URL Scanner / one URL, every check

/* ==========================================================================
   Pentest Toolkit — scanner backend (Cloudflare Worker)
   --------------------------------------------------------------------------
   Deploy this once and the toolkit's URL modes work fully, with nothing about
   your targets reaching a third party.

     1. https://workers.cloudflare.com  ->  Create Worker
     2. Replace the default code with this file
     3. Deploy, copy the *.workers.dev URL
     4. Paste it into any tool's "your own endpoint" field

   Free tier covers 100,000 requests a day.

   API
     GET /?url=<target>                     raw HTTP response (headers only)
     GET /?url=<target>&body=1              JSON: status, headers, body
     GET /?url=<target>&origin=<origin>     JSON, with that Origin sent
     GET /?url=<target>&method=OPTIONS      JSON, using that method
     GET /?urls=<a,b,c>&body=1              JSON: { results: [ ... ] }
     GET /?url=<target>&host=<host>         JSON, with that Host header sent

   Safety
     Only http and https. Private, loopback, link-local and cloud-metadata
     addresses are refused, so this cannot be turned into an SSRF proxy
     against your own infrastructure. Redirects are never followed here —
     the caller follows the chain so it can show every hop. Bodies are capped.
   ========================================================================== */

const CORS = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Methods': 'GET, OPTIONS',
  'Access-Control-Max-Age': '86400'
};

const MAX_BODY   = 512 * 1024;   // 512 KB is plenty for HTML analysis
const MAX_BATCH  = 12;
const TIMEOUT_MS = 12000;

const ALLOWED_METHODS = ['GET', 'HEAD', 'OPTIONS', 'TRACE', 'POST', 'PUT', 'DELETE'];

function json(obj, status = 200) {
  return new Response(JSON.stringify(obj), {
    status,
    headers: { ...CORS, 'Content-Type': 'application/json; charset=utf-8' }
  });
}
function text(body, status = 200) {
  return new Response(body, {
    status,
    headers: { ...CORS, 'Content-Type': 'text/plain; charset=utf-8' }
  });
}

/* Refuse anything that could reach infrastructure the caller should not be
   pivoting into through a public endpoint. */
function isBlockedHost(hostname) {
  const h = hostname.toLowerCase().replace(/^\[|\]$/g, '');
  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.internal') ||
      h.endsWith('.local') || h === '::1' || h === '0.0.0.0') return true;
  if (/^127\./.test(h) || /^10\./.test(h) || /^192\.168\./.test(h) ||
      /^169\.254\./.test(h) || /^0\./.test(h)) return true;
  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true;   // CGNAT
  if (/^f[cd][0-9a-f]{2}:/.test(h) || /^fe80:/.test(h)) return true;      // IPv6 ULA / link-local
  if (h === 'metadata.google.internal' || h === '169.254.169.254') return true;
  return false;
}

function parseTarget(raw) {
  let u;
  try { u = new URL(raw); } catch { throw new Error('invalid url'); }
  if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new Error('only http and https');
  if (u.username || u.password) throw new Error('embedded credentials refused');
  if (!u.hostname) throw new Error('no hostname');
  if (isBlockedHost(u.hostname)) throw new Error('private or link-local address refused');
  return u;
}

async function probe(target, opts = {}) {
  const u = parseTarget(target);
  const headers = {
    /* A recognisable agent, so the operator of a scanned host can identify
       and contact whoever ran this rather than seeing anonymous traffic. */
    'User-Agent': opts.userAgent ||
      'Mozilla/5.0 (compatible; PentestToolkit/1.0; +https://prashantique.github.io/pentest-toolkit/)',
    'Accept': '*/*',
    'Accept-Language': 'en-US,en;q=0.9'
  };
  if (opts.origin) headers['Origin'] = opts.origin;
  if (opts.host)   headers['Host']   = opts.host;
  if (opts.cookie) headers['Cookie'] = opts.cookie;
  if (opts.referer) headers['Referer'] = opts.referer;

  const method = ALLOWED_METHODS.includes((opts.method || 'GET').toUpperCase())
    ? opts.method.toUpperCase() : 'GET';

