Malware scanning is now more prominent:
- Moved from Web Application Analysis submenu to main Security Analysis menu
- Now option 1 (🦠 Malware Scanner) in Analysis & Troubleshooting
- Direct path: Security → Analysis → Malware Scanner (2→1→1)
- Removed from Web Application submenu to avoid duplication
- Renumbered all security analysis options accordingly
Much easier to find and access the malware scanner now.
New workflow:
1. User runs: source run.sh (instead of bash launcher.sh)
2. Launcher runs normally
3. On exit with cleanup=yes, launcher sets flag file
4. Wrapper detects flag and does ALL cleanup automatically:
- Cleans ~/.bash_history file
- Clears current shell's in-memory history
- Removes toolkit directory
- No manual commands needed
The key: wrapper is SOURCED so it runs in parent shell and can modify history.
User experience: answer "yes" and cleanup happens instantly, automatically.
Changes:
- Cleans ~/.bash_history file immediately when user selects yes
- Verifies curl command is gone from file before continuing
- Removes logs, temp files, toolkit directory automatically
- Shows verification: "✓ Verified: No curl download commands in history file"
- User just needs to run: history -c, unset HISTFILE, exit
No more asking user to source scripts. Just do the cleanup and verify.
Exit menu now tells user to SOURCE the trace eraser instead of running it as subprocess:
- Single command: TRACE_ERASER_AUTO=yes source tools/erase-toolkit-traces.sh
- Sourcing runs it in current shell, allowing it to modify that shell's history
- No more separate helper scripts or multiple steps
- Single source of truth for all cleanup logic
This fixes the parent shell history issue - by sourcing instead of running as subprocess, the trace eraser can actually modify the shell's history where the curl command was executed.
Exit menu now:
- Calls trace eraser in TRACE_ERASER_AUTO=yes mode (no prompts, removes everything)
- Creates minimal helper script only for parent shell history cleanup
- Single source of truth: tools/erase-toolkit-traces.sh
Removed duplicate cleanup logic from launcher exit handler.
The fundamental issue: launcher.sh runs in a subprocess, so it cannot modify the parent shell's history where the curl command was executed.
Solution: Create a temporary cleanup script that the parent shell must source after launcher exits. This allows the history cleaning to run in the correct shell context.
User workflow:
1. Run launcher.sh and select exit with cleanup
2. Source the generated /tmp/.cleanup_history_$$.sh script
3. History is cleaned in the parent shell
4. Exit and restart shell to verify
The cleanup script removes toolkit traces from ~/.bash_history and disables history recording for the current session.
Simplified to match the exact logic from erase-toolkit-traces.sh:
- Use grep -Ev with pattern matching
- Clean file, clear history, reload, unset HISTFILE
- Then run trace eraser subprocess for logs/files/directory
The key fix is running this in the current shell instead of subprocess.
The trace eraser was running as a subprocess, so history cleaning only affected the subprocess. The parent shell would still write its dirty history back to the file on exit.
Now the exit handler cleans history directly in the current shell before calling trace eraser:
- Cleans ~/.bash_history file with grep -Ev
- Runs history -c to clear in-memory history
- Reloads cleaned history with history -r
- Unsets HISTFILE to prevent re-writing on exit
- Then runs trace eraser subprocess for logs/files/directory cleanup
This ensures curl commands and all toolkit traces are actually removed from bash history.
Changes:
- Single question on exit: 'Clean history and remove traces?'
- If yes: runs full trace eraser automatically
- Auto mode skips all prompts, removes everything
- TRACE_ERASER_AUTO=yes flag for non-interactive mode
User experience:
- Exit (0)
- One question
- If yes: everything cleaned and removed automatically
- No multiple prompts
Changes:
- Prompt user to clean history when selecting Exit (0)
- Runs trace eraser if user answers 'yes'
- Shows clear message about what will be cleaned
User experience:
- Exit from main menu
- Asked: 'Clean history? (yes/no)'
- If yes: runs full trace eraser
- Then exits normally
Changes:
- Created modules/website/wordpress/ subdirectory for CMS-specific tools
- Moved wordpress-cron-manager.sh to new subdirectory
- Created wordpress-menu.sh submenu for WordPress tools
- Updated launcher.sh Website Management menu:
- Simplified to show general tools and CMS submenu options
- WordPress Management is now a submenu (option 3)
- Prepared structure for Joomla/Drupal/other CMS support
- Fixed script paths in wordpress-cron-manager.sh for new location
- Tested complete navigation: Main → Website → WordPress → Cron Manager
Menu Structure Now:
Website Management
├── Website Error Analyzer
├── 500 Error Tracker
└── WordPress Management (submenu)
└── WordPress Cron Manager
└── (All cron management options working)
https://claude.com/claude-code
Created comprehensive cleanup tool to remove all server-specific data
before transferring toolkit to another server.
NEW FILE:
- modules/maintenance/cleanup-toolkit-data.sh
* Removes IP reputation database (/var/lib/server-toolkit/)
* Cleans all temporary analysis files (/tmp/*bot*, *500-tracker*, etc.)
