SuperAPI AI Directory
Partner中文AI newsFavorites
Skillspentest-tools

pentest-tools

Testing & quality

View repository

Updated 10-16 09:45

About this skill

ACTION REQUIRED (execute immediately after reading)

  1. NOW: Read ../field-journal/precedent-pentest.md — confirm this skill's operations are authorized routine operations
  2. NOW: Confirm scope.md exists and auth.status=granted、network_profile is legitimate (../ops/scope-contract.md). If scope is missing, run case-init.ps1 and stop for the user to grant authorization;Forbiddento automatically add -AuthGranted
  3. NOW: Confirm whether the current task falls within this skill's scope of application
  4. NEXT: Read ../tool-index.md, verify tool availability and actual paths
  5. NEXT: When tools are missing, call bootstrap; do not guess paths
  6. ACT: During the reconnaissance phase, prioritize references/recon-pipeline.md(CF browser headers / Windows nmap / curl --globoff); append each batch of results to timeline.md; write candidates with ../scripts/append-evidence.ps1 into Evidence (a hit ≠ verified)
  7. ACT: Modern web/range client-side surface (DOM XSS / prototype pollution / agent-browser) → references/client-side-lab-playbook.md; even if not fully breached, still write observed Evidence + failure latch
Pentest Tools (Pentest Tools)

Scope of Application

Use this skill when the task belongs to the following scenarios:

  • Target information gathering (port scanning, subdomain enumeration, service identification)
  • Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
  • Web penetration (SQL injection, XSS, SSRF, directory brute-forcing)
  • Password cracking (hash cracking, dictionary attacks)
  • Network penetration (service exploitation, lateral movement assistance)

Division of labor with other skills

Scenario What to use
Active scanning/attack (Nmap/Nuclei/SQLMap) This skill
Reverse engineering binaries ida-reverse/ or radare2/
Frontend JS signature reverse engineering js-reverse/
Browser/desktop automation operations browser-automation/
CTF competitions (comprehensive) CTF-Sandbox-Orchestrator/

Simple judgment:

  • Need to "scan targets, discover vulnerabilities, exploit vulnerabilities" → this skill
  • Need to "analyze a program's internal logic" → reverse engineering skills
  • Need to "operate a browser/desktop" → browser-automation

Tool Matrix

Information Gathering

Tool Purpose Typical command
Nmap Port scanning, service identification, OS detection nmap -sV -sC -O target
Masscan Large-scale fast port scanning masscan -p1-65535 target --rate=1000
Subfinder Subdomain enumeration subfinder -d target.com
httpx HTTP probing, liveness detection httpx -l urls.txt -status-code

Vulnerability Scanning

Tool Purpose Typical command
Nuclei Template-based vulnerability scanning (CVE/configuration/exposure) nuclei -u target -t cves/
ZAP Web application security scanning Invoke via API or MCP
Nikto Web server vulnerability scanning nikto -h target

Web Penetration

Tool Purpose Typical command
SQLMap SQL injection automation sqlmap -u "url?id=1" --batch --dbs
FFUF Directory/parameter brute-forcing ffuf -u target/FUZZ -w wordlist.txt
Gobuster Directory/Subdomain Brute-forcing gobuster dir -u target -w wordlist
XSStrike XSS Detection xsstrike -u "url?param=test"

Password Cracking

Tool Purpose Typical Command
Hashcat GPU Hash Cracking hashcat -m 0 hash.txt wordlist.txt
John the Ripper CPU Hash Cracking john --wordlist=rockyou.txt hash.txt
Hydra Online Brute-force Cracking hydra -l admin -P pass.txt target ssh

Exploitation Frameworks

Tool Purpose Description
Metasploit Exploitation Framework Requires separate installation, large footprint
Impacket Windows Protocol Exploitation (SMB/WMI/Kerberos) pip install impacket

MCP Backend Selection

This skill supports two MCP backends; choose one:

Option A: pentestMCP (recommended, one-click Docker)

  • Project：https://github.com/ramkansal/pentestmcp
  • Features: 20+ tools packaged into a single Docker container, MCP server directly exposed
  • Tools: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
  • Installation：
# 拉取并运行
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# 或本地构建
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp
  • MCP Registration：
{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}

Option B: mcp-security-hub (modular)

Option C: Single-tool MCP (lightest)

If you only need one specific tool:

Tool MCP Project Installation
Nmap nmap-mcp-server npm
Nuclei nuclei-mcp npm
SQLMap mcp-security-hub submodule pip

Reqable MCP (local packet capture and API workbench)

The Reqable desktop client can expose local packet capture, API, breakpoint, and rule capabilities through the official Reqable MCP Server . First install and start Reqable separately, then register the MCP:

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability reqable-mcp -McpHostTarget Codex

Replace Codex with Claude or Both to select the corresponding client; omitting -McpHostTarget will not write any global client configuration.

The stdio configuration after registration is:

{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}
  • By default, Reqable's local API is used; configure --host、--port or --scope minimal|all。
  • minimal is the recommended default scope;all will expose more tools that can alter the proxy, rules, environment, or saved data.
  • For captured traffic, request replay, and rule modification, the authorization and network restrictions of scope.md must still be satisfied first; the target scope must not be expanded just because the MCP has been registered.

Workflow

Standard Penetration Testing Process

Important: When performing penetration testing, you must operate according to the autonomous loop framework of references/pentest-loop.md . This framework defines the complete risk gating, logging standards, context compression, and completion check mechanisms.