  const started = Date.now();
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);

  let res;
  try {
    res = await fetch(u.href, {
      method,
      headers,
      redirect: 'manual',       /* the caller walks the chain itself */
      signal: controller.signal
    });
  } catch (e) {
    clearTimeout(timer);
    return { url: u.href, error: e.name === 'AbortError'
      ? 'timed out after ' + TIMEOUT_MS + 'ms' : (e.message || 'fetch failed') };
  }
  clearTimeout(timer);

  const out = {
    url: u.href,
    method,
    status: res.status,
    statusText: res.statusText || '',
    headers: {},
    setCookie: [],
    timing: Date.now() - started
  };
  for (const [k, v] of res.headers) {
    if (k.toLowerCase() === 'set-cookie') out.setCookie.push(v);
    else out.headers[k] = v;
  }
  /* Workers collapse repeated Set-Cookie; getSetCookie gives them back. */
  if (typeof res.headers.getSetCookie === 'function') {
    const all = res.headers.getSetCookie();
    if (all && all.length) out.setCookie = all;
  }

  if (opts.body) {
    try {
      const reader = res.body ? res.body.getReader() : null;
      if (reader) {
        const chunks = []; let total = 0;
        while (total < MAX_BODY) {
          const { done, value } = await reader.read();
          if (done) break;
          chunks.push(value); total += value.length;
        }
        try { reader.cancel(); } catch {}
        const buf = new Uint8Array(total);
        let off = 0;
        for (const c of chunks) { buf.set(c.subarray(0, Math.min(c.length, total - off)), off); off += c.length; }
        out.body = new TextDecoder('utf-8', { fatal: false }).decode(buf);
        out.bodyTruncated = total >= MAX_BODY;
        out.bodyBytes = total;
      } else {
        out.body = ''; out.bodyBytes = 0;
      }
    } catch (e) {
      out.bodyError = e.message || 'could not read body';
    }
  }
  return out;
}

/* Emit a raw HTTP response, so a caller can reuse a paste-mode parser. */
function asRaw(r) {
  if (r.error) return 'error: ' + r.error;
  let out = `HTTP/1.1 ${r.status} ${r.statusText}\n`;
  for (const [k, v] of Object.entries(r.headers)) out += `${k}: ${v}\n`;
  for (const c of r.setCookie) out += `set-cookie: ${c}\n`;
  return out;
}

export default {
  async fetch(request) {
    if (request.method === 'OPTIONS') return new Response(null, { headers: CORS });
    if (request.method !== 'GET') return text('error: GET only', 405);

    const q = new URL(request.url).searchParams;

    if (q.has('health')) {
      return json({ ok: true, service: 'pentest-toolkit-scanner', version: 1,
                    maxBody: MAX_BODY, maxBatch: MAX_BATCH, timeoutMs: TIMEOUT_MS });
    }

    const opts = {
      body:    q.get('body') === '1',
      origin:  q.get('origin')  || null,
      method:  q.get('method')  || 'GET',
      host:    q.get('host')    || null,
      cookie:  q.get('cookie')  || null,
      referer: q.get('referer') || null
    };

    /* batch: several paths in one round trip, for well-known discovery */
    if (q.has('urls')) {
      const list = q.get('urls').split(',').map(s => s.trim()).filter(Boolean).slice(0, MAX_BATCH);
      if (!list.length) return json({ error: 'no urls' }, 400);
      const results = await Promise.all(list.map(async (t) => {
        try { return await probe(t, opts); }
        catch (e) { return { url: t, error: e.message }; }
      }));
      return json({ results });
    }

    const target = q.get('url');
    if (!target) return text('error: missing url parameter', 400);

    let r;
    try { r = await probe(target, opts); }
    catch (e) { return q.get('raw') === '1' ? text('error: ' + e.message, 400) : json({ error: e.message }, 400); }

    /* Default to raw so this is a drop-in for the public header API. */
    if (!opts.body && q.get('json') !== '1') return text(asRaw(r));
    return json(r);
  }
};