usage-examples.mdā¢14.3 kB
# MCP Pentest Usage Examples
Berikut adalah contoh-contoh penggunaan MCP Pentest Framework dalam berbagai skenario.
## š Basic Usage
### 1. Automated Full Penetration Test
```bash
# CLI Usage
mcp-pentest auto pentest example.com --scope full --intensity active
# MCP Call
{
"method": "tools/call",
"params": {
"name": "auto_pentest",
"arguments": {
"target": "example.com",
"scope": "full",
"intensity": "active"
}
}
}
```
### 2. Quick Reconnaissance
```bash
# Port scan
mcp-pentest recon nmap 192.168.1.1 --type quick
# Subdomain enumeration
mcp-pentest recon subdomains example.com
# Technology detection
mcp-pentest recon tech https://example.com
```
## š Reconnaissance Scenarios
### Network Discovery
```javascript
// Comprehensive network reconnaissance
const targets = ["192.168.1.0/24"];
for (const target of targets) {
// 1. Network discovery
const nmapResult = await mcp.call("nmap_scan", {
target: target,
scan_type: "quick"
});
// 2. Service enumeration for each found host
if (nmapResult.results.open_ports) {
for (const port of nmapResult.results.open_ports) {
console.log(`Found ${port.service} on ${target}:${port.port}`);
}
}
}
```
### Web Application Discovery
```javascript
// Web application reconnaissance workflow
const domain = "example.com";
// 1. Subdomain enumeration
const subdomains = await mcp.call("subdomain_enum", {
domain: domain
});
// 2. Technology detection for each subdomain
for (const subdomain of subdomains.results.subdomains) {
const techResult = await mcp.call("tech_detection", {
url: `https://${subdomain}`
});
// 3. Directory bruteforcing
const dirResult = await mcp.call("directory_bruteforce", {
url: `https://${subdomain}`,
extensions: ["php", "asp", "jsp"]
});
}
```
## š”ļø Vulnerability Assessment
### Web Application Security Testing
```javascript
// Comprehensive web app security assessment
const webApp = "https://example.com";
// 1. Technology fingerprinting
const techScan = await mcp.call("tech_detection", {
url: webApp
});
// 2. Nuclei vulnerability scan
const nucleiScan = await mcp.call("nuclei_scan", {
target: webApp,
templates: ["http", "vulnerabilities", "cves"],
severity: "medium"
});
// 3. Nikto web server scan
const niktoScan = await mcp.call("nikto_scan", {
url: webApp
});
// 4. SQL injection testing
const sqlmapScan = await mcp.call("sqlmap_scan", {
url: `${webApp}/login.php`,
data: "username=test&password=test"
});
```
### Infrastructure Assessment
```javascript
// Network infrastructure security assessment
const target = "192.168.1.100";
// 1. Comprehensive port scan
const portScan = await mcp.call("nmap_scan", {
target: target,
scan_type: "aggressive"
});
// 2. Service-specific vulnerability scans
const vulnScan = await mcp.call("nuclei_scan", {
target: target,
templates: ["network", "services"],
severity: "high"
});
// 3. Search for known exploits
const exploitSearch = await mcp.call("metasploit_search", {
service: "SSH OpenSSH 7.4",
platform: "linux"
});
```
## ā” Exploitation Examples
### Controlled Exploitation Testing
```javascript
// Safe exploitation workflow
const target = "https://test-app.example.com";
// 1. Identify vulnerabilities first
const vulnResults = await mcp.call("nuclei_scan", {
target: target,
severity: "high"
});
// 2. Only attempt exploitation if critical vulns found
if (vulnResults.results.vulnerabilities.some(v => v.severity === "critical")) {
// 3. Attempt controlled exploitation
const exploitAttempt = await mcp.call("exploit_attempt", {
target: target,
vulnerability: "SQL Injection",
payload: "UNION SELECT"
});
console.log("Exploitation results:", exploitAttempt);
}
```
### Technology-Specific Exploitation
```javascript
// WordPress-specific security testing
const wpSite = "https://wordpress-site.com";
// 1. Confirm WordPress
const techDetection = await mcp.call("tech_detection", {
url: wpSite
});
if (techDetection.results.technologies.some(t => t.technology.includes("WordPress"))) {
// 2. WordPress-specific scans
const wpScan = await mcp.call("nuclei_scan", {
target: wpSite,
templates: ["wordpress"],
severity: "medium"
});
// 3. Custom WordPress exploitation
const wpExploit = await mcp.call("custom_exploit_builder", {
target: wpSite,
vulnType: "web",
techStack: ["WordPress"]
});
}
```
## š¤ AI-Powered Workflow
### Intelligent Next Steps
```javascript
// AI-driven penetration testing
