# Choose a folder for the ICARAX demo code
mkdir -p ~/icarax-elementor-defense && cd $_
git clone https://github.com/icarax/elementor-defense-demo.git .

# Create a virtual environment (recommended)
python3 -m venv venv
source venv/bin/activate   # on Windows: venv\Scripts\activate

# Install dependencies
pip install --upgrade pip
pip install requests tqdm python-dotenv

# Initialize a new npm project (if not already present)
npm init -y

# Install core dependencies
npm install axios dotenv chalk progress

# Install TypeScript and typings (dev dependencies)
npm install --save-dev typescript @types/node ts-node nodemon

# Create a basic tsconfig.json
npx tsc --init --rootDir src --outDir dist \
  --esModuleInterop true --resolveJsonModule true --lib es6,dom

# Optional – WPScan API key (free tier: 50 requests/day)
WPSCAN_API_KEY=your_wpscan_key_here

# Optional – Slack webhook for alerts (if you want notifications)
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/XXX/YYY/ZZZ

# Optional – Email alerts via SMTP (example using Gmail)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your_email@gmail.com
SMTP_PASS=your_app_password

#!/usr/bin/env python3
"""
ICARAX Elementor Pro Vulnerability Detector (Python)

- Reads a list of site URLs (one per line) from `sites.txt` or via --sites.
- Tries to fetch the installed Elementor Pro version.
- Flags sites running a version <= VULNERABLE_MAX.
- Optionally sends alerts via Slack or email.
"""

import os
import sys
import json
import logging
import argparse
from urllib.parse import urljoin
import requests
from dotenv import load_dotenv
from tqdm import tqdm

# ----------------------------------------------------------------------
# Load environment variables
# ----------------------------------------------------------------------
load_dotenv()  # reads .env file
WPSCAN_API_KEY = os.getenv("WPSCAN_API_KEY")
SLACK_WEBHOOK = os.getenv("SLACK_WEBHOOK_URL")
SMTP_HOST = os.getenv("SMTP_HOST")
SMTP_PORT = int(os.getenv("SMTP_PORT", "0")) if os.getenv("SMTP_PORT") else None
SMTP_USER = os.getenv("SMTP_USER")
SMTP_PASS = os.getenv("SMTP_PASS")

# ----------------------------------------------------------------------
# Configuration
# ----------------------------------------------------------------------
VULNERABLE_MAX = "3.11.2"  # <-- adjust per the actual CVE advisory
PLUGIN_SLUG = "elementor-pro"
PLUGIN_API_URL = f"https://api.wordpress.org/plugins/info/1.0/{PLUGIN_SLUG}.json"
TIMEOUT = 10
USER_AGENT = "ICARAX-Elementor-Defender/1.0 (+https://icarax.example.com)"

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    handlers=[
        logging.FileHandler("elementor_scan.log"),
        logging.StreamHandler(sys.stdout),
    ],
)
log = logging.getLogger(__name__)

# ----------------------------------------------------------------------
# Helper functions
# ----------------------------------------------------------------------
def get_latest_stable_version() -> str:
    """Fetch the latest stable version from the WP.org API."""
    try:
        resp = requests.get(PLUGIN_API_URL, timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
        resp.raise_for_status()
        data = resp.json()
        return data.get("version", "0.0.0")
    except Exception as e:
        log.warning(f"Could not query WP.org API: {e}")
        return "0.0.0"


def parse_version_string(vstr: str) -> tuple:
    """Convert '3.11.2' -> (3,11,2) for comparison."""
    parts = []
    for part in vstr.strip().split("."):
        try:
            parts.append(int(part))
        except ValueError:
            # ignore non-numeric suffixes (e.g., "3.11.2-beta")
            break
    return tuple(parts)


def is_vulnerable(installed: str, max_vuln: str) -> bool:
    """Return True if installed <= max_vuln."""
    return parse_version_string(installed) <= parse_version_string(max_vuln)


