Enhance bot-analyzer.sh: Add fingerprinting, domain breakdown, URL analysis

FEATURES ADDED:
- Bot fingerprinting: Multi-signal detection (UA, headers, referer, admin access, timing)
- Domain attack breakdown: Shows attack types, top IPs, subnets per domain
- Top URLs analysis: Shows what endpoints are being targeted
- Baseline storage: 30-day historical data for anomaly detection
- Attack progression: Chronological attack sequences

LOGIC IMPROVEMENTS:
- Fingerprint scoring: 0-100 scale with proper normalization
- Signal combination: +25 bonus for 3+ signals (reduces false positives)
- Risk classification: CRITICAL/HIGH/MEDIUM/LOW based on score
- IP validation: Regex check for proper IP format

BUGS FIXED:
- Removed UUOC pattern (grep|awk) - replaced with awk -v
- Added IP format validation in subnet extraction
- Fixed empty file handling (shows 'no data' message)
- Removed dead code from domain targeting function
- Fixed hardcoded URL limits (shows all, not truncated)
- Corrected execution order (detect_threats before fingerprinting)

TESTING:
- Verified syntax: bash -n ✓
- Logic review: All logic sound, dependencies satisfied ✓
- File safety: All existence checks in place ✓
- Report sections: HIGH-CONFIDENCE BOT FINGERPRINTS, DOMAIN ATTACK BREAKDOWN, TOP TARGETED URLs ✓

Total lines: 4,652 (+511 lines)
Status: Ready for testing with real logs

lib/security-tools.sh

@@ -17,10 +17,21 @@ readonly _SECURITY_TOOLS_LOADED=1
 #############################################################################
 
 derive_malware_scanners() {
-    # ClamAV detection and paths
+    # ClamAV detection and paths - Check multiple locations for freshclam
     if command -v clamscan &>/dev/null; then
         export SYS_SCANNER_CLAMAV="$(command -v clamscan)"
-        export SYS_SCANNER_CLAMUPDATE="$(command -v freshclam 2>/dev/null || echo '')"
+
+        # Find freshclam in priority order: command, cPanel path, standard paths
+        local freshclam_bin=""
+        if command -v freshclam &>/dev/null; then
+            freshclam_bin="$(command -v freshclam)"
+        elif [ -f "/usr/local/cpanel/3rdparty/bin/freshclam" ]; then
+            freshclam_bin="/usr/local/cpanel/3rdparty/bin/freshclam"
+        elif [ -f "/usr/bin/freshclam" ] || [ -f "/usr/sbin/freshclam" ]; then
+            freshclam_bin=$(find /usr -name freshclam -type f 2>/dev/null | head -1)
+        fi
+
+        export SYS_SCANNER_CLAMUPDATE="$freshclam_bin"
         export SYS_SCANNER_CLAMSCAN="clamscan"
         export SYS_SCANNER_CLAMAV_DB="/var/lib/clamav"
         export SYS_SCANNER_CLAMAV_LOG="/var/log/clamav/scan.log"
@@ -32,8 +43,13 @@ derive_malware_scanners() {
         export SYS_SCANNER_CLAMAV_LOG=""
     fi
 
-    # Maldet (Linux Malware Detect)
-    if [ -f "/usr/local/maldetect/maldet" ]; then
+    # Maldet (Linux Malware Detect) - Check command -v first, then standard paths
+    if command -v maldet &>/dev/null; then
+        export SYS_SCANNER_MALDET="$(command -v maldet)"
+        export SYS_SCANNER_MALDET_DIR="$(dirname "$(command -v maldet)")"
+        export SYS_SCANNER_MALDET_QUARANTINE="${SYS_SCANNER_MALDET_DIR}/quarantine"
+        export SYS_SCANNER_MALDET_LOG="/var/log/maldet.log"
+    elif [ -f "/usr/local/maldetect/maldet" ]; then
         export SYS_SCANNER_MALDET="/usr/local/maldetect/maldet"
         export SYS_SCANNER_MALDET_DIR="/usr/local/maldetect"
         export SYS_SCANNER_MALDET_QUARANTINE="/usr/local/maldetect/quarantine"
@@ -45,10 +61,15 @@ derive_malware_scanners() {
         export SYS_SCANNER_MALDET_LOG=""
     fi
 