1. 信息收集
   - Nmap 端口扫描 → 确认开放服务
   - Subfinder 子域名枚举 → 扩大攻击面
   - httpx 存活检测 → 过滤有效目标

2. 漏洞扫描
   - Nuclei 模板扫描 → 快速发现已知漏洞
   - ZAP/Nikto → Web 应用深度扫描

3. 漏洞利用
   - SQLMap → SQL 注入
   - FFUF → 发现隐藏路径/参数
   - 手动验证 → 确认可利用性

4. 后渗透（如果授权范围内）
   - 权限提升
   - 横向移动
   - 数据提取

5. 报告
   - 调用 docs-generator skill 生成渗透测试报告

Quick Scan Process (results in 5 minutes)

1. nmap -sV -sC target → 端口+服务
2. nuclei -u target -severity critical,high → 高危漏洞
3. 有 Web 服务 → ffuf -u target/FUZZ -w common.txt → 目录
4. 汇总发现 → 决定下一步

Precautions

  • Authorization is required — all scanning/attack operations must be within the authorized scope
  • Control the scanning rate — avoid triggering WAF/IDS or crashing the target
  • Passive first, then active — first information gathering, then vulnerability scanning, and finally exploitation
  • Record all operations — every command and result must be recorded for the report
  • Do not automate blindly — the AI should wait for confirmation at every key step

On-Demand Bootstrap

Automation Capability Boundaries

Tool Auto-installable Installation Method Description
Nmap ✓ winget (Insecure.Nmap) Windows version
Nuclei ✓ go install or GitHub Release Requires Go or directly download the binary
SQLMap ✓ pip install sqlmap or git clone Python
FFUF ✓ GitHub Release Go binary
SecLists ✓ GitHub Release ZIP Dictionary collection (essential for FFUF/Gobuster)
Hashcat ✗ Manual download Requires GPU driver
Metasploit ✗ Manual installation Large in size, using Kali is recommended
pentestMCP (Docker) ✗ Requires Docker docker run ramkansal/pentestmcp
Impacket ✓ pip install impacket Python
ProxyCat ✓ pip install proxycat Proxy pool middleware (prevents blocking during batch scanning)
BurpSuite MCP ✗ Install from the BurpSuite extension marketplace Requires BurpSuite Pro/Community
Reqable MCP ✓ npx -y reqable-mcp-server@1.0.1 Requires manual installation of the Reqable desktop client first

Bootstrap Strategy

  1. If the user has Docker → recommend pentestMCP (one-click all-in-one bundle)
  2. If there is no Docker → install each tool individually on demand
  3. Prioritize installing Nmap + Nuclei + SQLMap (covers 80% of scenarios)

Manual Installation Guide

⚠️ **渗透工具未安装**

**推荐方案（需要 Docker）**：
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**轻量方案（逐个安装）**：
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: 从 https://github.com/ffuf/ffuf/releases 下载

**安装后告诉我，我继续当前任务。**

Reference Resources

  • awesome-pentest — Collection of 25k+ stars pentest tools
  • SecLists — Dictionary/payload collection (essential for FFUF/Gobuster)
  • PayloadsAllTheThings — Payloads for various vulnerabilities
  • HackTricks — Pentest techniques encyclopedia
  • pentest-ai-agents — 35 Claude Code pentest sub-agents (refer to their prompt patterns)
  • Pentest Swarm AI — Swarm-intelligence autonomous pentest framework (multi-agent collaboration, supports MCP server)
  • ProxyCat — Proxy pool middleware (prevents IP blocking during batch scanning)
  • planning-with-files — Scheduled task skill (for loop testing)

Reference Documents in This Skill

  • references/pentest-loop.md — Core Loop Framework(Risk gating + logging standards + context compression)
  • references/recon-pipeline.md — Authorized Reconnaissance Pipeline(CF headers / nmap / Evidence)
  • references/client-side-lab-playbook.md — DOM XSS / Prototype Pollution / agent-browser(Client-side attack surface)
  • references/burpsuite-mcp-guide.md — Complete Guide to BurpSuite MCP(63 tools + 7 major use cases + AI Prompt templates)
  • references/automation-loop-pattern.md — Automated loop testing mode (lightweight version)
  • references/awesome-pentest-digest.md — Quick reference for essential pentest tools
  • references/pentest-ai-agents-matrix.md — 35 agent coverage matrix
  • payloads/ — Custom payload directory (AI prioritizes use)
  • templates/ — Required file templates for penetration testing (scope/rules/plan/findings/progress)

src-hunter Vulnerability Discovery Knowledge Base

src-hunter/ The directory contains a complete SRC/Bug Bounty vulnerability discovery methodology:

  • 19 categories of attack playbooks(IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
  • 305 structured payloads + 263 WAF/EDR bypass steps
  • 2887 disclosed High/Critical reports from HackerOne
  • Statistics on 88,636 historical WooYun cases
  • Fingerprints and default credentials for domestic components
  • CVSS 4.0 report template

Usage: During the hunt phase, the AI automatically reads the corresponding playbook and tests according to its workflow.

See src-hunter/SKILL.md and src-hunter/references/。

Routing Context

Upstream Entry: skills/SKILL.md(master control),routing.md Trigger conditions: Requires actively scanning/attacking the target (port scanning, vulnerability detection, injection testing, etc.) Downstream outlets:

  • Discovering a Web vulnerability requires further analysis → js-reverse/
  • Discovering a binary vulnerability requires reverse engineering → ida-reverse/ or radare2/
  • Requires operating a browser to verify the vulnerability → browser-automation/
  • Generate a report after completion → docs-generator/

Sibling related modules: CTF-Sandbox-Orchestrator/(The Web/Pwn challenges in CTF will use these tools)

Task completion self-check (MUST pass before claiming completion)

  • Did I execute every step in the workflow (rather than just reading it)?
  • Did I use a real tool path based on tool-index ?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Did I complete and write back the Checklist items required by RULES?