FreePublished on GitHub

pentest-tools

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。

触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow

Works withDocker

See how to install

Files included (110)

SKILL.md9.8 KB
payloads/README.md1.1 KB
references/ai-pentest-agents.md6.0 KB
references/ai-pentesting-landscape-2026.md3.4 KB
references/automation-loop-pattern.md5.2 KB
references/awesome-pentest-digest.md5.9 KB
references/kali-mcp-ecosystem.md4.4 KB
references/network-attack-defense.md9.9 KB
references/nuclei-guide-2026.md4.0 KB
references/pentest-ai-agents-matrix.md5.0 KB
references/pentest-loop.md6.6 KB
references/web-attack-cheatsheet.md7.5 KB
src-hunter/.claude-plugin/marketplace.json1.0 KB
src-hunter/.gitignore164 B
src-hunter/LICENSE1.0 KB
src-hunter/README.en.md6.1 KB
src-hunter/README.md6.2 KB
src-hunter/references/.gitkeep0 B
src-hunter/references/dictionaries/00-index.md2.2 KB
src-hunter/references/dictionaries/chinese-srcfingerprints.md14.5 KB
src-hunter/references/dictionaries/default-credentials-cn.md9.9 KB
src-hunter/references/industry/00-index.md2.7 KB
src-hunter/references/industry/banking-finance.md14.6 KB
src-hunter/references/industry/telecom-isp.md11.5 KB
src-hunter/references/methodology/00-index.md2.9 KB
src-hunter/references/methodology/01-attack-priority.md6.5 KB
src-hunter/references/methodology/02-bypass-toolkit.md11.3 KB
src-hunter/references/methodology/03-evidence-discipline.md7.4 KB
src-hunter/references/methodology/04-control-gap-hunting.md9.1 KB
src-hunter/references/methodology/05-srctimebox-priority.md7.7 KB
src-hunter/references/payloader/by-category/intranet/adcs攻击.md6.2 KB
src-hunter/references/payloader/by-category/intranet/exchange攻击.md5.5 KB
src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md2.5 KB
src-hunter/references/payloader/by-category/intranet/信息收集.md21.5 KB
src-hunter/references/payloader/by-category/intranet/免杀与规避.md18.3 KB
src-hunter/references/payloader/by-category/intranet/凭证窃取.md34.2 KB
src-hunter/references/payloader/by-category/intranet/域渗透攻击.md18.0 KB
src-hunter/references/payloader/by-category/intranet/权限提升.md21.1 KB
src-hunter/references/payloader/by-category/intranet/权限维持.md13.6 KB
src-hunter/references/payloader/by-category/intranet/横向移动.md20.8 KB
src-hunter/references/payloader/by-category/intranet/隧道代理.md12.5 KB
src-hunter/references/payloader/by-category/web/ai安全.md31.3 KB
src-hunter/references/payloader/by-category/web/api安全.md45.1 KB
src-hunter/references/payloader/by-category/web/csrf跨站请求伪造.md23.6 KB
src-hunter/references/payloader/by-category/web/jwt安全.md19.6 KB
src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md35.1 KB
src-hunter/references/payloader/by-category/web/rce远程代码执行.md37.7 KB
src-hunter/references/payloader/by-category/web/sql-nosql注入.md61.5 KB
src-hunter/references/payloader/by-category/web/ssrf服务端请求伪造.md36.8 KB
src-hunter/references/payloader/by-category/web/ssti模板注入.md31.3 KB
src-hunter/references/payloader/by-category/web/websocket安全.md20.1 KB
src-hunter/references/payloader/by-category/web/xss跨站脚本.md43.5 KB
src-hunter/references/payloader/by-category/web/xxe实体注入.md24.3 KB
src-hunter/references/payloader/by-category/web/业务逻辑漏洞.md24.8 KB
src-hunter/references/payloader/by-category/web/云安全漏洞.md26.3 KB
src-hunter/references/payloader/by-category/web/供应链攻击.md17.4 KB
src-hunter/references/payloader/by-category/web/原型链污染.md18.6 KB
src-hunter/references/payloader/by-category/web/开放重定向.md13.6 KB
src-hunter/references/payloader/by-category/web/文件漏洞.md46.8 KB
src-hunter/references/payloader/by-category/web/框架漏洞.md67.2 KB
src-hunter/references/payloader/by-category/web/点击劫持.md13.7 KB
src-hunter/references/payloader/by-category/web/缓存与cdn安全.md16.9 KB
src-hunter/references/payloader/by-category/web/认证漏洞.md63.5 KB
src-hunter/references/payloader/by-category/web/请求走私.md22.0 KB
src-hunter/references/payloader/index.md4.7 KB
src-hunter/references/payloader/raw/navigation.json152.5 KB
src-hunter/references/payloader/raw/tools.json169.5 KB
src-hunter/references/payloader/raw/web.json1.1 MB
src-hunter/references/payloader/tools/web渗透.md12.6 KB
src-hunter/references/payloader/tools/windows渗透.md2.0 KB
src-hunter/references/payloader/tools/信息收集.md15.1 KB
src-hunter/references/payloader/tools/内网渗透.md14.9 KB
src-hunter/references/payloader/tools/凭证窃取.md2.7 KB
src-hunter/references/payloader/tools/域渗透.md883 B
src-hunter/references/payloader/tools/密码攻击.md9.1 KB
src-hunter/references/payloader/tools/权限提升.md2.1 KB
src-hunter/references/payloader/tools/漏洞利用.md9.3 KB
src-hunter/references/payloader/tools/系统命令.md7.7 KB
src-hunter/references/payloader/tools/红队工具.md799 B
src-hunter/references/payloader/tools/编码解码.md4.6 KB
src-hunter/references/payloader/tools/隧道代理.md1.1 KB
src-hunter/references/payloader/waf-bypass.md169.6 KB
src-hunter/references/playbooks/00-index.md2.7 KB
src-hunter/references/playbooks/api-rest.md45.2 KB
src-hunter/references/playbooks/arbitrary-x-authz.md20.3 KB
src-hunter/references/playbooks/dos.md28.6 KB
src-hunter/references/playbooks/file-upload.md44.3 KB
src-hunter/references/playbooks/graphql.md5.4 KB
src-hunter/references/playbooks/http-smuggling.md21.2 KB
src-hunter/references/playbooks/info-disclosure.md15.9 KB
src-hunter/references/playbooks/intranet-postexp.md107.5 KB
src-hunter/references/playbooks/llm-prompt-injection.md55.2 KB
src-hunter/references/playbooks/logic-flaws.md50.8 KB
src-hunter/references/playbooks/mobile.md13.5 KB
src-hunter/references/playbooks/oauth-saml-jwt.md77.2 KB
src-hunter/references/playbooks/path-traversal.md31.9 KB
src-hunter/references/playbooks/race-conditions.md7.1 KB
src-hunter/references/playbooks/rce.md120.5 KB
src-hunter/references/playbooks/sqli.md44.3 KB
src-hunter/references/playbooks/ssrf-cache-host.md61.5 KB
src-hunter/references/playbooks/unauth-access.md14.2 KB
src-hunter/references/playbooks/xss.md30.1 KB
src-hunter/references/templates/report-submission.md9.6 KB
src-hunter/references/tools/mcp-jshook.md15.7 KB
src-hunter/SKILL.md10.6 KB
templates/findings.md328 B
templates/progress.md242 B
templates/rules.md722 B
templates/scope.md422 B
templates/task_plan.md543 B

