN_TARGET_URL || "http://localhost:8080";
const WEBHOOK = process.env.ALERT_WEBHOOK_URL;

const scanner = new AtlassianScanner(TARGET, WEBHOOK);
scanner.scan().then(res => {
    const criticals = res.filter(r => r.vulnerable).length;
    console.log(`\nScan finished. Critical findings: ${criticals}`);
});

# The URL of your Atlassian instance to monitor
ATLASSIAN_TARGET_URL=https://jira.yourcompany.com

# Slack or Discord Webhook for instant alerts
ALERT_WEBHOOK_URL=https://hooks.slack.com/services/T000/B000/XXXXXX

# Security: If you need to scan behind a VPN/Auth
# ATLASSIAN_API_TOKEN=your_token_here