MCP Pentest

Instructions

Implementation Reference

• src/tools/service-specific.ts:145-209 (handler)

  The core handler function that executes the test_web_application tool. It performs technology-specific tests for CMS like WordPress (using WPScan), Drupal, Joomla, web servers, and common web vulnerabilities (Nikto). Aggregates findings and generates recommendations.
  async testWebApplication(target: string, technologies: string[]): Promise<ScanResult> { try { console.error(`🔍 Testing Web Application on ${target}`); const findings: string[] = []; const results: any = {}; // Test 1: Technology-specific tests for (const tech of technologies) { const techLower = tech.toLowerCase(); if (techLower.includes('wordpress')) { const wpResults = await this.testWordPress(target); results.wordpress_tests = wpResults; if (wpResults.plugins_detected) { findings.push(`WordPress plugins detected: ${wpResults.plugins_detected.length}`); } } if (techLower.includes('drupal')) { const drupalResults = await this.testDrupal(target); results.drupal_tests = drupalResults; } if (techLower.includes('joomla')) { const joomlaResults = await this.testJoomla(target); results.joomla_tests = joomlaResults; } if (techLower.includes('apache') || techLower.includes('nginx')) { const webServerResults = await this.testWebServer(target, techLower); results.webserver_tests = webServerResults; } } // Test 2: Common web vulnerabilities const webVulnResults = await this.testWebVulnerabilities(target); results.web_vulnerabilities = webVulnResults; findings.push(...webVulnResults.findings); return { target, timestamp: new Date().toISOString(), tool: 'web_application_test', results: { service: 'Web Application', technologies_tested: technologies, findings, detailed_results: results, recommendations: this.getWebAppRecommendations(findings, technologies) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'web_application_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } }
• src/index.ts:378-391 (schema)

  Input schema definition for the test_web_application tool, specifying required parameters: target (string) and technologies (array of strings). Part of the tool registration in ListTools response.
  name: "test_web_application", description: "Technology-specific web application penetration testing", inputSchema: { type: "object", properties: { target: { type: "string", description: "Target web application URL" }, technologies: { type: "array", items: { type: "string" }, description: "Detected technologies (e.g., ['WordPress', 'Apache', 'PHP'])" } }, required: ["target", "technologies"] }
• src/index.ts:577-578 (registration)

  Tool dispatch/registration in the CallToolRequest handler switch statement, routing calls to the serviceSpecificTools.testWebApplication method.
  case "test_web_application": return respond(await this.serviceSpecificTools.testWebApplication(args.target, args.technologies));
• src/index.ts:378-392 (registration)

  Tool object registration in the ListToolsRequest handler, defining name, description, and input schema for client discovery.
  name: "test_web_application", description: "Technology-specific web application penetration testing", inputSchema: { type: "object", properties: { target: { type: "string", description: "Target web application URL" }, technologies: { type: "array", items: { type: "string" }, description: "Detected technologies (e.g., ['WordPress', 'Apache', 'PHP'])" } }, required: ["target", "technologies"] } },
• src/tools/service-specific.ts:209-953 (helper)

  Supporting helper methods called by the main handler: testWordPress (WPScan), testDrupal (droopescan), testJoomla (joomscan), testWebServer (headers), testWebVulnerabilities (Nikto).
