MCP Pentest

Instructions

Implementation Reference

• src/tools/recon.ts:300-354 (handler)

  The core handler function for the 'tech_detection' tool. It performs HTTP requests to the target URL, analyzes response headers, HTML content, meta tags, and script sources to detect technologies, versions, and confidence levels.
  async techDetection(url: string): Promise<ScanResult> { try { const technologies: TechDetectionResult[] = []; // Make HTTP request to analyze headers and content const response = await axios.get(url, { timeout: 10000, headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' } }); const headers = response.headers; const html = response.data; const $ = cheerio.load(html); // Detect technologies from headers this.detectFromHeaders(headers, technologies); // Detect technologies from HTML content this.detectFromHTML($, technologies); // Detect technologies from meta tags this.detectFromMetaTags($, technologies); // Detect technologies from script sources this.detectFromScripts($, technologies); return { target: url, timestamp: new Date().toISOString(), tool: 'tech_detection', results: { technologies, headers: headers, status_code: response.status, server_info: { server: headers.server || 'Unknown', powered_by: headers['x-powered-by'] || 'Unknown', generator: $('meta[name="generator"]').attr('content') || 'Unknown' } }, status: 'success' }; } catch (error) { return { target: url, timestamp: new Date().toISOString(), tool: 'tech_detection', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } }
• src/index.ts:511-512 (registration)

  MCP tool dispatch in the main server switch statement, calling the reconTools.techDetection handler.
  case "tech_detection": return respond(await this.reconTools.techDetection(args.url));
• src/index.ts:110-119 (schema)

  Input schema definition for the 'tech_detection' tool registered in MCP listTools handler.
  name: "tech_detection", description: "Detect technologies used by target website", inputSchema: { type: "object", properties: { url: { type: "string", description: "Target URL" } }, required: ["url"] } },
• src/tools/recon.ts:26-31 (schema)

  TypeScript interface defining the structure of detected technologies in the tool's output.
  export interface TechDetectionResult { technology: string; version?: string; confidence: number; category: string; }
• src/tools/recon.ts:497-544 (helper)

  Helper function to detect web servers (Apache, Nginx, IIS) and backend technologies (PHP, ASP.NET) from HTTP response headers.
  private detectFromHeaders(headers: any, technologies: TechDetectionResult[]): void { // Server detection if (headers.server) { const server = headers.server.toLowerCase(); if (server.includes('apache')) { technologies.push({ technology: 'Apache HTTP Server', version: this.extractVersion(server, 'apache'), confidence: 100, category: 'Web Server' }); } else if (server.includes('nginx')) { technologies.push({ technology: 'Nginx', version: this.extractVersion(server, 'nginx'), confidence: 100, category: 'Web Server' }); } else if (server.includes('iis')) { technologies.push({ technology: 'Microsoft IIS', version: this.extractVersion(server, 'iis'), confidence: 100, category: 'Web Server' }); } } // X-Powered-By detection if (headers['x-powered-by']) { const poweredBy = headers['x-powered-by'].toLowerCase(); if (poweredBy.includes('php')) { technologies.push({ technology: 'PHP', version: this.extractVersion(poweredBy, 'php'), confidence: 100, category: 'Programming Language' }); } else if (poweredBy.includes('asp.net')) { technologies.push({ technology: 'ASP.NET', version: this.extractVersion(poweredBy, 'asp.net'), confidence: 100, category: 'Web Framework' }); } } }