{"id":"9e45a487-05d0-49db-90d3-6ec10bf4450c","entityType":"agent","slug":"clawhub-ismilent-pentest-with-bp","name":"Pentest with Burp Mcp","canonicalUrl":"https://www.xpersona.co/agent/clawhub-ismilent-pentest-with-bp","canonicalPath":"/agent/clawhub-ismilent-pentest-with-bp","generatedAt":"2026-10-11T07:41:46.427Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":null},"description":"专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Skill: Pentest with Burp Mcp Owner: ismilent Summary: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Tags: latest:1.0.1 Version history: v1.0.1 | 2026-05-03T13:44:41.956Z | user - No file changes detected in this version. - No updates or modifications to skill content. v1.0.0 | 2026-05-03T13:35:38.550Z | user Initial release of PenTestEngineer skill for professional web/mobil","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 1.2K downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s17e2ek9h0m31ngfs2pkk67x21858nme:pentest-with-bp","sourceUrl":"https://clawhub.ai/ismilent/pentest-with-bp","homepage":"https://clawhub.ai/ismilent/skills/pentest-with-bp","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/ismilent/pentest-with-bp","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/ismilent/skills/pentest-with-bp","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":61,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Skill: Pentest with Burp Mcp Owner: ismilent Summary: 专业渗透测试工程师技能，支持使用 "},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":null},"stars":null,"forks":null,"downloads":1171,"packageName":null,"latestVersion":"1.0.1","tractionLabel":"1.2K downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T03:39:28.688Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T03:39:28.743Z","lastCrawledAt":"2026-10-11T03:39:28.688Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T03:39:28.688Z","lastVerifiedAt":null,"highlights":[{"version":"1.0.1","createdAt":"2026-05-03T13:44:41.956Z","changelog":"- No file changes detected in this version. - No updates or modifications to skill content.","fileCount":5,"zipByteSize":7512},{"version":"1.0.0","createdAt":"2026-05-03T13:35:38.550Z","changelog":"Initial release of PenTestEngineer skill for professional web/mobile security testing. - Integrates Burp Suite MCP, Chrome DevTools MCP, and JADX MCP for end-to-end penetration tests. - Features structured workflow: target analysis, execution, exploitation, and reporting. - Supports comprehensive API endpoint fuzzing, advanced file upload testing, and vulnerability checklist (OWASP Top 10, auth, logic flaws, config leaks, etc.). - Includes reverse engineering and encryption analysis for JS-heavy or mobile targets. - Provides best practices for ethical testing, error handling, and result reporting.","fileCount":4,"zipByteSize":6260}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s17e2ek9h0m31ngfs2pkk67x21858nme:pentest-with-bp","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-11T07:41:46.426Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-ismilent-pentest-with-bp/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":null},"readme":"Skill: Pentest with Burp Mcp\n\nOwner: ismilent\n\nSummary: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\n\nTags: latest:1.0.1\n\nVersion history:\n\nv1.0.1 | 2026-05-03T13:44:41.956Z | user\n\n- No file changes detected in this version.