MCP Server Pt

Web Application Penetration Testing MCP is a comprehensive tool focusing on the analysis of business logic security vulnerabilities. Through systematic crawling and analysis, it can identify security issues that standard scanners cannot detect.

Security Developer tools #Penetration testing #Business logic #Security analysis #Automated scanning .Python

rating : 2.5 points

downloads : 15

update time : 2025-04-29

What is Web Application Penetration Testing MCP?

Web Application Penetration Testing MCP is a tool specifically designed to analyze the security of web applications. It can not only detect common vulnerabilities but also thoroughly examine potential risks in business logic.

How to use Web Application Penetration Testing MCP?

You can start the scan through simple command - line operations, generate detailed reports, and visually display the application structure.

Applicable scenarios

Suitable for enterprises or teams that need to conduct regular security reviews, especially in scenarios where business logic security is a concern.

Main features

Automatically build application structure diagramsSystematically crawl and map the entire web application, including all links, forms, and interactive elements.

Intelligent authentication processingAutomatically identify login/logout pages and support authentication based on cookies or Bearer Tokens.

In - depth business logic analysisDetect potential IDOR (Insecure Direct Object Reference) vulnerabilities, permission control issues, and anomalies in multi - step workflows.

Advanced input testingGenerate corresponding test values according to field types and mine sensitive information in hidden fields.

Visualization supportGenerate site maps in DOT format for easy graphical viewing via Graphviz.

Advantages and limitations

Advantages

Comprehensively cover areas not reached by standard scanners

Powerful business logic analysis capabilities

Support multiple authentication mechanisms

Limitations

May require more manual intervention in complex environments

Some advanced features depend on specific configurations

How to use

Install the tool

Clone the project repository and install dependencies in the local environment.

Start the scan

Run the script and specify the target URL to start the scan.

Generate visual charts

Use the Graphviz tool to generate site map images.

Usage examples

Basic scanPerform a basic security scan on a specified website.

Scan with authenticationSimulate the scanning process in a logged - in state.

Visual outputConvert the scan results into an intuitive graphical view.

Frequently Asked Questions

Does it support custom request headers?

Can the scanning speed be adjusted?

How to limit the scanning scope?

Related resources

Official documentation

Detailed introduction to the tool's functions and usage.

GitHub code repository

Source code hosting address.

Example video tutorial

Watch a demonstration video on how to quickly get started with the tool.

🚀 Web Application Penetration Testing MCP

A comprehensive tool for analyzing security vulnerabilities in web applications, with a particular focus on business logic security vulnerabilities. This Master Control Program (MCP) systematically crawls, analyzes, and identifies potential security issues that standard scanners often miss.

🚀 Quick Start

Web Application Penetration Testing MCP helps you understand the business context of web applications. It constructs a complete map of the application's structure and identifies potential security weaknesses, especially vulnerabilities in business logic implementation.

✨ Features

Comprehensive Discovery

Automatically build a tree structure of the entire web application.
Map all links, forms, and interactive elements.
Identify input fields, their types, and expected values.

Authentication Handling

Automatically detect login/logout pages.
Access protected areas using credential authentication.
Support authentication based on Cookies and Bearer Tokens.

Business Logic Analysis

Identify potential Insecure Direct Object Reference (IDOR) vulnerabilities.
Detect mathematical/computational boundary cases.
Map multi-step workflows that may be tampered with.
Discover permission and access control issues.

Advanced Input Analysis

Identify input field types (even if not explicitly defined).
Generate appropriate test values based on field types.
Detect hidden fields that may contain sensitive values.

Visualization Support

Create a visual sitemap in DOT format (viewable via Graphviz).
Highlight complex pages that require more attention.

📦 Installation

# Clone the repository
git clone https://github.com/yourusername/web-app-penetration-testing-mcp.git

# Navigate to the directory
cd web-app-penetration-testing-mcp

# Install dependencies - using uv
pip install -r requirements.txt

💻 Usage Examples

Basic Usage

# Basic usage
python web_app_mcp.py https://example.com

# Scan with authentication
python web_app_mcp.py https://example.com --username user@example.com --password mysecretpassword

# Create a visual sitemap
python web_app_mcp.py https://example.com --visual

# Control crawling speed and depth
python web_app_mcp.py https://example.com --delay 1.0 --max-pages 200

Command-line Arguments

Property	Details
`url`	Target web application URL (required)
`--username`	Username for authenticated scanning
`--password`	Password for authenticated scanning
`--visual`	Generate visual output
`--delay`	Set crawling delay (default: 0.0)
`--max-pages`	Set the maximum number of pages to crawl (default: unlimited)