SKILL.md (original)

Review the instructions the agent will receive before you install.

渗透测试工具链 (Pentest Tools)

适用范围

当任务属于以下场景时使用本 skill：

目标信息收集（端口扫描、子域名枚举、服务识别）
漏洞扫描（Web 漏洞、CVE 检测、配置错误）
Web 渗透（SQL 注入、XSS、SSRF、目录爆破）
密码破解（哈希破解、字典攻击）
网络渗透（服务利用、横向移动辅助）

与其他 skill 的分工

场景	用什么
主动扫描/攻击（Nmap/Nuclei/SQLMap）	本 skill
逆向分析二进制	`ida-reverse/` 或 `radare2/`
前端 JS 签名逆向	`js-reverse/`
浏览器/桌面自动化操作	`browser-automation/`
CTF 竞赛（综合）	`CTF-Sandbox-Orchestrator/`
游戏安全	`game-security/`

简单判断：

需要"扫描目标、发现漏洞、利用漏洞" → 本 skill
需要"分析程序内部逻辑" → 逆向类 skill
需要"操作浏览器/桌面" → browser-automation

工具矩阵

信息收集

工具	用途	典型命令
Nmap	端口扫描、服务识别、OS 检测	`nmap -sV -sC -O target`
Masscan	大规模快速端口扫描	`masscan -p1-65535 target --rate=1000`
Subfinder	子域名枚举	`subfinder -d target.com`
httpx	HTTP 探测、存活检测	`httpx -l urls.txt -status-code`

漏洞扫描

工具	用途	典型命令
Nuclei	模板化漏洞扫描（CVE/配置/暴露）	`nuclei -u target -t cves/`
ZAP	Web 应用安全扫描	通过 API 或 MCP 调用
Nikto	Web 服务器漏洞扫描	`nikto -h target`

