# 1. 克隆仓库
git clone https://github.com/guaidao2/Xuanmu-Bugbounty-mcp.git
cd Xuanmu-BugBounty-mcp

# 2. 安装依赖（使用清华源）
pip install -e . -i https://pypi.tuna.tsinghua.edu.cn/simple

# 3. 启动 MCP 服务器（stdio 模式）
# 方式一：直接启动（推荐）
xuanmu-bb

# 方式二：使用 python + 脚本绝对路径启动
python "绝对路径/src/xuanmu_bb/server.py"

{
  "mcpServers": {
    "Xuanmu-BugBounty-mcp": {
      "command": "xuanmu-bb",
      "args": []
    }
  }
}

{
  "mcpServers": {
    "Xuanmu-BugBounty-mcp": {
      "command": "python",
      "args": ["你的项目绝对路径/src/xuanmu_bb/server.py"]
    }
  }
}

# Bearer Token（API 认证）
bb_sqli url="https://target.com/api/search" params="q" auth_token="eyJhbGciOiJIUzI1NiIs..."

# Session Cookie（Web 认证）
bb_xss url="https://target.com/search" params="q" cookie="JSESSIONID=ABCD1234"

# 先探测认证状态
bb_param_discover url="https://target.com"
# 输出会标注: [AUTH: required] HTTP 401 或 [AUTH: none] HTTP 200

# 侦察一个目标
bb_ping         target="example.com"
bb_port_scan    target="example.com" ports="80,443,8080-8090"
bb_subdomain    domain="example.com"
bb_fingerprint  url="https://example.com"
bb_dir_scan     url="https://example.com"

# 漏洞检测
bb_sqli         url="https://example.com/page?id=1" params="id"
bb_xss          url="https://example.com/search?q=test" params="q"
bb_ssti         url="https://example.com/welcome?name=test" params="name"
bb_cmdi         url="https://example.com/ping?host=127.0.0.1" params="host"
bb_ssrf         url="https://example.com/fetch?url=http://example.com" params="url"
bb_cors         url="https://api.example.com/data"
bb_open_redirect url="https://example.com/redirect?url=https://example.com"
bb_csrf         url="https://example.com/change_password"
bb_xxe          url="https://example.com/xml/parse"
bb_lfi          url="https://example.com/file?name=test.txt" params="name"
bb_host_inject  url="https://example.com/reset"
bb_takeover     domain="sub.example.com"
bb_race         url="https://example.com/api/coupon/claim" method="POST"

# JWT 工具
bb_jwt_decode   token="eyJhbGciOiJIUzI1NiIs..."
bb_jwt_analyze  token="eyJhbGciOiJIUzI1NiIs..."
bb_jwt_crack    token="eyJhbGciOiJIUzI1NiIs..."
bb_jwt_attack   token="eyJhbGciOiJIUzI1NiIs..." mode="none"

# GraphQL
bb_graphql      url="https://example.com/graphql"

# 信息提取
bb_extract      url="https://example.com" depth=2
bb_secrets      url="https://example.com" check_js=true
bb_headers      url="https://example.com"

# POST body 注入（新增）
bb_sqli         url="https://target.com/api/login" method="POST" body="username=admin&password=test" params="username"
bb_xss          url="https://target.com/api/feedback" method="POST" body="message=test" params="message"
bb_cmdi         url="https://target.com/api/ping" method="POST" body="host=127.0.0.1" params="host"
bb_xxe          url="https://target.com/xml/parse" body="<?xml version='1.0'?><root>test</root>"
bb_lfi          url="https://target.com/api/read" method="POST" body="file=../../../../etc/passwd" params="file"
bb_ssti         url="https://target.com/welcome" method="POST" body="name={{7*7}}" params="name"

# 工具
bb_payload      vuln_type="xss" encode="all" count=20
bb_send         url="https://example.com/api/login" method="POST" headers='{"Content-Type": "application/json"}' body='{"user":"admin","pass":"123"}'
bb_report       vuln_type="sqli" target="https://example.com/page?id=1" payload="\' OR 1=1 -- "
bb_send         url="https://example.com/api/login" method="POST" headers='{"Content-Type": "application/json"}' body='{"user":"admin","pass":"123"}'
bb_report       vuln_type="sqli" target="https://example.com/page?id=1" payload="' OR 1=1 -- "

# JS 深度分析
bb_js_analyze   url="https://example.com" auth_token="..."

# WAF 检测
bb_waf_check    url="https://example.com"

# IDOR 越权检测
bb_idor         url="https://api.example.com/users/1234" \
                token_owner="eyJ...owner_token..." \
                token_attacker="eyJ...attacker_token..."

# 多步骤流程
bb_session      steps='[
  {"method":"POST","url":"https://target.com/login","body":"user=admin&pass=test"},
  {"method":"GET","url":"https://target.com/api/profile"}
]'

# 云服务检测
bb_cloud_check  url="https://example.com"

# 参数自动发现 + NoSQL 注入
bb_param_discover url="https://example.com/api"
bb_nosqli       url="https://example.com/api/user?id=1"

1. 预检 — 发无害请求检测 WAF 指纹
2. 发现 WAF → 自动降速 + 轮换 UA + 提示绕过建议
3. 扫描中 — 实时检测拦截页面 (403/503/验证页)
4. 熔断 — 连续 N 次被拦截 → 自动中断 → 输出熔断报告

bb_waf_check url="https://target.com"

bb_sqli url="https://target.com/page?id=1" waf_mode="safe" request_delay="3"

src/xuanmu_bb/
├── server.py              # MCP 入口（38 个工具注册）
├── client.py              # HTTP 客户端（代理/Cookie/UA轮换/反封策略）
├── utils.py               # 公共工具函数
├── data/                  # 内置数据（Payload 字典/指纹/WAF库/正则模式）
├── recon/                 # 侦察模块（5 工具）
├── vuln/                  # 漏洞检测模块（15 工具）
├── auth/                  # 认证安全模块（5 工具）
├── extract/               # 信息提取模块（5 工具）
└── tools/                 # 工具模块（9 工具）