MCP Pentest

Instructions

Implementation Reference

• src/index.ts:323-339 (registration)

  Registration of the 'directory_scan' tool in the MCP tools list, including name, description, and input schema definition.
  { name: "directory_scan", description: "Advanced directory scanning with dirb/dirsearch/gobuster/feroxbuster", inputSchema: { type: "object", properties: { target: { type: "string", description: "Target URL" }, tool: { type: "string", enum: ["dirb", "dirsearch", "gobuster", "feroxbuster"], description: "Directory scanning tool to use" }, recursive: { type: "boolean", description: "Enable recursive scanning" } }, required: ["target"] } },
• src/index.ts:561-565 (handler)

  MCP tool call handler in switch statement that delegates to DirectoryScannerEngine.scanDirectories with parsed arguments.
  case "directory_scan": return respond(await this.directoryScanner.scanDirectories(args.target, { tool: args.tool || 'dirsearch', recursive: args.recursive }));
• src/tools/directory-scanner.ts:38-109 (handler)

  Core implementation of directory scanning logic: configures tool, executes selected scanner (dirb/dirsearch/gobuster/feroxbuster), parses results, analyzes risks, and returns structured ScanResult.
  async scanDirectories(target: string, config: Partial<DirectoryScanConfiguration> = {}): Promise<ScanResult> { try { const defaultConfig: DirectoryScanConfiguration = { tool: 'dirsearch', wordlist: this.getDefaultWordlist(), extensions: ['php', 'asp', 'aspx', 'jsp', 'html', 'htm', 'txt', 'xml', 'json', 'js', 'css'], threads: 30, timeout: 10, recursive: true, max_depth: 3, status_codes: [200, 201, 204, 301, 302, 307, 308, 401, 403, 405, 500], user_agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', delay: 0, ...config }; console.error(`🔍 Directory scanning ${target} with ${defaultConfig.tool}`); let results: DirectoryResult[] = []; switch (defaultConfig.tool) { case 'dirb': results = await this.runDirb(target, defaultConfig); break; case 'dirsearch': results = await this.runDirsearch(target, defaultConfig); break; case 'gobuster': results = await this.runGobuster(target, defaultConfig); break; case 'feroxbuster': results = await this.runFeroxbuster(target, defaultConfig); break; default: throw new Error(`Unsupported tool: ${defaultConfig.tool}`); } // Analyze and categorize results const analyzedResults = this.analyzeResults(results); const sensitiveFiles = analyzedResults.filter(r => r.is_sensitive); const accessibleDirs = analyzedResults.filter(r => r.is_directory && r.status_code === 200); const highRiskFindings = analyzedResults.filter(r => r.risk_level === 'high' || r.risk_level === 'critical'); return { target, timestamp: new Date().toISOString(), tool: 'directory_scanner', results: { scan_tool: defaultConfig.tool, total_discovered: results.length, accessible_directories: accessibleDirs.length, sensitive_files: sensitiveFiles.length, high_risk_findings: highRiskFindings.length, status_code_breakdown: this.groupByStatusCode(results), risk_level_breakdown: this.groupByRiskLevel(analyzedResults), discovered_paths: analyzedResults, security_recommendations: this.generateSecurityRecommendations(analyzedResults) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'directory_scanner', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } }
• src/tools/directory-scanner.ts:21-34 (schema)

  TypeScript interface defining configuration options for directory scanning tools, used in scanDirectories method.
  export interface DirectoryScanConfiguration { tool: 'dirb' | 'dirsearch' | 'gobuster' | 'feroxbuster'; wordlist?: string; extensions?: string[]; threads: number; timeout: number; recursive: boolean; max_depth: number; status_codes: number[]; user_agent?: string; headers?: Record<string, string>; proxy?: string; delay?: number; }
• src/tools/directory-scanner.ts:207-250 (helper)

  Helper method to execute dirsearch tool, construct command with config, capture output, and parse into DirectoryResult array. Similar methods exist for other tools.
  private async runDirsearch(target: string, config: DirectoryScanConfiguration): Promise<DirectoryResult[]> { try { // Check if dirsearch is installed try { await execAsync('dirsearch -h', { timeout: 5000 }); } catch { console.warn('dirsearch not found, skipping dirsearch scan'); return []; } const extensions = config.extensions?.join(',') || 'php,asp,aspx,jsp,html'; const statusCodes = config.status_codes.join(','); let command = `dirsearch -u ${target} -e ${extensions} -t ${config.threads} --timeout ${config.timeout}`; command += ` --include-status ${statusCodes}`; if (config.recursive) { command += ` -r --max-recursion-depth ${config.max_depth}`; } if (config.wordlist) { command += ` -w ${config.wordlist}`; } if (config.user_agent) { command += ` --user-agent "${config.user_agent}"`; } command += ' --format simple --quiet-mode'; console.error(`Executing: ${command}`); const { stdout } = await execAsync(command, { timeout: 600000, // 10 minutes maxBuffer: 1024 * 1024 * 20 // 20MB }); return this.parseDirsearchOutput(stdout, target); } catch (error) { console.error('Dirsearch execution error:', error); return []; } }