Xuanmu-BugBounty-mcp

git clone https://github.com/guaidao2/Xuanmu-Bugbounty-mcp.git
cd Xuanmu-BugBounty-mcp
pip install -e . -i https://pypi.tuna.tsinghua.edu.cn/simple

# 启动
xuanmu-bb
# 或: python "绝对路径/src/xuanmu_bb/server.py"

{
  "mcpServers": {
    "Xuanmu-BugBounty-mcp": {
      "command": "xuanmu-bb"
    }
  }
}

{
  "tool": "bb_sqli",
  "target": "https://example.com",
  "status": "confirmed",
  "summary": "发现 3 个可疑点（2个CRITICAL, 1个HIGH），其中 2 个已确认",
  "findings": [{
    "param": "id", "payload": "' AND SLEEP(3) --",
    "type": "time_based", "severity": "CRITICAL",
    "evidence": "时间盲注: 响应延迟 3.2s",
    "verified": true,
    "verified_by": "二次确认: sleep(5) 延迟 5.1s"
  }],
  "waf": {"detected": true, "name": "Cloudflare"},
  "metadata": {"duration_ms": 8234, "requests_sent": 45}
}

bb_sqli url="..." custom_payloads="' OR 1=1 -- ,1' AND SLEEP(10) -- "
bb_xss  url="..." custom_payloads="<script>alert(document.cookie)</script>,<img src=x onerror=alert(1)>"

bb_fingerprint url="https://example.com"

# 1. 指纹识别（识别技术栈 + WAF + 分类）
bb_fingerprint  url="https://target.com"

# 2. 目录扫描
bb_dir_scan     url="https://target.com"

# 3. 参数发现
bb_param_discover url="https://target.com/api"

# 4. 漏洞检测（使用发现的参数 + 自定义 payload）
bb_sqli         url="https://target.com/page?id=1" params="id" \
                custom_payloads="' OR 1=1 -- ,' AND SLEEP(5) -- "

bb_xss          url="https://target.com/search?q=test" params="q" \
                custom_payloads="<script>alert(1)</script>,<img src=x onerror=alert(1)>"

bb_ssti         url="https://target.com/welcome?name=test" params="name"
bb_cmdi         url="https://target.com/ping?host=127.0.0.1" params="host"
bb_ssrf         url="https://target.com/fetch?url=http://example.com" params="url"
bb_lfi          url="https://target.com/file?name=test.txt" params="name"
bb_cors         url="https://api.target.com/data"
bb_open_redirect url="https://target.com/redirect?url=https://example.com"
bb_xxe          url="https://target.com/xml/parse"

# 5. 认证测试
bb_jwt_analyze  token="eyJhbGciOiJIUzI1NiIs..."
bb_jwt_attack   token="..." mode="none"
bb_graphql      url="https://target.com/graphql"

# 6. 多步骤业务流
bb_session      steps='[
  {"method":"POST","url":"https://target.com/login","body":"user=admin&pass=test"},
  {"method":"GET","url":"https://target.com/api/profile"}
]'

# 7. 生成报告 + bb_send 全格式示例
bb_report       vuln_type="sqli" target="https://target.com/page?id=1" \
                payload="' OR 1=1 -- " impact="可获取数据库所有数据"

# bb_send: JSON 自动识别
bb_send         url="https://api.example.com/login" method="POST" \
                body='{"user":"admin","pass":"test"}'

# bb_send: Form 自动识别
bb_send         url="https://example.com/search" method="POST" \
                body="q=test&page=1"

# bb_send: 文件上传 (multipart/form-data)
bb_send         url="https://example.com/upload" method="POST" \
                files="file=/path/to/shell.php" body="action=upload"

# bb_send: XML 手动指定 Content-Type
bb_send         url="https://example.com/api" method="POST" \
                headers="Content-Type: application/xml" \
                body='<?xml version="1.0"?><root>data</root>'

# Bearer Token
bb_sqli url="https://target.com/api/search" params="q" auth_token="eyJ..."

# Session Cookie
bb_xss url="https://target.com/search" params="q" cookie="JSESSIONID=ABCD1234"

# 先检测 WAF
bb_waf_check url="https://target.com"

# 带 WAF 防护扫描（自动降速 + UA轮换）
bb_sqli url="https://target.com/page?id=1" waf_mode="safe" request_delay="3"

src/xuanmu_bb/
├── server.py              # MCP 入口（39 工具，注册表模式）
├── client.py              # HTTP 客户端（代理/Cookie/UA轮换/反封策略）
├── utils.py               # 公共工具 + ResultBuilder 结构化输出
├── data/
│   ├── payloads.py           # SQLi/XSS/SSTI/CMDI/SSRF/LFI Payload
│   ├── dicts.py              # 子域/目录字典 + 端口映射 + 弱口令
│   ├── fingerprints.py       # Web 指纹库 + WAF 签名
│   ├── fingerprints_enhanced.py  # 增强指纹库（79条，27分类）
│   ├── fingerprints_hub.py   # FingerprintHub 全量（2,224条，365KB）
│   ├── patterns.py           # 敏感信息正则 + 安全头列表
│   └── waf.py                # WAF 检测引擎
├── recon/                 # 侦察模块（5 工具）
├── vuln/                  # 漏洞检测模块（15 工具，均支持二次确认）
├── auth/                  # 认证安全模块（5 工具）
├── extract/               # 信息提取模块（5 工具）
└── tools/                 # 工具模块（9 工具 + fingerprint_importer）