def fetch_version_via_api(site_url: str) -> str | None:
    """
    Try to get the plugin version via the site's /wp-json/wp/v2/plugins endpoint
    (requires authentication, so often fails). We'll fall back to HTML/readme.
    """
    api_url = urljoin(site_url, "/wp-json/wp/v2/plugins")
    try:
        r = requests.get(api_url, timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
        if r.status_code == 200:
            plugins = r.json()
            for p in plugins:
                if p.get("slug") == PLUGIN_SLUG:
                    return p.get("version")
    except Exception:
        pass
    return None


def fetch_version_via_readme(site_url: str) -> str | None:
    """Fetch the readme.txt file and parse the 'Version:' line."""
    readme_url = urljoin(site_url, f"/wp-content/plugins/{PLUGIN_SLUG}/readme.txt")
    try:
        r = requests.get(readme_url, timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
        if r.status_code == 200:
            for line in r.text.splitlines():
                if line.lower().startswith("version:"):
                    return line.split(":", 1)[1].strip()
    except Exception:
        pass
    return None


def fetch_version_via_meta(site_url: str) -> str | None:
    """
    Some themes/plugins expose the version in a meta tag.
    This is a heuristic; not reliable but useful as a last resort.
    """
    try:
        r = requests.get(site_url, timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
        if r.status_code == 200:
            import re
            # Look for something like: <meta name="generator" content="WordPress 6.2">
            # or a custom meta tag added by Elementor Pro (rare)
            match = re.search(r'<meta[^>]+name=["\']generator["\'][^>]+content=["\']([^"\']*)', r.text, re.I)
            if match:
                content = match.group(1)
                # Sometimes the content includes the plugin version after a slash
                # e.g., "WordPress 6.2|Elementor Pro 3.11.2"
                for part in content.split("|"):
                    if PLUGIN_SLUG.lower() in part.lower():
                        # extract version-like token
                        ver_match = re.search(r"\d+(\.\d+)+", part)
                        if ver_match:
                            return ver_match.group(0)
    except Exception:
        pass
    return None


def detect_elementor_version(site_url: str) -> str | None:
    """Try multiple strategies; return the first successful version string."""
    # 1. WP JSON API (often blocked)
    ver = fetch_version_via_api(site_url)
    if ver:
        return ver
    # 2. readme.txt
    ver = fetch_version_via_readme(site_url)
    if ver:
        return ver
    # 3. meta tag fallback
    ver = fetch_version_via_meta(site_url)
    if ver:
        return ver
    return None


def send_slack_alert(message: str):
    if not SLACK_WEBHOOK:
        return
    try:
        requests.post(SLACK_WEBHOOK, json={"text": message}, timeout=5)
    except Exception as e:
        log.error(f"Slack alert failed: {e}")


def send_email_alert(subject: str, body: str):
    if not (SMTP_HOST and SMTP_PORT and SMTP_USER and SMTP_PASS):
        return
    import smtplib
    from email.message import EmailMessage

    msg = EmailMessage()
    msg["From"] = SMTP_USER
    msg["To"] = ", ".join([SMTP_USER])  # simple: send to yourself; adjust as needed
    msg["Subject"] = subject
    msg.set_content(body)

    try:
        with smtplib.SMTP(SMTP_HOST, SMTP_PORT) as server:
            server.starttls()
            server.login(SMTP_USER, SMTP_PASS)
            server.send_message(msg)
    except Exception as e:
        log.error(f"Email alert failed: {e}")


# ----------------------------------------------------------------------
# Main scanning routine
# ----------------------------------------------------------------------
def main():
    parser = argparse.ArgumentParser(description="Detect vulnerable Elementor Pro installations.")
    parser.add_argument(
        "--sites",
        help="Path to a file containing one site URL per line. Default: sites.txt",
        default="sites.txt",
    )
    parser.add_argument(
        "--threshold",
        help=f"Maximum version considered vulnerable (default: {VULNERABLE_MAX})",
        default=VULNERABLE_MAX,
    )
    args = parser.parse_args()