let scanResults = {};
// 1. Initial reconnaissance
scanResults.recon = await mcp.call("nmap_scan", {
target: "example.com",
scan_type: "quick"
});
// 2. Get AI recommendations for next steps
const nextSteps = await mcp.call("suggest_next_steps", {
scan_results: JSON.stringify(scanResults)
});
// 3. Execute recommended actions
for (const recommendation of nextSteps.results.recommendations) {
console.log(`Priority: ${recommendation.priority}`);
console.log(`Action: ${recommendation.action}`);
console.log(`Tool: ${recommendation.tool}`);
console.log(`Reason: ${recommendation.reason}`);
// Execute the recommended tool
if (recommendation.tool === "nuclei_scan") {
const result = await mcp.call("nuclei_scan", {
target: "example.com",
severity: "high"
});
scanResults.vulnerabilities = result;
}
}
```
### Adaptive Assessment Strategy
```javascript
// Adaptive penetration testing workflow
async function adaptivePentest(target) {
const results = {
phases: [],
findings: [],
riskScore: 0
};
// Phase 1: Reconnaissance
console.log("Phase 1: Reconnaissance");
const reconResults = await mcp.call("auto_pentest", {
target: target,
scope: "network",
intensity: "passive"
});
results.phases.push(reconResults);
// Analyze results and adapt strategy
const analysis = await mcp.call("suggest_next_steps", {
scan_results: JSON.stringify(reconResults)
});
// Phase 2: Targeted assessment based on findings
if (analysis.results.recommendations.length > 0) {
console.log("Phase 2: Targeted Assessment");
for (const rec of analysis.results.recommendations.slice(0, 3)) {
if (rec.tool === "nuclei_scan") {
const vulnScan = await mcp.call("nuclei_scan", {
target: target,
severity: rec.risk_level
});
results.phases.push(vulnScan);
}
}
}
// Phase 3: Exploitation (if appropriate)
if (results.phases.some(p => p.results?.vulnerabilities?.some(v => v.severity === "critical"))) {
console.log("Phase 3: Controlled Exploitation");
const exploitResults = await mcp.call("exploit_attempt", {
target: target,
vulnerability: "Critical Vulnerability Found"
});
results.phases.push(exploitResults);
}
return results;
}
```
## š Reporting and Documentation
### Comprehensive Report Generation
```javascript
// Generate detailed penetration test report
async function generateComprehensiveReport(target) {
// 1. Perform comprehensive assessment
const assessment = await mcp.call("auto_pentest", {
target: target,
scope: "full",
intensity: "active"
});
// 2. Generate multiple report formats
const reports = {};
// HTML report for stakeholders
reports.html = await mcp.call("generate_report", {
target: target,
format: "html"
});
// JSON report for integration
reports.json = await mcp.call("generate_report", {
target: target,
format: "json"
});
// Markdown report for documentation
reports.markdown = await mcp.call("generate_report", {
target: target,
format: "markdown"
});
return {
assessment,
reports
};
}
```
### Custom Report Templates
```javascript
// Custom report generation with specific focus
async function generateExecutiveReport(target) {
const results = await mcp.call("auto_pentest", {
target: target,
scope: "full",
intensity: "active"
});
// Focus on business-critical findings
const criticalFindings = results.results.workflow.results.vulnerabilities
.filter(v => v.severity === "critical" || v.severity === "high")
.map(v => ({
title: v.name,
risk: v.severity,
businessImpact: calculateBusinessImpact(v),
remediation: v.solution
}));
return {
executiveSummary: {
target: target,
assessmentDate: new Date().toISOString(),
overallRisk: results.results.threat_level,
criticalIssues: criticalFindings.length,
recommendedActions: results.results.workflow.recommendations
},
findings: criticalFindings
};
}
```
## š Security and Best Practices
### Safe Testing Practices
```javascript
// Example of safe, authorized testing
async function authorizedPentest(target, authorization) {
// 1. Verify authorization
if (!authorization.isValid || !authorization.scopeIncludes(target)) {
throw new Error("Unauthorized target");
}
// 2. Configure safe testing parameters
const safeConfig = {
scope: authorization.allowedScope, // "web" | "network" | "full"
intensity: authorization.maxIntensity, // "passive" | "active"
timeLimit: authorization.maxDuration
};
// 3. Execute authorized testing
const results = await mcp.call("auto_pentest", {
target: target,
