Project Astro

🚀 Automating HTB Penetration Testing with MCP Server

The MCP Server integrates with Claude AI to streamline penetration testing, offering a unified interface for managing multiple security tools.

🚀 Quick Start

The MCP (Machine Collaboration Proxy) Server is an innovative tool designed to enhance the efficiency of penetration testing by integrating with the Claude AI assistant. It provides a unified interface for managing various network security tools and can be operated via API. Key features include:

• Multi-tool Compatibility: Supports over 30 common security tools such as nmap, dirbuster, and wpscan.
• Automated Workflows: Claude AI can automatically generate penetration testing plans and step-by-step suggestions.
• Logging and Auditing: Keeps detailed records of all operations for easy review and analysis.

📦 Installation

System Requirements

• Operating System: Linux (recommended) or Windows
• Memory: At least 2GB RAM
• Disk Space: Over 50GB
• Others: Docker and Python 3.8+ installed

Installation Steps

1. Clone the Repository:

   git clone https://github.com/your-repo/mcp-server.git
   cd mcp-server
   

2. Build the Image (using Docker):

   docker build -t mcp-server .
   

3. Start the Service:

   docker run --name mcp-server -p 8080:8080 -v $(pwd)/config:/app/config mcp-server
   

🛠️ Tool List

The MCP Server integrates multiple penetration testing tools, each with detailed configuration options and usage instructions:

1. nmap: For network scanning and port probing.
2. dirbuster: A website directory enumeration tool.
3. wpscan: A WordPress vulnerability scanner.
4. sqlmap: A SQL injection detection and exploitation tool.
5. hydra: A password brute-force cracking tool.
6. john: A password recovery tool.
7. enum4linux: A Linux system information gathering tool.

📚 Configuration Guide

Tool Installation

• Before starting the MCP Server, ensure that all dependencies are correctly installed.
• Check the version compatibility and path configuration for each tool.

API Usage Instructions

• Access Address: http://localhost:8080/api/v1/
• Authentication Method: API Key authentication
• Supported Verbs: GET, POST, PUT, DELETE

💻 Usage Examples

Basic Usage

Here is a typical HTB penetration testing workflow:

1. Initial Reconnaissance
   • Use Claude to generate an initial reconnaissance plan.
   • Select the "HTB Penetration Testing with MCP Server" scenario.
2. Service Discovery and Enumeration
   • Use nmap to scan the target network and identify open ports and services.
   • Combine with dirbuster for website directory enumeration.
3. Vulnerability Detection
   • For web servers, use wpscan to check for WordPress plugin and theme vulnerabilities.
   • For database services, deploy sqlmap for SQL injection testing.
4. Vulnerability Exploitation
   • Based on Claude's suggestions, select the appropriate exploit tool.
   • Use the Metasploit framework for remote code execution.
5. Post-exploitation Operations
   • After gaining initial access, perform lateral movement and privilege escalation.
   • Deploy C2 (Command and Control) infrastructure.

🔧 Troubleshooting

Common Issues

• Service Startup Failure: Check the log file /app/logs/server.log.
• API Request Error: Confirm the correctness of the API Key and check the network connection.
• Tool Unresponsiveness: Verify the installation path and version of the relevant tool.

Contact Information

• Technical Support Email: support@yourdomain.com
• GitHub Repository: https://github.com/your-repo/mcp-server

📄 License

⚠️ Important Note

Strictly control API access permissions to avoid unauthorized operations.

💡 Usage Tip

Ensure that the test environment is completely isolated from the production environment and regularly review operation logs to monitor abnormal behavior.

By leveraging the powerful features of the MCP Server and the intelligent collaboration of Claude AI, penetration testers can significantly improve work efficiency while reducing the risk of human error.