  } // SMB/NetBIOS Testing with cross-platform support async testSMB(target: string, port: number = 445): Promise<ScanResult> { try { console.error(`🔍 Testing SMB service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: SMB enumeration (platform-specific) if (isWindows) { // Windows: Use built-in commands try { const { stdout: netViewOutput } = await execAsync(`net view \\\\${target}`, { timeout: 60000 }); results.net_view = netViewOutput; if (netViewOutput.includes('Shared resources')) { findings.push('SMB shares enumerated successfully via net view'); } } catch (e) { console.error('net view failed:', e); } // Windows: NBTStat for NetBIOS enumeration try { const { stdout: nbtstatOutput } = await execAsync(`nbtstat -A ${target}`, { timeout: 30000 }); results.nbtstat = nbtstatOutput; if (nbtstatOutput.includes('<20>')) { findings.push('NetBIOS file sharing service detected'); } if (nbtstatOutput.includes('<00>')) { findings.push('NetBIOS workstation service detected'); } } catch (e) { console.error('nbtstat failed:', e); } } else { // Linux/Mac: Use traditional tools try { const { stdout: enum4linuxOutput } = await execAsync(`enum4linux -a ${target}`, { timeout: 120000 }); results.enum4linux = enum4linuxOutput; if (enum4linuxOutput.includes('Domain Name:')) { findings.push('Domain information disclosed'); } if (enum4linuxOutput.includes('password policy')) { findings.push('Password policy information disclosed'); } } catch (e) { console.error('enum4linux failed:', e); } try { const { stdout: smbclientOutput } = await execAsync(`smbclient -L ${target} -N`, { timeout: 60000 }); results.smbclient_shares = smbclientOutput; if (smbclientOutput.includes('Sharename')) { findings.push('SMB shares enumerated successfully'); } if (smbclientOutput.includes('IPC$')) { findings.push('IPC$ share accessible'); } } catch (e) { console.error('smbclient enumeration failed:', e); } } // Test 2: CrackMapExec (works on all platforms if installed) try { const cmeCommand = isWindows ? 'python -m crackmapexec' : 'crackmapexec'; const { stdout: cmeOutput } = await execAsync(`${cmeCommand} smb ${target}`, { timeout: 60000 }); results.crackmapexec = cmeOutput; if (cmeOutput.includes('SMBv1:True')) { findings.push('SMBv1 enabled (security risk)'); } if (cmeOutput.includes('signing:False')) { findings.push('SMB signing disabled (security risk)'); } } catch (e) { console.error('CrackMapExec failed:', e); } // Test 3: Check for EternalBlue vulnerability (nmap works on all platforms) try { const { stdout: nmapOutput } = await execAsync(`nmap -p ${port} --script smb-vuln-ms17-010 ${target}`, { timeout: 120000 }); results.eternalblue_check = nmapOutput; if (nmapOutput.includes('VULNERABLE')) { findings.push('CRITICAL: EternalBlue vulnerability detected (CVE-2017-0144)'); } } catch (e) { console.error('EternalBlue check failed:', e); } // Test 4: PowerShell SMB testing (Windows only) if (isWindows) { try { const psScript = ` $target = "${target}" try { $result = Test-NetConnection -ComputerName $target -Port ${port} if ($result.TcpTestSucceeded) { Write-Output "SMB port ${port} is accessible" # Try to enumerate shares $shares = Get-SmbShare -CimSession $target -ErrorAction SilentlyContinue if ($shares) { Write-Output "Available shares:" $shares | ForEach-Object { Write-Output " - $($_.Name)" } } } } catch { Write-Output "Error: $($_.Exception.Message)" } `; const { stdout: psOutput } = await execAsync(`powershell -Command "${psScript}"`, { timeout: 60000 }); results.powershell_smb = psOutput; if (psOutput.includes('is accessible')) { findings.push('SMB service confirmed accessible via PowerShell'); } if (psOutput.includes('Available shares:')) { findings.push('SMB shares enumerated via PowerShell'); } } catch (e) { console.error('PowerShell SMB test failed:', e); } } else { // Test 5: SMB null session test (Linux/Mac) try { const { stdout: nullSessionOutput } = await execAsync(`rpcclient -U "" -N ${target} -c "enumdomusers"`, { timeout: 60000 }); results.null_session = nullSessionOutput; if (nullSessionOutput.includes('user:')) { findings.push('SMB null session allows user enumeration'); } } catch (e) { console.error('Null session test failed:', e); } } return { target, timestamp: new Date().toISOString(), tool: 'smb_comprehensive_test', results: { service: 'SMB', port, findings, detailed_results: results, recommendations: this.getSMBRecommendations(findings) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'smb_comprehensive_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // SSH Testing async testSSH(target: string, port: number = 22): Promise<ScanResult> { try { console.error(`🔍 Testing SSH service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: SSH audit try { const { stdout: auditOutput } = await execAsync(`ssh-audit ${target}:${port}`, { timeout: 60000 }); results.ssh_audit = auditOutput; if (auditOutput.includes('WARN')) { findings.push('SSH configuration warnings detected'); } if (auditOutput.includes('FAIL')) { findings.push('SSH