Hydra Penetration Testing Toolkit

🚀 Hydra Project Introduction

Hydra is a platform that connects AI tools with security tools through the Model Context Protocol (MCP), supporting AI-assisted security research, scanning, and analysis.

🚀 Quick Start

Demo - SQLMap

https://github.com/user-attachments/assets/8f7f4185-ca32-4204-a98d-7596e0dedc41

📦 Installation

Build the Docker Image

git clone https://github.com/happyhackingspace/mcp-hydra.git
cd mcp-hydra
docker build -t hydramcp .

💻 Usage Examples

Edit your claude_desktop_config.json file

{
  "mcpServers": {
    "hydramcp": {
      "command": "docker",
      "args": ["run", "--rm", "-i","--name","hydramcp", "hydramcp"]
    }
  }
}

Or use VS Code's Copilot

mkdir -p .vscode
cd .vscode
touch mcp.json

Add the following content to mcp.json:

{
    "servers": {
        "hydramcp": {
            "command": "docker",
            "args": [
                "run",
                "--rm",
                "-i",
                "--net=host",
                "--privileged",
                "--name",
                "hydramcp",
                "hydramcp"
            ]
        }
    }
}

Test Prompt Examples

• Sublist3r

  Use Sublist3rScanner to scan all subdomains of example.com and save the results to the "recon" folder.

• DNSRecon

  Run a DNS reconnaissance scan on example.com using the standard scan type.

• Holehe

  Use HoleheScanner to check if the email address user@example.com is registered on multiple websites.

• Nmap

  Scan the open ports (range 1-1000) of 192.168.1.1.

• OCR

  Use OCRScanner to extract text from the specified screenshot, e.g., /path/to/image.png.

• Sqlmap

  Perform a SQL injection scan on http://testphp.vulnweb.com/listproducts.php?cat=1.

• WPScan

  Scan the vulnerabilities of the WordPress website https://example.com.

• Zmap

  Scan the subnet 192.168.1.0/24 to find devices with port 80 open, with a bandwidth limit of 1M.

📚 Documentation

Changelog

Implemented Tools

• [x] Sublist3r - Domain enumeration tool
• [x] DNSRecon - DNS reconnaissance tool
• [x] Holehe - Email registration check tool
• [x] Nmap - Network scanning tool
• [x] OCR - Optical character recognition tool
• [x] Sqlmap - SQL injection scanning tool
• [x] WPScan - WordPress security scanning tool
• [x] Zmap - Internet scanning tool

Planned Tools

• [ ] gobuster
• [ ] TheHarvester
• [ ] GitRecon
• [ ] Phone carrier query
• [ ] Netcraft
• [ ] Cloudunflare (Claudflare penetration)
• [ ] Censys
• [ ] Programmable tools
• [ ] Intelligence tools

Contribution Guidelines

We welcome contributions from the community! Please refer to the specific instructions in the project repository.

Disclaimer

This project aims to provide a platform for security research. Please comply with relevant laws and regulations before use and ensure that testing is conducted within the scope of legal authorization.