使用说明
KALI-V4-MCP
克劳德代码×Kali Linux MCP桥--v4.1
一个完整的pentest自动化平台，通过SSH ControlMaster将Claude Code（Windows）连接到Kali Linux VM。包括12项专家级最重要的技能，涵盖完整的外部攻击面。
建筑
Claude Code (Windows)
↓ stdio
kali_mcp_client.py — SSH ControlMaster pool (persistent, ~200ms saved/call)
↓
Kali Linux VM (VirtualBox, root@<kali-host>)
Claude Code (Windows)
↓ stdio
kali_desktop_client.py → desktop-bridge-server.js (port 3002)
↓ VBoxManage screenshotpng + xdotool + Playwright
Kali XFCE4 Desktop
v4.1功能：SSH ControlMaster多路复用、同一套接字上的SCP文件传输、并行作业启动器、仅附加JSONL审计跟踪、异步作业注册表持久化到磁盘（重启后仍然存在）、多目标支持。
仓库结构
KALI-V4-MCP/
├── CLAUDE.md — Full system context & architecture reference
├── README.md — This file
├── mcp-bridge/ — MCP bridge code
│ ├── kali_mcp_client.py — CLI bridge (v4.1) — SSH ControlMaster pool
│ ├── kali_desktop_client.py — Desktop bridge client
│ ├── desktop-bridge-server.js — Desktop bridge server (Windows-native Node.js)
│ ├── bridge-server.js — CLI bridge server
│ ├── mcp_base.py — Shared MCP base class
│ ├── ssh-keys/ — SSH key pair for Kali VM
│ ├── .env — Config (KALI_HOST, PORT, etc.)
│ └── ...
├── skills/ — Claude Code slash commands
│ ├── pt.md — Signal-driven attack planner
│ ├── pt-init.md — Engagement workspace init + CVE search
│ ├── pt-recon.md — Deep asset recon (Shodan, subfinder, JS analysis)
│ ├── pt-api.md — REST/GraphQL API attack (JWT, OAuth, race, type coercion)
│ ├── pt-secrets.md — Leaked secrets & API key hunter
│ ├── pt-web.md — HTTP smuggling, cache poisoning, subdomain takeover, WebSockets
│ ├── pt-logic.md — Business logic + IDOR expert
│ ├── pt-blind.md — OOB blind detection via interactsh
│ ├── pt-payloads.md — Payload generator from PayloadsAllTheThings
│ ├── pt-privesc.md — Linux privilege escalation (10-phase)
│ ├── pt-ad.md — Active Directory attack chain
│ └── pt-report.md — Professional pentest report generator
└── memory/ — Claude persistent memory files
技能覆盖率
| 技能 | 攻击类 |
|---|---|
/pt |
信号驱动规划器——30多个信号映射到矢量 |
/pt-init |
技术栈上的工作区、指纹、WAF、CORS、CVE搜索 |
/pt-recon |
子域枚举、Shodan/ASN、JS秘密、云桶、.git/.env暴露 |
/pt-api |
IDOR、JWT/OAuth、GraphQL、动词篡改、竞争条件、类型强制 |
/pt-secrets |
.git dump、.env hunt、GitHub dorking、trufflehog、API密钥验证（AWS/Stripe/OpenAI/SendGrid） |
/pt-web |
HTTP请求走私、web缓存中毒、子域接管、WebSocket IDOR、CRLF |
/pt-logic |
IDOR（5种模式）、工作流绕过、价格操纵、批量分配、账户枚举 |
/pt-blind |
OOB SSRF、盲SQLi、盲CMDi、盲XXE通过交互 |
/pt-payloads |
基于PAT的有效载荷：SQLi、SSTI、LFI、XXE、NoSQL、反序列化 |
/pt-privesc |
LinPEAS、SUID、sudo、功能、cron、内核CVE、Docker转义 |
/pt-ad |
AS-REP烘焙、Kerberoasting、BloodHound、传递哈希、DCSync |
/pt-report |
CVSS v3.1评分，OWASP/PCI-DSS/GDPR合规性映射 |
设置
1.克隆和配置
git clone https://github.com/0xthusharkiranreddy/KALI-V4-MCP
cd KALI-V4-MCP/mcp-bridge
cp .env.example .env
# Edit .env: set KALI_HOST, KALI_PORT, KALI_USERNAME
2.安装节点依赖项
npm install
3.配置克劳德代码(settings.json)
{
"mcpServers": {
"kali-pentest": {
"command": "python3",
"args": ["C:/path/to/KALI-V4-MCP/mcp-bridge/kali_mcp_client.py"],
"env": {
"KALI_HOST": "192.168.1.202",
"KALI_PORT": "22",
"KALI_USERNAME": "root",
"COMMAND_TIMEOUT": "900000000"
}
},
"kali-desktop": {
"command": "python3",
"args": ["C:/path/to/KALI-V4-MCP/mcp-bridge/kali_desktop_client.py"]
}
}
}
4.安装技能
# Copy skills to Claude commands directory
cp skills/*.md ~/.claude/commands/
# Or on Windows:
cp skills/*.md "C:/Users/<you>/.claude/commands/"
5.启动桌面桥（可选——用于GUI/浏览器控制）
$env:KALI_HOST="192.168.1.202"
$env:SSH_KEY="C:/path/to/KALI-V4-MCP/mcp-bridge/ssh-keys/id_ed25519"
$env:VBOX_VM="kali-linux-2025.4-virtualbox-amd64"
node mcp-bridge/desktop-bridge-server.js
Kali上的工具
sqlmap、ffuf、feroxbuster、nucleus、nmap、masscan、gobuster、wfuzz、nikto、whatweb、sslscan、arjun、jwt_tool、burpsuite、metasploit、hydra、netexec、寻血犬python、impacket、hashcat、john、trufflehog、gitleaks、git dumper、subinder、收割机、交互式客户端、wscat、走私者.py
单词列表：机密列表(/usr/share/wordlists/seclists/)，Payloads一切(/home/kali/PayloadsAllTheThings/)
