AI导哈

Kali Linux 渗透测试 MCP 服务

通过 Model Context Protocol 提供 27 个 Kali Linux 渗透测试工具的统一编程接口，覆盖信息收集、漏洞扫描、利用、后渗透、Shell 管理与报告生成，适用于 CTF、安全研究和自动化渗透测试。

  • by SiteQ8
  • Python
  • 本地部署
  • 更新于
在 GitHub 查看 SiteQ8/KaliMCP

使用说明

🐉 KaliMCP

Automate Kali Linux Pentesting with MCP

Live Demo: siteq8.github.io/KaliMCP · Repo: github.com/SiteQ8/KaliMCP

Programmatic access to 27 Kali Linux tools via Model Context Protocol. SSH and reverse shell management, file operations, Docker test labs. Perfect for CTFs, security research, and automated reporting.

⚡ Quick Start

git clone https://github.com/SiteQ8/KaliMCP.git
cd KaliMCP
python3 scripts/kalimcp_server.py --port 7070

Call a Tool

# Nmap scan with vuln scripts
curl -X POST http://localhost:7070 \
  -d '{"method":"tools/call","params":{"name":"nmap_scan","arguments":{"target":"10.10.10.1","scan_type":"vuln"}}}'

# Search for exploits
curl -X POST http://localhost:7070 \
  -d '{"method":"tools/call","params":{"name":"searchsploit","arguments":{"query":"Apache 2.4.49"}}}'

# Generate reverse shell payloads
curl -X POST http://localhost:7070 \
  -d '{"method":"tools/call","params":{"name":"reverse_shell_listener","arguments":{"port":4444}}}'

🔧 27 Tools in 8 Categories

🔍 Reconnaissance (5)

Tool Description
nmap_scan 8 scan profiles: quick, default, full, udp, stealth, vuln, os, aggressive
masscan_scan Ultra-fast full port scan (65535 ports)
dns_enum DNS enumeration via dnsenum, dnsrecon, or fierce
whois_lookup WHOIS domain/IP lookup
theharvester Email, subdomain, IP harvesting from OSINT sources

🌐 Web Application (6)

Tool Description
nikto_scan Web vulnerability scanner (6700+ tests)
dirb_scan Directory brute-force
gobuster_scan Dir/DNS/vhost enumeration (50 threads)
sqlmap_scan Automated SQL injection detection
whatweb_scan Technology fingerprinting
wfuzz_scan Web application fuzzer

🔐 Exploitation (3)

Tool Description
searchsploit Search Exploit-DB (JSON output with exploit details)
hydra_attack Network brute-force (SSH, FTP, HTTP, SMB, RDP, MySQL)
msf_search Metasploit module search

🔑 Password (2)

Tool Description
john_crack John the Ripper with wordlist + format support
hashid Hash type identification

🕵️ OSINT (2)

Tool Description
subfinder_scan Fast passive subdomain discovery
amass_enum Comprehensive DNS intelligence

🛡️ Post-Exploitation (2)

Tool Description
enumerate_system Local privesc recon (users, SUID, cron, kernel, network)
linpeas Download latest LinPEAS scanner

🐚 Shell Management (4)

Tool Description
ssh_connect SSH session with password/key auth
ssh_exec Execute commands on SSH sessions
reverse_shell_listener 6 payload types (bash, python, nc, php, powershell, perl) + listener
list_sessions List active sessions

📁 Files + 📋 Reporting (4)

Tool Description
file_upload Stage file with transfer methods (HTTP, nc, base64, scp)
file_download Download from URL
generate_report JSON pentest report with severity stats
docker_lab_setup 5 Docker vulnerable labs

🐳 Docker Test Mode

Safe practice environments:

# DVWA
docker run -d -p 8081:80 --name dvwa vulnerables/web-dvwa

# OWASP Juice Shop
docker run -d -p 3000:3000 --name juice bkimminich/juice-shop

# Metasploitable
docker run -d -p 8082:80 -p 2222:22 --name meta tleemcjr/metasploitable2

# WebGoat
docker run -d -p 8083:8080 --name webgoat webgoat/webgoat

📋 Pentest Workflow

1. RECON     → nmap_scan → dns_enum → whois_lookup → theharvester
2. WEB       → whatweb_scan → gobuster_scan → nikto_scan
3. VULN      → sqlmap_scan → searchsploit
4. EXPLOIT   → hydra_attack → ssh_connect
5. POST      → enumerate_system → linpeas
6. REPORT    → generate_report

⚠️ Legal Disclaimer

This tool is for authorized security testing only. Always obtain written permission before testing any system you do not own. Unauthorized access to computer systems is illegal.

👤 Author

Ali AlEnezi · @SiteQ8 · 3li.info

Security Architecture Principal · National Bank of Kuwait (NBK Group) 🇰🇼

GPEN · GWEB · GDSA · GICSP · GCCC · PCI DSS Professional

相关 MCP