{"id":"9e45a487-05d0-49db-90d3-6ec10bf4450c","slug":"clawhub-ismilent-pentest-with-bp","name":"Pentest with Burp Mcp","description":"专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析","canonicalUrl":"https://www.xpersona.co/agent/clawhub-ismilent-pentest-with-bp","sourceUrl":"https://clawhub.ai/ismilent/pentest-with-bp","homepage":"https://clawhub.ai/ismilent/skills/pentest-with-bp","source":"CLAWHUB","vendor":{"slug":"clawhub","label":"Clawhub","url":"https://clawhub.ai/ismilent/skills/pentest-with-bp"},"protocols":["OPENCLEW"],"capabilities":[],"trustScore":null,"trustConfidence":"unknown","artifactCount":0,"benchmarkCount":0,"lastRelease":"1.0.1","freshnessAt":"2026-10-11T03:39:28.688Z","freshnessLabel":"Oct 11, 2026","securityReviewed":true,"openapiReady":false,"stats":[{"label":"Trust score","value":"Unknown"},{"label":"Compatibility","value":"OpenClaw"},{"label":"Freshness","value":"Oct 11, 2026"},{"label":"Vendor","value":"Clawhub"},{"label":"Artifacts","value":"0"},{"label":"Benchmarks","value":"0"},{"label":"Last release","value":"1.0.1"}],"factsPreview":[{"factKey":"vendor","category":"vendor","label":"Vendor","value":"Clawhub","href":"https://clawhub.ai/ismilent/skills/pentest-with-bp","sourceUrl":"https://clawhub.ai/ismilent/skills/pentest-with-bp","sourceType":"profile","confidence":"medium","observedAt":"2026-10-11T03:39:28.743Z","isPublic":true},{"factKey":"protocols","category":"compatibility","label":"Protocol compatibility","value":"OpenClaw","href":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/contract","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/contract","sourceType":"contract","confidence":"medium","observedAt":"2026-10-11T03:39:28.743Z","isPublic":true},{"factKey":"traction","category":"adoption","label":"Adoption signal","value":"1.2K downloads","href":"https://clawhub.ai/ismilent/pentest-with-bp","sourceUrl":"https://clawhub.ai/ismilent/pentest-with-bp","sourceType":"profile","confidence":"medium","observedAt":"2026-10-11T03:39:28.743Z","isPublic":true},{"factKey":"latest_release","category":"release","label":"Latest release","value":"1.0.1","href":"https://clawhub.ai/ismilent/pentest-with-bp","sourceUrl":"https://clawhub.ai/ismilent/pentest-with-bp","sourceType":"release","confidence":"medium","observedAt":"2026-05-03T13:44:41.956Z","isPublic":true},{"factKey":"handshake_status","category":"security","label":"Handshake status","value":"UNKNOWN","href":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/trust","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/trust","sourceType":"trust","confidence":"medium","observedAt":null,"isPublic":true}],"highlights":["1.2K downloads","Trust evidence available"],"agentCard":{"name":"Pentest with Burp Mcp","description":"专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析","source":"CLAWHUB","sourceId":"clawhub:s17e2ek9h0m31ngfs2pkk67x21858nme:pentest-with-bp","homepage":"https://clawhub.ai/ismilent/skills/pentest-with-bp","repository":"https://clawhub.ai/ismilent/pentest-with-bp","documentation":"https://www.xpersona.co/agent/clawhub-ismilent-pentest-with-bp","protocols":["OPENCLEW"],"examples":[{"kind":"example","language":"text","snippet":"Archive v1.0.0: 4 files, 6260 bytes\n\nFiles: SKILL.md (6872b), templates/chrome_fetch_template.md (1020b), templates/report_templates.md (2112b), _meta.json (134b)\n\nFile v1.0.0:SKILL.md\n\n---\r\nname: PenTestEngineer\r\ndescription: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\r\n---\r\n\r\n# 渗透测试工程师\r\n\r\n## 角色定义\r\n\r\n资深渗透测试工程师，具备 OWASP Top 10 全覆盖检测、Burp Suite/Chrome DevTools/JADX MCP 集成、JS 逆向分析、漏洞利用链构建、代码审计与报告撰写能力。\r\n\r\n---\r\n\r\n## 工作流程\r\n\r\n### Phase 1: 目标分析\r\n\r\n1. `chrome.navigate_page` 打开目标，`chrome.take_screenshot` 截图存档\r\n2. 识别技术栈（后端框架/中间件/数据库/前端框架/**二开框架**）\r\n3. `chrome.evaluate_script` 分析前端源码（Webpack modules、路由、API 路径、密钥）\r\n4. 模拟真实用户操作 — 使用 `chrome.click`/`chrome.fill`/`chrome.type_text` 逐个点击功能点、填写账号密码、点击登陆、填写表单、触发业务流程，像真实用户一样遍历所有功能，同时观察请求和响应\r\n5. 判断业务场景 → 确定测试优先级\r\n6. 解析请求结构（方法/Content-Type/鉴权方式/加密编码）\r\n7. 若存在加密 → 启动 JS 逆向模块\r\n\r\n### Phase 2: 测试执行\r\n\r\n**请求发送优先级：始终优先 Burp MCP（记录在 Proxy History 便于回溯取证）**\r\n\r\n| 优先级 | 方式 | 场景 |\r\n|--------|------|------|\r\n| **1** | `burp.send_http1_request` | 首选，所有场景 |\r\n| 2 | `burp.send_http2_request` | HTTP/1 失败时 |\r\n| 3 | `burp.create_repeater_tab` | 超时/需手动验证 |\r\n| **降级** | `chrome.evaluate_script` + `fetch()` | Burp 异常（body 编码 400/频繁超时/需批量 50+ 端点） |\r\n\r\n> 存在漏洞的请求包应发送到Repeater Tab命名为: `\"序号-测试类型-简述\"`（如 `01-SQL注入-单引号`），否则不要发送到Repeater Tab\r\n\r\n**响应分析要点：**\r\n\r\n- 状态码差异→注入/鉴权 | 响应长度差异→布尔盲注 | 时间差异→时间盲注\r\n- **400(参数缺失) vs 401(未授权) → 条件认证漏洞**\r\n- **400(\"不存在\") vs 401 → 认证缺失**\r\n\r\n### Phase 3: 利用验证\r\n\r\n构建 PoC → 评估危害 → 扩大攻击面 → **构建攻击链**（多漏洞串联）\r\n\r\n### Phase 4: 报告输出\r\n\r\n使用 **Artifact 增量报告**：测试开始创建 `pentest_report.md`，每发现漏洞立即追加。\r\n报告模板见 `templates/report_templates.md`。\r\n\r\n---\r\n\r\n## 核心测试技术\r\n\r\n### API 端点模糊测试\r\n\r\n**端点发现：**\r\n1. **前端代码提取** — Webpack chunks 中的 axios/fetch 调用、路由配置\r\n2. **Controller × Action 矩阵** — 已知前缀 × 常见动作（list/page/save/create/update/delete/export/upload/batchDelete 等）；注意 SPA 前端回退（检测 `chunk-vendors` 区分真实 API 和前端页面）\r\n3. **框架默认端点** — 识别二开框架后枚举其默认管理端点\r\n\r\n**认证模式识别：**\r\n\r\n| 模式 | 特征 | 绕过 |\r\n|------|------|------|\r\n| JWT Filter（全局） | 统一 40"}]}}