configuration failures detected'); } } catch (e) { console.error('SSH audit failed:', e); } // Test 2: Banner grabbing and version detection (cross-platform) try { let bannerCommand = ''; if (isWindows) { // Windows: Use PowerShell bannerCommand = `powershell -Command "try { $client = New-Object System.Net.Sockets.TcpClient('${target}', ${port}); $stream = $client.GetStream(); $buffer = New-Object byte[] 1024; $read = $stream.Read($buffer, 0, 1024); $banner = [System.Text.Encoding]::ASCII.GetString($buffer, 0, $read); Write-Output $banner; $client.Close() } catch { Write-Output 'Connection failed' }"`; } else { // Linux/Mac: Use netcat or telnet bannerCommand = `timeout 10 bash -c "echo '' | nc -w 3 ${target} ${port}" || timeout 10 telnet ${target} ${port} 2>/dev/null | head -n 1`; } const { stdout: bannerOutput } = await execAsync(bannerCommand, { timeout: 15000 }); results.banner = bannerOutput; if (bannerOutput.includes('OpenSSH') || bannerOutput.includes('SSH')) { const versionMatch = bannerOutput.match(/OpenSSH[_\s]*([\d.]+)/i) || bannerOutput.match(/SSH[_\s]*([\d.]+)/i); if (versionMatch) { results.ssh_version = versionMatch[1]; findings.push(`SSH version detected: ${versionMatch[1]}`); } else { findings.push('SSH service detected'); } } } catch (e) { console.error('Banner grab failed:', e); } // Test 3: SSH key algorithms and ciphers try { const { stdout: nmapOutput } = await execAsync(`nmap -p ${port} --script ssh2-enum-algos ${target}`, { timeout: 60000 }); results.ssh_algorithms = nmapOutput; if (nmapOutput.includes('weak')) { findings.push('Weak SSH algorithms detected'); } } catch (e) { console.error('SSH algorithm enumeration failed:', e); } return { target, timestamp: new Date().toISOString(), tool: 'ssh_comprehensive_test', results: { service: 'SSH', port, findings, detailed_results: results, recommendations: this.getSSHRecommendations(findings) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'ssh_comprehensive_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // FTP Testing async testFTP(target: string, port: number = 21): Promise<ScanResult> { try { console.error(`🔍 Testing FTP service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: Anonymous FTP access try { const { stdout: anonOutput } = await execAsync(`ftp -n ${target} ${port} << EOF user anonymous anonymous ls quit EOF`, { timeout: 30000 }); results.anonymous_access = anonOutput; if (anonOutput.includes('230')) { findings.push('Anonymous FTP access allowed'); } } catch (e) { console.error('Anonymous FTP test failed:', e); } // Test 2: FTP banner and version detection try { const { stdout: bannerOutput } = await execAsync(`nc -nv ${target} ${port} < /dev/null`, { timeout: 10000 }); results.banner = bannerOutput; if (bannerOutput.includes('220')) { findings.push('FTP banner retrieved'); if (bannerOutput.includes('vsftpd 2.3.4')) { findings.push('CRITICAL: vsftpd 2.3.4 backdoor vulnerability detected'); } } } catch (e) { console.error('FTP banner grab failed:', e); } // Test 3: FTP bounce attack test try { const { stdout: nmapOutput } = await execAsync(`nmap -p ${port} --script ftp-bounce ${target}`, { timeout: 60000 }); results.bounce_attack = nmapOutput; if (nmapOutput.includes('bounce')) { findings.push('FTP bounce attack possible'); } } catch (e) { console.error('FTP bounce test failed:', e); } return { target, timestamp: new Date().toISOString(), tool: 'ftp_comprehensive_test', results: { service: 'FTP', port, findings, detailed_results: results, recommendations: this.getFTPRecommendations(findings) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'ftp_comprehensive_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // Database Testing (MySQL/PostgreSQL/MSSQL) async testDatabase(target: string, port: number, dbType: 'mysql' | 'postgres' | 'mssql'): Promise<ScanResult> { try { console.error(`🔍 Testing ${dbType.toUpperCase()} service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: Default credentials test const defaultCreds = this.getDefaultDatabaseCredentials(dbType); for (const cred of defaultCreds) { try { let testCommand = ''; switch (dbType) { case 'mysql': testCommand = `mysql -h ${target} -P ${port} -u ${cred.username} -p${cred.password} -e "SELECT VERSION();"`; break; case 'postgres': testCommand = `PGPASSWORD=${cred.password} psql -h ${target} -p ${port} -U ${cred.username} -d postgres -c "SELECT version();"`; break; case 'mssql': testCommand = `sqlcmd -S ${target},${port} -U ${cred.username} -P ${cred.password} -Q "SELECT @@VERSION"`; break; } const { stdout: credOutput } = await execAsync(testCommand, { timeout: 30000 }); if (credOutput && !credOutput.includes('ERROR') && !credOutput.includes('failed')) { findings.push(`Default credentials work: ${cred.username}/${cred.password}`); results.default_credentials = cred; } } catch (e) { // Expected for wrong credentials } } // Test 2: Database enumeration with nmap scripts try { let scriptName = ''; switch (dbType) { case 'mysql': scriptName = 'mysql-info,mysql-enum'; break; case 