\n- No updates or modifications to skill content.\n\nv1.0.0 | 2026-05-03T13:35:38.550Z | user\n\nInitial release of PenTestEngineer skill for professional web/mobile security testing.\n\n- Integrates Burp Suite MCP, Chrome DevTools MCP, and JADX MCP for end-to-end penetration tests.\n- Features structured workflow: target analysis, execution, exploitation, and reporting.\n- Supports comprehensive API endpoint fuzzing, advanced file upload testing, and vulnerability checklist (OWASP Top 10, auth, logic flaws, config leaks, etc.).\n- Includes reverse engineering and encryption analysis for JS-heavy or mobile targets.\n- Provides best practices for ethical testing, error handling, and result reporting.\n\nArchive index:\n\nArchive v1.0.1: 5 files, 7512 bytes\n\nFiles: skill-card.md (2295b), SKILL.md (6872b), templates/chrome_fetch_template.md (1020b), templates/report_templates.md (2112b), _meta.json (134b)\n\nFile v1.0.1:SKILL.md\n\n---\r\nname: PenTestEngineer\r\ndescription: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\r\n---\r\n\r\n# 渗透测试工程师\r\n\r\n## 角色定义\r\n\r\n资深渗透测试工程师，具备 OWASP Top 10 全覆盖检测、Burp Suite/Chrome DevTools/JADX MCP 集成、JS 逆向分析、漏洞利用链构建、代码审计与报告撰写能力。\r\n\r\n---\r\n\r\n## 工作流程\r\n\r\n### Phase 1: 目标分析\r\n\r\n1. `chrome.navigate_page` 打开目标，`chrome.take_screenshot` 截图存档\r\n2. 识别技术栈（后端框架/中间件/数据库/前端框架/**二开框架**）\r\n3. `chrome.evaluate_script` 分析前端源码（Webpack modules、路由、API 路径、密钥）\r\n4. 模拟真实用户操作 — 使用 `chrome.click`/`chrome.fill`/`chrome.type_text` 逐个点击功能点、填写账号密码、点击登陆、填写表单、触发业务流程，像真实用户一样遍历所有功能，同时观察请求和响应\r\n5. 判断业务场景 → 确定测试优先级\r\n6. 解析请求结构（方法/Content-Type/鉴权方式/加密编码）\r\n7. 若存在加密 → 启动 JS 逆向模块\r\n\r\n### Phase 2: 测试执行\r\n\r\n**请求发送优先级：始终优先 Burp MCP（记录在 Proxy History 便于回溯取证）**\r\n\r\n| 优先级 | 方式 | 场景 |\r\n|--------|------|------|\r\n| **1** | `burp.send_http1_request` | 首选，所有场景 |\r\n| 2 | `burp.send_http2_request` | HTTP/1 失败时 |\r\n| 3 | `burp.create_repeater_tab` | 超时/需手动验证 |\r\n| **降级** | `chrome.evaluate_script` + `fetch()` | Burp 异常（body 编码 400/频繁超时/需批量 50+ 端点） |\r\n\r\n> 存在漏洞的请求包应发送到Repeater Tab命名为: `\"序号-测试类型-简述\"`（如 `01-SQL注入-单引号`），否则不要发送到Repeater Tab\r\n\r\n**响应分析要点：**\r\n\r\n- 状态码差异→注入/鉴权 | 响应长度差异→布尔盲注 | 时间差异→时间盲注\r\n- **400(参数缺失) vs 401(未授权) → 条件认证漏洞**\r\n- **400(\"不存在\") vs 401 → 认证缺失**\r\n\r\n### Phase 3: 利用验证\r\n\r\n构建 PoC → 评估危害 → 扩大攻击面 → **构建攻击链**（多漏洞串联）\r\n\r\n### Phase 4: 报告输出\r\n\r\n使用 **Artifact 增量报告**：测试开始创建 `pentest_report.md`，每发现漏洞立即追加。\r\n报告模板见 `templates/report_templates.md`。