scope: safeConfig.scope,
intensity: safeConfig.intensity
});
// 4. Document all activities
const auditLog = {
target: target,
authorization: authorization.id,
startTime: new Date().toISOString(),
activities: results.results.workflow.phases,
findings: results.results.workflow.results.vulnerabilities.length
};
return { results, auditLog };
}
```
### Rate Limiting and Throttling
```javascript
// Implement proper rate limiting
class SafePentester {
constructor() {
this.requestCount = 0;
this.startTime = Date.now();
this.maxRequestsPerMinute = 30;
}
async throttledScan(target, scanType) {
// Check rate limits
const elapsed = Date.now() - this.startTime;
if (elapsed < 60000 && this.requestCount >= this.maxRequestsPerMinute) {
await new Promise(resolve => setTimeout(resolve, 60000 - elapsed));
this.requestCount = 0;
this.startTime = Date.now();
}
this.requestCount++;
// Execute scan with throttling
return await mcp.call(scanType, { target });
}
}
```
## šÆ Real-World Scenarios
### Bug Bounty Workflow
```javascript
// Automated bug bounty reconnaissance
async function bugBountyRecon(domain) {
const findings = [];
// 1. Subdomain discovery
const subdomains = await mcp.call("subdomain_enum", {
domain: domain
});
// 2. Technology stack analysis
for (const subdomain of subdomains.results.subdomains.slice(0, 10)) {
const tech = await mcp.call("tech_detection", {
url: `https://${subdomain}`
});
// 3. Quick vulnerability scan
const vulns = await mcp.call("nuclei_scan", {
target: `https://${subdomain}`,
templates: ["exposures", "misconfiguration"],
severity: "medium"
});
if (vulns.results.vulnerabilities.length > 0) {
findings.push({
target: subdomain,
technologies: tech.results.technologies,
vulnerabilities: vulns.results.vulnerabilities
});
}
}
return findings;
}
```
### Compliance Assessment
```javascript
// PCI DSS compliance checking
async function pciComplianceCheck(target) {
const complianceResults = {
target,
checkDate: new Date().toISOString(),
requirements: {},
overallStatus: 'pending'
};
// Requirement 2: Change vendor defaults
const techScan = await mcp.call("tech_detection", {
url: target
});
complianceResults.requirements.req2 = {
description: "Change vendor-supplied defaults",
status: checkDefaultCredentials(techScan.results),
findings: []
};
// Requirement 6: Develop secure systems
const vulnScan = await mcp.call("nuclei_scan", {
target: target,
templates: ["cves", "vulnerabilities"],
severity: "medium"
});
complianceResults.requirements.req6 = {
description: "Develop and maintain secure systems",
status: vulnScan.results.vulnerabilities.length === 0 ? 'compliant' : 'non-compliant',
findings: vulnScan.results.vulnerabilities
};
return complianceResults;
}
```
## š Integration Examples
### CI/CD Security Testing
```javascript
// GitHub Actions integration example
async function securityTestingPipeline(deploymentUrl) {
console.log("Starting security testing for deployment...");
// Quick security scan
const securityScan = await mcp.call("auto_pentest", {
target: deploymentUrl,
scope: "web",
intensity: "passive"
});
// Check for critical issues
const criticalIssues = securityScan.results.workflow.results.vulnerabilities
.filter(v => v.severity === "critical" || v.severity === "high");
if (criticalIssues.length > 0) {
console.error(`ā Security test failed: ${criticalIssues.length} critical issues found`);
process.exit(1);
}
console.log("ā
Security tests passed");
return securityScan;
}
```
### SIEM Integration
```javascript
// Send findings to SIEM system
async function siemIntegration(target) {
const scanResults = await mcp.call("auto_pentest", {
target: target,
scope: "full",
intensity: "active"
});
// Format for SIEM ingestion
const siemEvents = scanResults.results.workflow.results.vulnerabilities.map(vuln => ({
timestamp: new Date().toISOString(),
source: "mcp-pentest",
event_type: "vulnerability_detected",
severity: vuln.severity,
target: target,
vulnerability: vuln.name,
description: vuln.description,
confidence: vuln.confidence || 90
}));
// Send to SIEM (example)
for (const event of siemEvents) {
console.log("SIEM Event:", JSON.stringify(event));
// await sendToSiem(event);
}
return siemEvents;
}
```
Semua contoh di atas menunjukkan penggunaan framework MCP Pentest dalam berbagai skenario real-world dengan mempertimbangkan aspek keamanan, etika, dan legal compliance.