'postgres': scriptName = 'pgsql-brute'; break; case 'mssql': scriptName = 'ms-sql-info,ms-sql-empty-password'; break; } const { stdout: nmapOutput } = await execAsync(`nmap -p ${port} --script ${scriptName} ${target}`, { timeout: 120000 }); results.nmap_enumeration = nmapOutput; if (nmapOutput.includes('version')) { findings.push('Database version information disclosed'); } } catch (e) { console.error('Database enumeration failed:', e); } return { target, timestamp: new Date().toISOString(), tool: `${dbType}_comprehensive_test`, results: { service: dbType.toUpperCase(), port, findings, detailed_results: results, recommendations: this.getDatabaseRecommendations(findings, dbType) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: `${dbType}_comprehensive_test`, results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // RDP Testing async testRDP(target: string, port: number = 3389): Promise<ScanResult> { try { console.error(`🔍 Testing RDP service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: BlueKeep vulnerability check try { const { stdout: bluekeepOutput } = await execAsync(`nmap -p ${port} --script rdp-vuln-ms12-020 ${target}`, { timeout: 120000 }); results.bluekeep_check = bluekeepOutput; if (bluekeepOutput.includes('VULNERABLE')) { findings.push('CRITICAL: BlueKeep vulnerability detected (CVE-2019-0708)'); } } catch (e) { console.error('BlueKeep check failed:', e); } // Test 2: RDP enumeration try { const { stdout: rdpEnumOutput } = await execAsync(`nmap -p ${port} --script rdp-enum-encryption ${target}`, { timeout: 60000 }); results.rdp_enumeration = rdpEnumOutput; if (rdpEnumOutput.includes('CredSSP')) { findings.push('CredSSP supported'); } if (rdpEnumOutput.includes('TLS')) { findings.push('TLS encryption supported'); } } catch (e) { console.error('RDP enumeration failed:', e); } return { target, timestamp: new Date().toISOString(), tool: 'rdp_comprehensive_test', results: { service: 'RDP', port, findings, detailed_results: results, recommendations: this.getRDPRecommendations(findings) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'rdp_comprehensive_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // SNMP Testing async testSNMP(target: string, port: number = 161): Promise<ScanResult> { try { console.error(`🔍 Testing SNMP service on ${target}:${port}`); const findings: string[] = []; const results: any = {}; // Test 1: SNMP community string enumeration const commonCommunities = ['public', 'private', 'community', 'admin', 'manager']; for (const community of commonCommunities) { try { const { stdout: snmpOutput } = await execAsync(`snmpwalk -v2c -c ${community} ${target}:${port} 1.3.6.1.2.1.1.1.0`, { timeout: 30000 }); if (snmpOutput && !snmpOutput.includes('Timeout')) { findings.push(`SNMP community string found: ${community}`); results[`community_${community}`] = snmpOutput; } } catch (e) { // Expected for wrong community strings } } // Test 2: SNMP version detection try { const { stdout: versionOutput } = await execAsync(`nmap -p ${port} --script snmp-info ${target}`, { timeout: 60000 }); results.snmp_version = versionOutput; if (versionOutput.includes('SNMPv1')) { findings.push('SNMPv1 detected (insecure)'); } } catch (e) { console.error('SNMP version detection failed:', e); } return { target, timestamp: new Date().toISOString(), tool: 'snmp_comprehensive_test', results: { service: 'SNMP', port, findings, detailed_results: results, recommendations: this.getSNMPRecommendations(findings) }, status: 'success' }; } catch (error) { return { target, timestamp: new Date().toISOString(), tool: 'snmp_comprehensive_test', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } } // Helper methods for recommendations private getSMBRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('SMBv1'))) { recommendations.push('Disable SMBv1 protocol'); } if (findings.some(f => f.includes('signing:False'))) { recommendations.push('Enable SMB signing'); } if (findings.some(f => f.includes('EternalBlue'))) { recommendations.push('Apply MS17-010 security patch immediately'); } if (findings.some(f => f.includes('null session'))) { recommendations.push('Disable SMB null sessions'); } recommendations.push('Implement strong authentication'); recommendations.push('Use SMBv3 with encryption'); return recommendations; } private getSSHRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('weak'))) { recommendations.push('Update SSH configuration to use strong algorithms'); } recommendations.push('Disable root login'); recommendations.push('Use key-based authentication'); recommendations.push('Implement fail2ban for brute force protection'); recommendations.push('Change default SSH port'); return recommendations; } private getFTPRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('Anonymous'))) { recommendations.push('Disable anonymous FTP access'); } if (findings.some(f => f.includes('vsftpd 2.3.4'))) { recommendations.push('URGENT: Update vsftpd to latest version'); } if (findings.some(f => f.includes('bounce'))) { recommendations.push('Disable FTP bounce attacks'); } recommendations.push('Use SFTP instead of FTP'); recommendations.push('Implement strong authentication'); return recommendations; } private getDatabaseRecommendations(findings: string[], dbType: string): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('Default credentials'))) { recommendations.push('Change default database credentials'); } recommendations.push('Implement strong password policies'); recommendations.push('Use database firewall rules'); recommendations.push('Enable database audit logging'); recommendations.push('Use encrypted connections (SSL/TLS)'); recommendations.push('Implement least privilege access'); return recommendations; } private getRDPRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('BlueKeep'))) { recommendations.push('URGENT: Apply BlueKeep security patches'); } recommendations.push('Enable Network Level Authentication (NLA)'); recommendations.push('Use strong authentication'); recommendations.push('Implement account lockout policies'); recommendations.push('Use VPN for remote access'); recommendations.push('Change default RDP port'); return recommendations; } private getSNMPRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('community string'))) { recommendations.push('Change default SNMP community strings'); } if (findings.some(f => f.includes('SNMPv1'))) { recommendations.push('Upgrade to SNMPv3 with authentication and encryption'); } recommendations.push('Implement SNMP access control lists'); recommendations.push('Use strong community strings'); recommendations.push('Disable SNMP if not needed'); return recommendations; } private getDefaultDatabaseCredentials(dbType: string): Array<{username: string, password: string}> { switch (dbType) { case 'mysql': return [ { username: 'root', password: '' }, { username: 'root', password: 'root' }, { username: 'root', password: 'mysql' }, { username: 'admin', password: 'admin' }, { username: 'mysql', password: 'mysql' } ]; case 'postgres': return [ { username: 'postgres', password: '' }, { username: 'postgres', password: 'postgres' }, { username: 'postgres', password: 'admin' }, { username: 'admin', password: 'admin' } ]; case 'mssql': return [ { username: 'sa', password: '' }, { username: 'sa', password: 'sa' }, { username: 'sa', password: 'admin' }, { username: 'admin', password: 'admin' } ]; default: return []; } } private getADRecommendations(findings: string[]): string[] { const recommendations: string[] = []; if (findings.some(f => f.includes('Domain Controller'))) { recommendations.push('Ensure Domain Controller is properly hardened'); recommendations.push('Implement least privilege access controls'); recommendations.push('Enable Advanced Audit Policy Configuration'); } if (findings.some(f => f.includes('SYSVOL') || f.includes('NETLOGON'))) { recommendations.push('Secure SYSVOL and NETLOGON shares with proper permissions'); recommendations.push('Monitor access to domain controller shares'); } if (findings.some(f => f.includes('RID cycling'))) { recommendations.push('CRITICAL: Implement measures to prevent user enumeration'); recommendations.push('Consider disabling null session enumeration'); } if (findings.some(f => f.includes('Kerberoasting'))) { recommendations.push('Review Service Principal Names (SPNs)'); recommendations.push('Use strong passwords for service accounts'); recommendations.push('Consider using Group Managed Service Accounts (gMSA)'); } recommendations.push('Implement Windows Event Forwarding (WEF)'); recommendations.push('Deploy Microsoft Defender for Identity'); recommendations.push('Regular security assessments using BloodHound'); return recommendations; } private getWebAppRecommendations(findings: string[], technologies: string[]): string[] { const recommendations: string[] = []; if (technologies.some(tech => tech.toLowerCase().includes('wordpress'))) { recommendations.push('Keep WordPress core, themes, and plugins updated'); recommendations.push('Use strong admin credentials and two-factor authentication'); recommendations.push('Implement Web Application Firewall (WAF)'); } if (findings.some(f => f.includes('plugin'))) { recommendations.push('Audit and remove unnecessary plugins'); recommendations.push('Implement plugin vulnerability scanning'); } if (findings.some(f => f.includes('SQL injection'))) { recommendations.push('CRITICAL: Fix SQL injection vulnerabilities immediately'); recommendations.push('Implement parameterized queries'); } if (findings.some(f => f.includes('XSS'))) { recommendations.push('Implement proper input validation and output encoding'); recommendations.push('Use Content Security Policy (CSP) headers'); } recommendations.push('Regular security testing and code reviews'); recommendations.push('Implement secure coding practices'); recommendations.push('Monitor application logs for suspicious activity'); return recommendations; } // WordPress-specific testing private async testWordPress(target: string): Promise<any> {