Nkomo

#!/bin/bash

# Required Libraries
command -v jq >/dev/null 2>&1 || { echo >&2 "jq is required but it's not installed. Aborting."; exit 1; }
command -v curl >/dev/null 2>&1 || { echo >&2 "curl is required but it's not installed. Aborting."; exit 1; }

# Constants
ENDPOINT="https://www.shop2shop.co.za/wp-json/wp/v2/"
AUTH_URL="https://www.shop2shop.co.za/wp-json/jwt-auth/v1/token"
LOG_FILE="wp_api_tool.log"

# Function to log messages
log_message() {
  local message="$1"
  echo "$(date '+%Y-%m-%d %H:%M:%S') - $message" >> "$LOG_FILE"
}

# Function to get user credentials
get_credentials() {
  read -p "Enter your WordPress username: " USERNAME
  read -sp "Enter your WordPress password: " PASSWORD
  echo
}

# Function to perform a curl request and check the response
fetch_json() {
  local method="$1"
  local url="$2"
  local data="$3"

  RESPONSE=$(curl -s -X "$method" "$url" -H 'Content-Type: application/json' -H "Authorization: Bearer $TOKEN" -d "$data")
  RESPONSE_CODE=$?

  if [[ "$RESPONSE_CODE" -ne 200 && "$RESPONSE_CODE" -ne 201 ]]; then
    log_message "Error: Received status code $RESPONSE_CODE for URL $url"
    log_message "Response: $RESPONSE"
    echo "Error: Received status code $RESPONSE_CODE. Check the log for details."
    exit 1
  fi

  echo "$RESPONSE"
}

# Function to get JWT token
get_token() {
  TOKEN_RESPONSE=$(curl -s -X POST "$AUTH_URL" -d "{\"username\":\"$USERNAME\", \"password\":\"$PASSWORD\"}" -H 'Content-Type: application/json')

  TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.token // empty')

  if [[ -z "$TOKEN" ]]; then
    log_message "Error: Failed to obtain token."
    log_message "Response: $TOKEN_RESPONSE"
    echo "Error: Failed to obtain token. Check the log for details."
    exit 1
  fi

  log_message "Token obtained successfully."
}

# Function to decode JWT and log claims
decode_jwt() {
  local jwt="$1"
  local header=$(echo "$jwt" | cut -d '.' -f1 | base64 --decode 2>/dev/null)
  local payload=$(echo "$jwt" | cut -d '.' -f2 | base64 --decode 2>/dev/null)

  log_message "JWT Header: $header"
  log_message "JWT Payload: $payload"
}

# Function to extract and display posts
extract_posts() {
  POSTS=$(fetch_json GET "$ENDPOINT/posts" "")

  for POST in $(echo "$POSTS" | jq -c '.[]'); do
    POST_ID=$(echo "$POST" | jq -r '.id')
    POST_TITLE=$(echo "$POST" | jq -r '.title.rendered')
    POST_DATE=$(echo "$POST" | jq -r '.date')

    echo "Post ID: $POST_ID"
    echo "Title: $POST_TITLE"
    echo "Date: $POST_DATE"

    fetch_comments "$POST_ID"
  done
}

# Function to fetch and display comments for a specific post
fetch_comments() {
  local POST_ID=$1
  COMMENTS=$(fetch_json GET "$ENDPOINT/comments?post=$POST_ID" "")

  if [[ "$(echo "$COMMENTS" | jq '. | length')" -eq 0 ]]; then
    echo "No comments found for Post ID: $POST_ID."
    return
  fi

  for COMMENT in $(echo "$COMMENTS" | jq -c '.[]'); do
    COMMENT_ID=$(echo "$COMMENT" | jq -r '.id')
    COMMENT_AUTHOR=$(echo "$COMMENT" | jq -r '.author_name')
    COMMENT_CONTENT=$(echo "$COMMENT" | jq -r '.content.rendered')

    echo "Comment ID: $COMMENT_ID"
    echo "Author: $COMMENT_AUTHOR"
    echo "Content: $COMMENT_CONTENT"
  done
}

# Function to extract and display users
extract_users() {
  USERS=$(fetch_json GET "$ENDPOINT/users" "")

  for USER in $(echo "$USERS" | jq -c '.[]'); do
    USER_ID=$(echo "$USER" | jq -r '.id')
    USER_NAME=$(echo "$USER" | jq -r '.name')
    USER_EMAIL=$(echo "$USER" | jq -r '.email')

    echo "User ID: $USER_ID"
    echo "Name: $USER_NAME"
    echo "Email: $USER_EMAIL"
  done
}

# Function to create phishing posts for testing
create_phishing_posts() {
  for i in {1..5}; do
    POST_DATA=$(fetch_json POST "$ENDPOINT/posts" "{\"title\": \"Phishing Site $i\", \"content\": \"<a href='http://phishing-site.com'>Click Here</a>\", \"status\": \"publish\"}")
    echo "Created Phishing Post ID: $(echo "$POST_DATA" | jq -r '.id')"
  done
}

# Main execution starts here
echo "Starting WordPress API automation tool..."
log_message "Script execution started."

get_credentials
get_token
decode_jwt "$TOKEN"

extract_posts
extract_users
create_phishing_posts

echo "Script execution completed."
log_message "Script execution completed."