* Removes generated reports
* Clears cache and session data
* Optional log file removal
* Shows summary of items removed and space freed
* Safety confirmation required before cleanup
UPDATED:
- launcher.sh
* Added cleanup script to Backup & Recovery menu (option 9)
* Placed in "Data Management" section
* Clearly marked with trash icon to indicate destructive operation
PURPOSE:
This ensures the IP reputation database and other server-specific data
are not transferred when moving the toolkit between servers. Each server
should build its own IP reputation database based on its own traffic and
attack patterns.
USE CASES:
✓ Moving toolkit to different server
✓ Starting fresh analysis
✓ Removing server-specific data before sharing toolkit
✓ Regular maintenance/cleanup
WHAT GETS CLEANED:
- /var/lib/server-toolkit/ip-reputation/ (IP reputation database)
- /tmp/bot_analysis_* (bot analyzer temp files)
- /tmp/500-tracker-* (error tracker temp files)
- /tmp/live-monitor-* (live monitoring temp files)
- /tmp/*_report_*.txt (generated reports)
- /var/cache/server-toolkit/ (cached data)
- Session/lock files
- Optional: execution logs
Created a comprehensive IP reputation system that tracks IPs across all
toolkit scripts with tags/attack types, scores, and detailed analytics.
NEW FILES:
- lib/ip-reputation.sh: Core reputation library with optimized database
* Fast lookup using pipe-delimited file format
* Attack type tagging system (bitmask: SQL, XSS, RCE, Bot, Scanner, etc.)
* Reputation scoring (0-100) based on hits and attack severity
* GeoIP country lookup integration
* Automatic cleanup of old entries
* Thread-safe with file locking
- modules/security/ip-reputation-manager.sh: Interactive management tool
* Query individual IPs with full details
* View top malicious/active IPs
* Database statistics and analytics
* Manual IP flagging/whitelisting
* Import IPs from logs
* Export to readable reports
* Live monitoring mode
INTEGRATION:
All security and analysis scripts now use the centralized reputation system:
- modules/website/500-error-tracker.sh:
* Tracks IPs generating 500 errors
* Tags bots/scanners with BOT/SCANNER flags
* Background processing for performance
- modules/security/live-attack-monitor.sh:
* Maps attack types to reputation flags
* Tracks SSH bruteforce, SQL injection, XSS, DDoS, etc.
* Real-time reputation updates
- modules/website/website-error-analyzer.sh:
* Tags filtered bots in error analysis
* Builds IP reputation from website errors
- launcher.sh:
* Added IP Reputation Manager to Bot & Traffic Analysis menu
* Menu option 4 in Security > Analysis > Bot & Traffic Analysis
KEY FEATURES:
✓ Centralized IP tracking across ALL scripts
✓ Multi-tag system (IP can have multiple attack types)
✓ Reputation scores increase with more tags/attacks
✓ Country tracking via GeoIP
✓ Optimized for high-volume traffic (attacks with 1000s of IPs)
✓ Fast lookups even during DDoS
✓ Background processing doesn't slow down analysis
✓ Database cleanup/maintenance tools
✓ Export for reports and sharing
BENEFITS:
- Single source of truth for IP reputation
- Scripts share intelligence (bot detected in one script = flagged for all)
- Track IPs across time and multiple attack vectors
- Identify repeat offenders with multiple attack types
- Make blocking decisions based on comprehensive data
- Performance optimized with file locking and background updates
NEW SCRIPT: modules/website/500-error-tracker.sh
- FAST-ONLY 500 error detection (no menus, no options)
- Scans access logs for 500 errors
- Maps domains to cPanel usernames
- Automatically diagnoses root causes by checking error_log files
- Shows actual PHP errors causing the 500s
ROOT CAUSE DETECTION:
- PHP Memory Exhausted (shows current limit)
- PHP Fatal Errors
- PHP Syntax Errors
- Missing PHP Functions/Extensions
- Database Connection Failures
- .htaccess Issues
- Shows ACTUAL error examples, not just suggestions
FIXES:
- Fixed awk error in website-error-analyzer.sh:
• Changed "next" in END block to "if (length > 0)"
• "next" cannot be used in END block in awk
- Added option 2 in Website Management menu
- Renumbered all WordPress tools (3-16)
DIFFERENCE FROM FULL ANALYZER:
Full Analyzer: All errors, filters, time ranges, user choices
Fast Tracker: ONLY 500s, auto-diagnosis, shows WHY not suggestions
Use Fast Tracker when you need to quickly find which domains
are getting 500 errors and the exact PHP errors causing them.
- New tool: erase-toolkit-traces.sh removes all toolkit traces
- Cleans bash history for all users
- Removes toolkit mentions from system logs
- Deletes download artifacts and temp files
- Optional: complete toolkit directory removal
- Added to main menu as option 10
- Complete security menu restructure (3-mode: Analysis/Actions/Live)
- Intelligent cPHulk enablement with CSF whitelist import
- Live network security monitoring dashboard
- Multi-source threat detection and classification
- 50+ organized security tools across 4-level menu hierarchy
- System health diagnostics with cPanel/WHM integration
- Reference database for cross-module intelligence sharing
cschantz