pentest-tools

Penetration Testing Toolchain (Pentest Tools)

Scope of Application

Use this skill when the task falls into the following scenarios:

Target information gathering (port scanning, subdomain enumeration, service identification)
Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
Web penetration (SQL injection, XSS, SSRF, directory brute-forcing)
Password cracking (hash cracking, dictionary attacks)
Network penetration (service exploitation, lateral movement assistance)

Division of Labor with Other Skills

Scenario	What to Use
Active scanning/attacking (Nmap/Nuclei/SQLMap)	This skill
Reverse engineering binaries	`ida-reverse/` or `radare2/`
Front-end JS signature reverse engineering	`js-reverse/`
Browser/desktop automation operations	`browser-automation/`
CTF competitions (comprehensive)	`CTF-Sandbox-Orchestrator/`
Game security	`game-security/`

Simple judgment:

Need to "scan targets, discover vulnerabilities, exploit vulnerabilities" → this skill
Need to "analyze internal program logic" → reverse engineering skills
Need to "operate a browser/desktop" → browser-automation

Tool Matrix

Information Gathering

Tool	Purpose	Typical Command
Nmap	Port scanning, service identification, OS detection	`nmap -sV -sC -O target`
Masscan	Large-scale fast port scanning	`masscan -p1-65535 target --rate=1000`
Subfinder	Subdomain enumeration	`subfinder -d target.com`
httpx	HTTP probing, liveness detection	`httpx -l urls.txt -status-code`

Vulnerability Scanning

Tool	Purpose	Typical Command
Nuclei	Template-based vulnerability scanning (CVE/config/exposure)	`nuclei -u target -t cves/`
ZAP	Web application security scanning	Called via API or MCP
Nikto	Web server vulnerability scanning	`nikto -h target`

Web Penetration

Tool	Purpose	Typical Command
SQLMap	SQL injection automation	`sqlmap -u "url?id=1" --batch --dbs`
FFUF	Directory/parameter brute-forcing	`ffuf -u target/FUZZ -w wordlist.txt`
Gobuster	Directory/subdomain brute-forcing	`gobuster dir -u target -w wordlist`
XSStrike	XSS detection	`xsstrike -u "url?param=test"`

Password Cracking

Tool	Purpose	Typical Command
Hashcat	GPU hash cracking	`hashcat -m 0 hash.txt wordlist.txt`
John the Ripper	CPU hash cracking	`john --wordlist=rockyou.txt hash.txt`
Hydra	Online brute-force cracking	`hydra -l admin -P pass.txt target ssh`

Exploitation Frameworks

Tool	Purpose	Description
Metasploit	Vulnerability exploitation framework	Requires separate installation, large footprint
Impacket	Windows protocol exploitation (SMB/WMI/Kerberos)	`pip install impacket`

MCP Backend Selection

This skill supports two MCP backends; choose one:

Option A: pentestMCP (recommended, one-click Docker)

Item：https://github.com/ramkansal/pentestmcp
Features: 20+ tools packaged into a single Docker container, directly exposed by the MCP server
Tools: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
Installation：

# 拉取并运行
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# 或本地构建
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp

MCP Registration：

{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}

Option B: mcp-security-hub (modular)

Project：https://github.com/FuzzingLabs/mcp-security-hub
Features: each tool has an independent MCP server, enabled on demand
Tools：Nmap、Ghidra、Nuclei、SQLMap、Hashcat
Installation: follow the README of each submodule

Option C: Single-Tool MCP (lightest)

If you only need one tool:

Tool	MCP Project	Installation
Nmap	nmap-mcp-server	npm
Nuclei	nuclei-mcp	npm
SQLMap	mcp-security-hub submodule	pip

Workflow

Standard Penetration Testing Process

Important: when conducting a penetration test, you must run according to the autonomous loop framework of references/pentest-loop.md . That framework defines the complete risk gating, logging standards, context compression, and completion check mechanisms.