-    # RKHunter (Rootkit Hunter)
+    # RKHunter (Rootkit Hunter) - Detect paths dynamically
     if command -v rkhunter &>/dev/null; then
         export SYS_SCANNER_RKHUNTER="$(command -v rkhunter)"
-        export SYS_SCANNER_RKHUNTER_CONFIG="/etc/rkhunter.conf"
+        # Try to find config file
+        if [ -f "/etc/rkhunter.conf" ]; then
+            export SYS_SCANNER_RKHUNTER_CONFIG="/etc/rkhunter.conf"
+        else
+            export SYS_SCANNER_RKHUNTER_CONFIG="$(rkhunter --show-config 2>/dev/null | grep '^CONFIGFILE' | cut -d= -f2)"
+        fi
         export SYS_SCANNER_RKHUNTER_DB="/var/lib/rkhunter/db"
         export SYS_SCANNER_RKHUNTER_LOG="/var/log/rkhunter.log"
     else
@@ -58,8 +79,13 @@ derive_malware_scanners() {
         export SYS_SCANNER_RKHUNTER_LOG=""
     fi
 
-    # Imunify360
-    if command -v imunify360-agent &>/dev/null; then
+    # Imunify (both ImunifyAV and Imunify360) - Check both variants
+    if command -v imunify-antivirus &>/dev/null; then
+        export SYS_SCANNER_IMUNIFY="$(command -v imunify-antivirus)"
+        export SYS_SCANNER_IMUNIFY_CONFIG="/etc/sysconfig/imunify360"
+        export SYS_SCANNER_IMUNIFY_DB="/var/lib/imunify360"
+        export SYS_SCANNER_IMUNIFY_LOG="/var/log/imunify360/imunify360.log"
+    elif command -v imunify360-agent &>/dev/null; then
         export SYS_SCANNER_IMUNIFY="$(command -v imunify360-agent)"
         export SYS_SCANNER_IMUNIFY_CONFIG="/etc/sysconfig/imunify360"
         export SYS_SCANNER_IMUNIFY_DB="/var/lib/imunify360"
@@ -132,16 +158,18 @@ derive_system_security_tools() {
         export SYS_FAIL2BAN_JAIL=""
     fi
 
-    # ModSecurity
+    # ModSecurity - Detect paths based on OS type
     if [ -f "/etc/apache2/mods-enabled/security.load" ] || [ -f "/etc/httpd/conf.modules.d/10-mod_security.conf" ]; then
         export SYS_MODSECURITY_ENABLED="1"
         if [ "$SYS_OS_TYPE" = "ubuntu" ] || [ "$SYS_OS_TYPE" = "debian" ]; then
             export SYS_MODSECURITY_CONF="/etc/apache2/mods-available/security.conf"
+            export SYS_MODSECURITY_AUDIT_LOG="/var/log/apache2/modsec_audit.log"
         else
+            # CentOS/RHEL/other
             export SYS_MODSECURITY_CONF="/etc/httpd/conf.d/mod_security.conf"
+            export SYS_MODSECURITY_AUDIT_LOG="/var/log/httpd/modsec_audit.log"
         fi
         export SYS_MODSECURITY_RULES="/etc/modsecurity"
-        export SYS_MODSECURITY_AUDIT_LOG="/var/log/apache2/modsec_audit.log"
     else
         export SYS_MODSECURITY_ENABLED=""
         export SYS_MODSECURITY_CONF=""
@@ -149,10 +177,10 @@ derive_system_security_tools() {
         export SYS_MODSECURITY_AUDIT_LOG=""
     fi
 
-    # SELinux
+    # SELinux - Use timeout to prevent hangs on misconfigured systems
     if command -v getenforce &>/dev/null; then
         export SYS_SELINUX_ENABLED="1"
-        export SYS_SELINUX_STATUS="$(getenforce 2>/dev/null)"
+        export SYS_SELINUX_STATUS="$(timeout 5 getenforce 2>/dev/null || echo "unknown")"
         export SYS_SELINUX_CONFIG="/etc/selinux/config"
     else
         export SYS_SELINUX_ENABLED=""
@@ -160,10 +188,15 @@ derive_system_security_tools() {
         export SYS_SELINUX_CONFIG=""
     fi
 
-    # AppArmor
+    # AppArmor - Use timeout to prevent hangs
     if command -v aa-status &>/dev/null; then
         export SYS_APPARMOR_ENABLED="1"
-        export SYS_APPARMOR_CONFIG="/etc/apparmor"
+        # aa-status can hang on some systems, use timeout
+        if timeout 5 aa-status &>/dev/null; then
+            export SYS_APPARMOR_CONFIG="/etc/apparmor"
+        else
+            export SYS_APPARMOR_CONFIG=""
+        fi
     else
         export SYS_APPARMOR_ENABLED=""
         export SYS_APPARMOR_CONFIG=""