    # Load site list
    if not os.path.isfile(args.sites):
        log.error(f"Site list file not found: {args.sites}")
        sys.exit(1)

    with open(args.sites, "r", encoding="utf-8") as f:
        sites = [line.strip() for line in f if line.strip() and not line.startswith("#")]

    if not sites:
        log.error("No sites to scan.")
        sys.exit(1)

    log.info(f"Scanning {len(sites)} site(s) for Elementor Pro <= {args.threshold}")

    vulnerable = []

    for site in tqdm(sites, desc="Scanning", unit="site"):
        # Normalize URL
        if not site.startswith(("http://", "https://")):
            site = "https://" + site

        version = detect_elementor_version(site)
        if version is None:
            log.debug(f"{site}: Could not determine Elementor Pro version.")
            continue

        log.info(f"{site}: Elementor Pro {version} detected")
        if is_vulnerable(version, args.threshold):
            log.warning(f"🚨 VULNERABLE: {site} is running Elementor Pro {version} (<= {args.threshold})")
            vulnerable.append((site, version))
        else:
            log.info(f"{site}: Version {version} is safe (> {args.threshold})")

    # ------------------------------------------------------------------
    # Reporting
    # ------------------------------------------------------------------
    if vulnerable:
        report = "\n".join([f"{url} -> {ver}" for url, ver in vulnerable])
        log.warning(f"\n=== VULNERABLE SITES ({len(vulnerable)}) ===\n{report}")

        # Slack
        slack_msg = f":warning: *ICARAX Elementor Pro Scan* – {len(vulnerable)} vulnerable site(s) found.\n{report}"
        send_slack_alert(slack_msg)

        # Email
        email_subject = f"[ICARAX] Elementor Pro Vulnerability Alert – {len(vulnerable)} site(s)"
        email_body = f"The following sites are running a vulnerable Elementor Pro version (<= {args.threshold}):\n\n{report}\n\nPlease update immediately."
        send_email_alert(email_subject, email_body)
    else:
        log.info("✅ No vulnerable Elementor Pro installations detected.")


if __name__ == "__main__":
    main()

# 1. Prepare a list of targets (one per line)
echo -e "https://example.com\nhttps://anothersite.org" > sites.txt

# 2. Execute the scanner
python scan_elementor.py --sites sites.txt

#!/usr/bin/env node
/*
ICARAX Elementor Pro Vulnerability Detector (TypeScript / Node.js)

- Reads site URLs from `sites.txt` (or CLI argument).
- Attempts to detect the installed Elementor Pro version via:
    1. WordPress Plugin API (https://api.wordpress.org/plugins/info/1.0/elementor-pro.json)
    2. Parsing readme.txt from /wp-content/plugins/elementor-pro/readme.txt
    3. Fallback to scanning HTML for a generator meta tag (heuristic).
- Flags sites with version <= VULNERABLE_MAX.
- Optional Slack/email alerts via environment variables.
*/

import * as dotenv from "dotenv";
import * as fs from "fs";
import * as path from "path";
import axios, { AxiosInstance } from "axios";
import * as chalk from "chalk";
import { ProgressBar } from "progress";

dotenv.config(); // loads .env

// ----------------------------------------------------------------------
// Configuration
// ----------------------------------------------------------------------
const VULNERABLE_MAX = process.env.VULNERABLE_MAX ?? "3.11.2"; // adjust per CVE
const PLUGIN_SLUG = "elementor-pro";
const PLUGIN_API_URL = `https://api.wordpress.org/plugins/info/1.0/${PLUGIN_SLUG}.json`;
const REQUEST_TIMEOUT = 10000; // ms
const USER_AGENT = "ICARAX-Elementor-Defender/1.0 (+https://icarax.example.com)";

const SLACK_WEBHOOK = process.env.SLACK_WEBHOOK_URL;
const SMTP_HOST = process.env.SMTP_HOST;
const SMTP_PORT = parseInt(process.env.SMTP_PORT ?? "0", 10);
const SMTP_USER = process.env.SMTP_USER;
const SMTP_PASS = process.env.SMTP_PASS;

// ----------------------------------------------------------------------
// Helper types
// ----------------------------------------------------------------------
type SiteResult = { url: string; version?: string; error?: string };