1. 信息收集
   - Nmap 端口扫描 → 确认开放服务
   - Subfinder 子域名枚举 → 扩大攻击面
   - httpx 存活检测 → 过滤有效目标

2. 漏洞扫描
   - Nuclei 模板扫描 → 快速发现已知漏洞
   - ZAP/Nikto → Web 应用深度扫描

3. 漏洞利用
   - SQLMap → SQL 注入
   - FFUF → 发现隐藏路径/参数
   - 手动验证 → 确认可利用性

4. 后渗透（如果授权范围内）
   - 权限提升
   - 横向移动
   - 数据提取

5. 报告
   - 调用 docs-generator skill 生成渗透测试报告

Quick Scan Process (results in 5 minutes)

1. nmap -sV -sC target → 端口+服务
2. nuclei -u target -severity critical,high → 高危漏洞
3. 有 Web 服务 → ffuf -u target/FUZZ -w common.txt → 目录
4. 汇总发现 → 决定下一步

Notes

Authorization is required — all scanning/attack operations must be within the authorized scope
Control the scan rate — avoid triggering WAF/IDS or crashing the target
Passive first, then active — first information gathering, then vulnerability scanning, and finally exploitation
Record all operations — every command and result must be recorded for the report
Do not automate blindly — the AI should wait for confirmation at each key step

On-Demand Bootstrap

Automation Capability Boundaries

Tool	Can be installed automatically	Installation Method	Description
Nmap	✓	winget (`Insecure.Nmap`)	Windows version
Nuclei	✓	`go install` or GitHub Release	Requires Go or directly download the binary
SQLMap	✓	`pip install sqlmap` or git clone	Python
FFUF	✓	GitHub Release	Go binary
SecLists	✓	GitHub Release ZIP	Wordlist collection (essential for FFUF/Gobuster)
Hashcat	✗	Manual download	Requires GPU driver
Metasploit	✗	Manual installation	Large in size, using Kali is recommended
pentestMCP (Docker)	✗	Requires Docker	`docker run ramkansal/pentestmcp`
Impacket	✓	`pip install impacket`	Python
ProxyCat	✓	`pip install proxycat`	Proxy pool middleware (prevents blocking during batch scanning)
BurpSuite MCP	✗	Install from the BurpSuite extension marketplace	Requires BurpSuite Pro/Community

Bootstrap Strategy

If the user has Docker → recommend pentestMCP (one-click all-in-one bundle)
If there is no Docker → install each tool individually on demand
Prioritize installing Nmap + Nuclei + SQLMap (covers 80% of scenarios)

Manual Installation Guide

⚠️ **渗透工具未安装**

**推荐方案（需要 Docker）**：
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**轻量方案（逐个安装）**：
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: 从 https://github.com/ffuf/ffuf/releases 下载

**安装后告诉我，我继续当前任务。**

Reference Resources

awesome-pentest — a comprehensive collection of 25k+ stars penetration testing tools
SecLists — a collection of wordlists/payloads (essential for FFUF/Gobuster)
PayloadsAllTheThings — payloads for various vulnerabilities
HackTricks — encyclopedia of penetration testing techniques
pentest-ai-agents — 35 Claude Code penetration testing sub-agents (refer to their prompt patterns)
ProxyCat — proxy pool middleware (prevents IP blocking during batch scanning)
planning-with-files — scheduled task skill (for loop testing)

Reference documents within this skill

references/pentest-loop.md — Core Loop Framework(risk gating + logging standards + context compression)
references/automation-loop-pattern.md — automated loop testing mode (lightweight version)
references/awesome-pentest-digest.md — Essential Penetration Testing Tools Quick Reference
references/pentest-ai-agents-matrix.md — 35 agent coverage matrix
payloads/ — Custom payload directory (AI prioritizes this)
templates/ — Essential penetration testing file templates (scope/rules/plan/findings/progress)

src-hunter vulnerability discovery knowledge base

src-hunter/ The directory contains a complete SRC/Bug Bounty vulnerability discovery methodology:

19 categories of attack playbooks(IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
305 structured payloads + 263 WAF/EDR bypass steps
2,887 disclosed High/Critical reports from HackerOne
88,636 WooYun historical case statistics
Domestic component fingerprints and default credentials
CVSS 4.0 report template

How to use: During the hunt phase, the AI automatically reads the corresponding playbook and tests according to its workflow.

See src-hunter/SKILL.md and src-hunter/references/。

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Trigger conditions: Requires actively scanning/attacking the target (port scanning, vulnerability detection, injection testing, etc.) Downstream exit:

A web vulnerability is discovered and requires further analysis → js-reverse/
A binary vulnerability is discovered and requires reverse engineering → ida-reverse/ or radare2/
Browser operations are needed to verify the vulnerability → browser-automation/
After completion, generate a report → docs-generator/

Peer-related modules: CTF-Sandbox-Orchestrator/(Web/Pwn challenges in CTF will use these tools)