Web 渗透

工具	用途	典型命令
SQLMap	SQL 注入自动化	`sqlmap -u "url?id=1" --batch --dbs`
FFUF	目录/参数爆破	`ffuf -u target/FUZZ -w wordlist.txt`
Gobuster	目录/子域名爆破	`gobuster dir -u target -w wordlist`
XSStrike	XSS 检测	`xsstrike -u "url?param=test"`

密码破解

工具	用途	典型命令
Hashcat	GPU 哈希破解	`hashcat -m 0 hash.txt wordlist.txt`
John the Ripper	CPU 哈希破解	`john --wordlist=rockyou.txt hash.txt`
Hydra	在线暴力破解	`hydra -l admin -P pass.txt target ssh`

利用框架

工具	用途	说明
Metasploit	漏洞利用框架	需要单独安装，体量大
Impacket	Windows 协议利用（SMB/WMI/Kerberos）	`pip install impacket`

MCP 后端选择

本 skill 支持两种 MCP 后端，选一个即可：

方案 A：pentestMCP（推荐，Docker 一键）

项目：https://github.com/ramkansal/pentestmcp
特点：20+ 工具打包成单个 Docker 容器，MCP server 直接暴露
工具：Nmap、Nuclei、ZAP、SQLMap、FFUF、Nikto、Gobuster、Subfinder、httpx 等
安装：

# 拉取并运行
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# 或本地构建
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp

MCP 注册：

{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}

方案 B：mcp-security-hub（模块化）

项目：https://github.com/FuzzingLabs/mcp-security-hub
特点：每个工具独立 MCP server，按需启用
工具：Nmap、Ghidra、Nuclei、SQLMap、Hashcat
安装：按各子模块 README 操作

方案 C：单工具 MCP（最轻量）

如果只需要某一个工具：

工具	MCP 项目	安装
Nmap	nmap-mcp-server	npm
Nuclei	nuclei-mcp	npm
SQLMap	mcp-security-hub 子模块	pip

工作流

标准渗透流程

重要：执行渗透测试时，必须按 references/pentest-loop.md 的自主循环框架运行。该框架定义了完整的风险门控、记录规范、上下文压缩和完成检查机制。

1. 信息收集
   - Nmap 端口扫描 → 确认开放服务
   - Subfinder 子域名枚举 → 扩大攻击面
   - httpx 存活检测 → 过滤有效目标

2. 漏洞扫描
   - Nuclei 模板扫描 → 快速发现已知漏洞
   - ZAP/Nikto → Web 应用深度扫描

3. 漏洞利用
   - SQLMap → SQL 注入
   - FFUF → 发现隐藏路径/参数
   - 手动验证 → 确认可利用性

4. 后渗透（如果授权范围内）
   - 权限提升
   - 横向移动
   - 数据提取

5. 报告
   - 调用 docs-generator skill 生成渗透测试报告

快速扫描流程（5 分钟出结果）

1. nmap -sV -sC target → 端口+服务
2. nuclei -u target -severity critical,high → 高危漏洞
3. 有 Web 服务 → ffuf -u target/FUZZ -w common.txt → 目录
4. 汇总发现 → 决定下一步

注意事项

必须有授权 — 所有扫描/攻击操作必须在授权范围内
控制扫描速率 — 避免触发 WAF/IDS 或打崩目标
先被动后主动 — 先信息收集，再漏洞扫描，最后利用
记录所有操作 — 每个命令和结果都要记录，用于报告
不要盲目自动化 — AI 应该在每个关键步骤等待确认

按需自举（On-Demand Bootstrap）

自动化能力边界

工具	可自动安装	安装方式	说明
Nmap	✓	winget (`Insecure.Nmap`)	Windows 版
Nuclei	✓	`go install` 或 GitHub Release	需要 Go 或直接下载二进制
SQLMap	✓	`pip install sqlmap` 或 git clone	Python
FFUF	✓	GitHub Release	Go 二进制
SecLists	✓	GitHub Release ZIP	字典大全（FFUF/Gobuster 必备）
Hashcat	✗	手动下载	需要 GPU 驱动
Metasploit	✗	手动安装	体量大，建议用 Kali
pentestMCP (Docker)	✗	需要 Docker	`docker run ramkansal/pentestmcp`
Impacket	✓	`pip install impacket`	Python
ProxyCat	✓	`pip install proxycat`	代理池中间件（批量扫描防封）
BurpSuite MCP	✗	BurpSuite 扩展市场安装	需要 BurpSuite Pro/Community