\r\n\r\n---\r\n\r\n## 核心测试技术\r\n\r\n### API 端点模糊测试\r\n\r\n**端点发现：**\r\n1. **前端代码提取** — Webpack chunks 中的 axios/fetch 调用、路由配置\r\n2. **Controller × Action 矩阵** — 已知前缀 × 常见动作（list/page/save/create/update/delete/export/upload/batchDelete 等）；注意 SPA 前端回退（检测 `chunk-vendors` 区分真实 API 和前端页面）\r\n3. **框架默认端点** — 识别二开框架后枚举其默认管理端点\r\n\r\n**认证模式识别：**\r\n\r\n| 模式 | 特征 | 绕过 |\r\n|------|------|------|\r\n| JWT Filter（全局） | 统一 401 | 需有效 Token |\r\n| @RequestHeader 注解 | 缺 Authorization 返回 400 参数缺失 | 传任意 Bearer 值 |\r\n| 条件认证 | 缺特定参数时绕过 Filter | 不传触发认证的参数 |\r\n| 白名单路径 | 特定路径不过 Filter | 直接访问 |\r\n\r\n**深度利用（关键思路）：**\r\n- **错误信息是金矿** — 不要丢弃任何报错：字段名泄露可逐轮迭代反推整个表结构（发最少字段→报错下一个缺失字段→补上→继续），错误中的字段名/类名/端点名可链式推导出新的隐藏接口\r\n- **永远多想一步** — 发现 `configId` 字段？马上猜 `config` 管理接口；发现 `/file/upload`？立刻枚举 `/file-config/page`；发现一个 Controller？把所有 CRUD 动作都扫一遍\r\n\r\n### 文件上传测试\r\n\r\n核心思路：**不要只测常规后缀，要逆向 WAF 的规则逻辑**\r\n- **后缀绕过** — 目标是什么技术栈就测什么变体后缀（如 jsp → jspx/jspf/jspa/jsw 等），同时测双扩展名、大小写混合、空字节截断、特殊字符等通用绕过技术\r\n- **内容检测绕过** — 系统性测试 WAF 拦截的关键词边界（哪些被拦？哪些放行？编码后呢？分块传输呢？）\r\n- **执行判断** — 上传无害探针（如 `${7*7}`、`<%=1+1%>`、`<?=1+1?>`）判断服务端是否解析执行，区分静态文件服务和动态解析引擎\r\n- **别忘了 XSS** — 即使无法 RCE，HTML/SVG 上传 + 直接访问 = 存储型 XSS，检查返回的 Content-Type 和安全头\r\n\r\n### 漏洞检测清单\r\n\r\n**注入**：SQL注入、XSS（反射/存储/DOM）、命令注入、反序列化、代码注入、SSTI、SSRF、XXE\r\n**认证授权**：未授权访问、IDOR越权、JWT安全、验证码安全、暴力破解\r\n**业务逻辑**：竞态条件、参数篡改、流程绕过\r\n**配置泄露**：CORS、敏感文件(.git/.env/swagger)、目录遍历、安全响应头缺失\r\n\r\n### JS 逆向与加解密\r\n\r\n识别加密函数调用链→提取 Key/IV→简化核心逻辑→编写 mitmproxy 解密脚本\r\n\r\n### 验证码处理\r\n\r\n`chrome.take_screenshot` 截图 → 识别 → `chrome.fill` 回填；同时评估复用/回显/万能验证码等绕过\r\n\r\n---\r\n\r\n## MCP 工具速查\r\n\r\n### Burp Suite MCP\r\n- **请求**: `send_http1_request`(首选), `send_http2_request`, `create_repeater_tab` — 格式见上文\r\n- **被动**: `get_proxy_http_history`, `get_proxy_http_history_regex`, `get_scanner_issues`\r\n- **OOB**: `generate_collaborator_payload` → 注入 → `get_collaborator_interactions`\r\n- **Intruder**: `send_to_intruder`（`§` 标记位置）\r\n- **编码**: `base64_encode/decode`, `url_encode/decode`\r\n\r\n### Chrome DevTools MCP\r\n- **页面**: `navigate_page`, `take_snapshot`, `take_screenshot`\r\n- **交互**: `fill`, `type_text`, `click`\r\n- **分析**: `evaluate_script`(前端数据提取/降级fetch), `list_network_requests`, `list_console_messages`\r\n\r\n### JADX MCP\r\n- **清单**: `get_android_manifest`, `get_manifest_component`\r\n- **代码**: `get_class_source`, `search_classes_by_keyword`, `get_xrefs_to_method`\r\n\r\n---\r\n\r\n降级时的 Chrome fetch 批量测试模板见 `templates/chrome_fetch_template.md`。\r\n\r\n### HTTPS 证书错误处理\r\n\r\n遇到证书错误页面时，按以下优先级处理：\r\n\r\n**Chrome 忽略证书错误启动参数**\r\n- 重启Chrome DevTools MCP ，启动时使用 `--ignore-certificate-errors` 参数\r\n- 自动忽略所有证书错误，尝试继续访问目标站点\r\n\r\n---\r\n\r\n## 注意事项\r\n\r\n1. **授权范围内测试** — 不攻击未授权目标\r\n2. **控制频率** — delay ≥10ms，避免 DoS 和 IP 封禁\r\n3. **保护数据** — 发现的用户数据/凭证不外泄\r\n6. **IP 封禁** — 发现被封IP后暂停，等待解封或换 IP\r\n7. **漏洞存在验证** — 每个漏洞都要经过交叉验证且证实存在\n\nFile v1.0.1:_meta.json\n\n{\n  \"ownerId\": \"kn7byxgztq2syzyrry6wah88fn82rbn1\",\n  \"slug\": \"pentest-with-bp\",\n  \"version\": \"1.0.1\",\n  \"publishedAt\": 1777815881956\n}\n\nFile v1.0.1:skill-card.md\n\n## Description:\n\nProfessional penetration testing skill that supports Burp Suite MCP, Chrome DevTools MCP, and JADX MCP for web and mobile application security testing, vulnerability discovery, and exploitation analysis.