// ----------------------------------------------------------------------
// Axios instance with common defaults
// ----------------------------------------------------------------------
const http: AxiosInstance = axios.create({
  timeout: REQUEST_TIMEOUT,
  headers: { "User-Agent": USER_AGENT },
});

// ----------------------------------------------------------------------
// Version utilities
// ----------------------------------------------------------------------
function parseVersion(vstr: string): number[] {
  return vstr
    .split(".")
    .map((p) => {
      const num = parseInt(p, 10);
      return isNaN(num) ? 0 : num; // treat non‑numeric as 0
    });
}

function isVulnerable(installed: string, maxVuln: string): boolean {
  return parseVersion(installed).every((v, i) => v <= (parseVersion(maxVuln)[i] ?? 0));
}

// ----------------------------------------------------------------------
// Detection strategies
// ----------------------------------------------------------------------
async function getLatestStableVersion(): Promise<string> {
  try {
    const { data } = await http.get<string>(PLUGIN_API_URL);
    const json = JSON.parse(data);
    return json.version ?? "0.0.0";
  } catch (e) {
    console.warn(chalk.yellow(`Could not fetch latest version from WP.org: ${e}`));
    return "0.0.0";
  }
}

async function fetchVersionViaApi(siteUrl: string): Promise<string | null> {
  try {
    const apiUrl = new URL("/wp-json/wp/v2/plugins", siteUrl).toString();
    const { data } = await http.get<any[]>(apiUrl);
    const plugin = data.find((p) => p.slug === PLUGIN_SLUG);
    return plugin?.version ?? null;
  } catch {
    return null;
  }
}

async function fetchVersionViaReadme(siteUrl: string): Promise<string | null> {
  try {
    const readmeUrl = new URL(
      `/wp-content/plugins/${PLUGIN_SLUG}/readme.txt`,
      siteUrl
    ).toString();
    const { data } = await http.get<string>(readmeUrl);
    const match = data.match(/^Version:\s*(.+)$/im);
    return match ? match[1].trim() : null;
  } catch {
    return null;
  }
}

async function fetchVersionViaMeta(siteUrl: string): Promise<string | null> {
  try {
    const { data } = await http.get<string>(siteUrl);
    // Look for a meta generator tag that may contain the plugin version
    const match = data.match(
      /<meta[^>]+name=["']generator["'][^>]+content=["']([^"']*)["']/i
    );
    if (!match) return null;
    const content = match[1];
    // Heuristic: find a token like "Elementor Pro 3.11.2"
    const verMatch = content.match(
      new RegExp(`${PLUGIN_SLUG}[\\s:-]*(\\d+(?:\\.\\d+)+)`, "i")
    );
    return verMatch ? verMatch[1] : null;
  } catch {
    return null;
  }
}

async function detectElementorVersion(siteUrl: string): Promise<string | null> {
  // Try each strategy in order
  let version = await fetchVersionViaApi(siteUrl);
  if (version) return version;

  version = await fetchVersionViaReadme(siteUrl);
  if (version) return version;

  version = await fetchVersionViaMeta(siteUrl);
  return version; // may be null
}

// ----------------------------------------------------------------------
// Alerting
// ----------------------------------------------------------------------
async function sendSlackAlert(message: string) {
  if (!SLACK_WEBHOOK) return;
  try {
    await http.post(SLACK_WEBHOOK, { text: message });
  } catch (e) {
    console.error(chalk.red(`Slack alert failed: ${e}`));
  }
}

async function sendEmailAlert(subject: string, body: string) {
  if (
    !SMTP_HOST ||
    !SMTP_PORT ||
    !SMTP_USER ||
    !SMTP_PASS
  ) {
    return;
  }
  const nodemailer = await import("nodemailer");
  const transporter = nodemailer.createTransport({
    host: SMTP_HOST,
    port: SMTP_PORT,
    secure: SMTP_PORT === 465, // true for 465, false for other ports
    auth: { user: SMTP_USER, pass: SMTP_PASS },
  });

  const mailOptions = {
    from: `"ICARAX Defender" <${SMTP_USER}>`,
    to: SMTP_USER, // change to a distribution list as needed
    subject,
    text: body,
  };

  try {
    await transporter.sendMail(mailOptions);
  } catch (e) {
    console.error(chalk.red(`Email alert failed: ${e}`));
  }
}