自举策略

如果用户有 Docker → 推荐 pentestMCP（一键全家桶）
如果没有 Docker → 按需单独安装各工具
优先安装 Nmap + Nuclei + SQLMap（覆盖 80% 场景）

手动安装引导

⚠️ **渗透工具未安装**

**推荐方案（需要 Docker）**：
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**轻量方案（逐个安装）**：
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: 从 https://github.com/ffuf/ffuf/releases 下载

**安装后告诉我，我继续当前任务。**

参考资源

awesome-pentest — 25k+ stars 渗透工具大全
SecLists — 字典/payload 集合（FFUF/Gobuster 必备）
PayloadsAllTheThings — 各类漏洞 payload
HackTricks — 渗透技巧百科
pentest-ai-agents — 35 个 Claude Code 渗透子 agent（参考其 prompt 模式）
ProxyCat — 代理池中间件（批量扫描防封 IP）
planning-with-files — 计划任务 skill（循环测试用）

本 skill 内参考文档

references/pentest-loop.md — 核心循环框架（风险门控 + 记录规范 + 上下文压缩）
references/automation-loop-pattern.md — 自动化循环测试模式（轻量版）
references/awesome-pentest-digest.md — 渗透工具精华速查
references/pentest-ai-agents-matrix.md — 35 agent 覆盖矩阵
payloads/ — 自定义 payload 目录（AI 优先使用）
templates/ — 渗透测试必需文件模板（scope/rules/plan/findings/progress）

src-hunter 漏洞挖掘知识库

src-hunter/ 目录包含完整的 SRC/Bug Bounty 漏洞挖掘方法论：

19 类攻击 playbook（IDOR、RCE、XSS、SQLi、SSRF、OAuth、文件上传等）
305 个结构化 payload + 263 个 WAF/EDR 绕过步骤
2887 份 HackerOne 已披露 High/Critical 报告
88,636 条 WooYun 历史案例统计
国产组件指纹和默认凭据
CVSS 4.0 报告模板

使用方式：AI 在 hunt 阶段自动读取对应 playbook，按其流程测试。

详见 src-hunter/SKILL.md 和 src-hunter/references/。

路由上下文

上游入口: skills/SKILL.md（总控）、routing.md 触发条件: 需要主动扫描/攻击目标（端口扫描、漏洞检测、注入测试等） 下游出口:

发现 Web 漏洞需要进一步分析 → js-reverse/
发现二进制漏洞需要逆向 → ida-reverse/ 或 radare2/
需要操作浏览器验证漏洞 → browser-automation/
完成后生成报告 → docs-generator/

同级关联模块: CTF-Sandbox-Orchestrator/（CTF 中的 Web/Pwn 题会用到这些工具）

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

ab-testing

Free

A/B 测试设计与分析时使用。适用于产品实验、功能验证、转化率优化。融合假设驱动 + 样本量计算 + 置信度判断。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

acceptance-testing

Free

上线前业务方/产品方验收时使用。适用于功能交付确认、UAT、发布会签。融合 BDD Given-When-Then、Specification by Example、ATDD。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

accessibility

Free

设计无障碍可访问的界面时使用。适用于满足 WCAG 标准、键盘导航、屏幕阅读器支持。优先使用 WCAG 2.2 AA 级标准 + 键盘 + 焦点 + 对比度 + ARIA。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

accessibility-implementation

Free

实现可访问性（无障碍）时使用。覆盖 WCAG 2.2 AA / ARIA / 键盘导航 / 屏幕阅读器 / 颜色对比 / 焦点管理。融合 React Aria / Radix UI / Headless UI 实践 + axe-core 自动化测试。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

ai-deployment

Free

AI 模型部署时使用。适用于推理服务 / GPU / TensorRT / 监控 / 扩缩容。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

analysis-report

Free

数据分析报告输出时使用。适用于业务分析报告、周报、专项分析、决策支持。融合洞察 + 建议 + 行动项。

The English summary is being prepared. Showing the original description.

zhaoxuya520/AI-Fullstack-Delivery-Workflow53Updated May 19, 2026

See all skills by zhaoxuya520

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/zhaoxuya520/AI-Fullstack-Delivery-Workflow --skill pentest-tools

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/zhaoxuya520/AI-Fullstack-Delivery-Workflow/tree/master/workflows/reverse-pentest/reverse-skill-private/skills/pentest-tools

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/pentest-tools/ for Claude Code, or ~/.agents/skills/pentest-tools/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: zhaoxuya520/AI-Fullstack-Delivery-Workflow
Stars: 53
Forks: 16
Category: Testing & Security
Original language: Chinese
Last updated: May 19, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.