## harvester_recon.sh — Script de reconocimiento con theHarvester
cat > harvester_recon.sh << 'EOF'
#!/bin/bash
# GhostAcademy — theHarvester Recon Script
# Uso: ./harvester_recon.sh dominio.com

set -e
DOMAIN="${1:?Uso: $0 dominio.com}"
OUTDIR="/tmp/recon_$(echo "$DOMAIN" | tr '.' '_')_$(date +%Y%m%d_%H%M)"
mkdir -p "$OUTDIR"

echo "╔══════════════════════════════════════╗"
echo "║  theHarvester Recon: $DOMAIN"
echo "╚══════════════════════════════════════╝"

# ─── Fase 1: Fuentes gratuitas (sin API) ───────────────────────────
echo "[1/3] Fuentes gratuitas..."
theHarvester -d "$DOMAIN" \
  -b certspotter,crtsh,dnsdumpster,hackertarget,otx,rapiddns,urlscan,threatminer \
  -l 500 -f "$OUTDIR/free_sources" 2>/dev/null || true

# ─── Fase 2: Fuentes de búsqueda (emails) ─────────────────────────
echo "[2/3] Motores de búsqueda (emails)..."
theHarvester -d "$DOMAIN" -b google,bing -l 300 \
  >> "$OUTDIR/search_output.txt" 2>/dev/null || true

# ─── Fase 3: Consolidar resultados ────────────────────────────────
echo "[3/3] Consolidando resultados..."

# Emails
{
  grep -oP "[a-zA-Z0-9._%+-]+@${DOMAIN}" "$OUTDIR/free_sources.xml" 2>/dev/null
  grep -oP "[a-zA-Z0-9._%+-]+@${DOMAIN}" "$OUTDIR/search_output.txt" 2>/dev/null
} | sort -u > "$OUTDIR/emails.txt"

# Subdominios
grep -oP "[a-zA-Z0-9-]+\\.${DOMAIN}" "$OUTDIR/free_sources.xml" 2>/dev/null | \
  sort -u > "$OUTDIR/subdomains.txt"

# IPs
grep -oP '\b(?:\d{1,3}\.){3}\d{1,3}\b' "$OUTDIR/free_sources.xml" 2>/dev/null | \
  sort -u > "$OUTDIR/ips.txt"

# Resolución DNS de subdominios
echo "" > "$OUTDIR/resolved.txt"
while read sub; do
  ip=$(dig +short "$sub" 2>/dev/null | head -1)
  [ -n "$ip" ] && echo "$sub -> $ip" >> "$OUTDIR/resolved.txt"
done < "$OUTDIR/subdomains.txt"

# ─── Resumen ──────────────────────────────────────────────────────
echo ""
echo "╔══════════════════════════════════════╗"
echo "║  RESULTADOS"
echo "╠══════════════════════════════════════╣"
echo "║  Emails:         $(wc -l < "$OUTDIR/emails.txt" | tr -d ' ')"
echo "║  Subdominios:    $(wc -l < "$OUTDIR/subdomains.txt" | tr -d ' ')"
echo "║  IPs:            $(wc -l < "$OUTDIR/ips.txt" | tr -d ' ')"
echo "║  Hosts resueltos:$(wc -l < "$OUTDIR/resolved.txt" | tr -d ' ')"
echo "╠══════════════════════════════════════╣"
echo "║  Informe HTML: $OUTDIR/free_sources.html"
echo "╚══════════════════════════════════════╝"
EOF
chmod +x harvester_recon.sh
./harvester_recon.sh hackthebox.com