// ----------------------------------------------------------------------
// Main
// ----------------------------------------------------------------------
async function main() {
  const args = process.argv.slice(2);
  const sitesFileArg = args.indexOf("--sites");
  const sitesFile =
    sitesFileArg !== -1 && args[sitesFileArg + 1]
      ? args[sitesFileArg + 1]
      : "sites.txt";

  const thresholdArg = args.indexOf("--threshold");
  const threshold =
    thresholdArg !== -1 && args[thresholdArg + 1]
      ? args[thresholdArg + 1]
      : VULNERABLE_MAX;

  if (!fs.existsSync(sitesFile)) {
    console.error(chalk.red(`Site list file not found: ${sitesFile}`));
    process.exit(1);
  }

  const raw = fs.readFileSync(sitesFile, "utf-8");
  const sites = raw
    .split("\n")
    .map((l) => l.trim())
    .filter((l) => l.length && !l.startsWith("#"));

  if (sites.length === 0) {
    console.error(chalk.red("No sites to scan."));
    process.exit(1);
  }

  console.info(
    chalk.blue(
      `🔎 Scanning ${sites.length} site(s) for Elementor Pro <= ${threshold}`
    )
  );

  const bar = new ProgressBar("  scanning [:bar] :current/:total :etas", {
    total: sites.length,
    width: 20,
  });

  const vulnerable: SiteResult[] = [];

  for (const siteRaw of sites) {
    const site = /^https?:\/\//i.test(siteRaw)
      ? siteRaw
      : `https://${siteRaw}`;

    try {
      const version = await detectElementorVersion(site);
      if (!version) {
        console.log(chalk.gray(`❔ ${site}: could not determine version`));
        bar.tick();
        continue;
      }

      console.log(
        `${chalk.cyan(site)} → Elementor Pro ${chalk.yellow(version)}`
      );

      if (isVulnerable(version, threshold)) {
        console.log(
          chalk.red(`   🚨 VULNERABLE (≤ ${threshold})`)
        );
        vulnerable.push({ url: site, version });
      } else {
        console.log(chalk.green(`   ✅ safe (> ${threshold})`));
      }
    } catch (err) {
      console.log(chalk.red(`❌ ${site}: error – ${err}`));
      vulnerable.push({ url: site, error: String(err) });
    }
    bar.tick();
  }

  // ------------------------------------------------------------------
  // Reporting
  // ------------------------------------------------------------------
  if (vulnerable.length > 0) {
    const report = vulnerable
      .map(
        (r) =>
          `${r.url} → ${r.version ?? `[ERROR: ${r.error}]`}`
      )
      .join("\n");

    console.log(
      chalk.red(
        `\n=== VULNERABLE SITES (${vulnerable.length}) ===\n${report}`
      )
    );

    const slackMsg = `:warning: *ICARAX Elementor Pro Scan* – ${vulnerable.length} vulnerable site(s) found.\n${report}`;
    await sendSlackAlert(slackMsg);

    const emailSubject = `[ICARAX] Elementor Pro Vulnerability Alert – ${vulnerable.length} site(s)`;
    const emailBody = `The following sites are running a vulnerable Elementor Pro version (<= ${threshold}):\n\n${report}\n\nPlease update immediately.`;
    await sendEmailAlert(emailSubject, emailBody);
  } else {
    console.log(chalk.green("✅ No vulnerable Elementor Pro installations detected."));
  }
}

// Run the async main and handle unhandled rejections
main().catch((err) => {
  console.error(chalk.red(`Fatal error: ${err}`));
  process.exit(1);
});

# 1. Install deps (if not done already)
npm install

# 2. Prepare sites.txt (one URL per line)
echo -e "https://example.com\nhttps://anothersite.org" > sites.txt

# 3. Execute the scanner (TS via ts-node)
npx ts-node scan-elementor.ts --sites sites.txt

send_slack_alert(msg)
send_email_alert(subj, body)

await sendSlackAlert(msg);
await sendEmailAlert(subj, body);