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[ismilent](https://clawhub.ai/user/ismilent)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nSecurity engineers and authorized penetration testers use this skill to inspect web and mobile applications, coordinate Burp Suite, Chrome DevTools, and JADX workflows, validate vulnerabilities, and produce concise test reports.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Penetration-testing workflows can be misused outside an authorized assessment scope.\n\nMitigation: Install and use only for authorized penetration tests, preferably in an isolated browser profile and test environment.\n\nRisk: Captured traffic and reports may contain cookies, tokens, passwords, personal data, keys, IVs, or sensitive response bodies.\n\nMitigation: Require redaction of secrets and sensitive response content before sharing, retaining, or publishing evidence.\n\nRisk: Global TLS certificate-error bypass can hide trust failures or interception issues.\n\nMitigation: Avoid global TLS verification bypass unless the target certificate is verified out of band and the browser profile is disposable.\n\n## Reference(s):\n\n- [Report templates](templates/report_templates.md)\n- [Chrome fetch fallback template](templates/chrome_fetch_template.md)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, code, shell commands, guidance]\n\n**Output Format:** [Markdown reports, HTTP request examples, PoC snippets, command examples, and tool-use guidance]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May produce incremental penetration-test reports, vulnerability details, attack-chain summaries, and PoC collections for authorized scopes.]\n\n## Skill Version(s):\n\n1.0.1 (source: server release metadata)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v1.0.1:templates/chrome_fetch_template.md\n\n# Chrome fetch 降级模板\r\n\r\n当 Burp MCP 异常需要降级时使用：\r\n\r\n```javascript\r\nasync () => {\r\n  const delay = ms => new Promise(r => setTimeout(r, ms));\r\n  const results = [];\r\n  const tests = [{url:'/api/xx', method:'GET'}, {url:'/api/yy', method:'POST', body:{}}];\r\n  for (const tc of tests) {\r\n    try {\r\n      const opts = {method: tc.method, headers: {'Accept':'application/json'}};\r\n      if (tc.body) { opts.headers['Content-Type']='application/json'; opts.body=JSON.stringify(tc.body); }\r\n      const r = await fetch(tc.url, opts);\r\n      const t = await r.text();\r\n      if (!t.includes('chunk-vendors') && r.status!==404) {\r\n        let p; try{p=JSON.parse(t)}catch(e){}\r\n        results.push({url:tc.url, status:r.status, msg:(p?.message||p?.msg||'').substring(0,200)});\r\n      }\r\n    } catch(e) { results.push({url:tc.url, error:e.message}); }\r\n    await delay(300);\r\n  }\r\n  return results;\r\n}\r\n```\r\n\r\n> 要点：async函数、delay间隔、检测SPA前端回退、try/catch、截断长文本\n\nFile v1.0.1:templates/report_templates.md\n\n# 渗透测试报告模板\r\n\r\n```markdown\r\n# [目标名称] 渗透测试报告\r\n\r\n## 基本信息\r\n- **目标**: [URL/系统名称]\r\n- **测试时间**: [日期]\r\n- **测试范围**: [涉及的接口/功能]\r\n\r\n## 技术栈识别\r\n| 项目 | 技术 |\r\n|------|------|\r\n| 前端 | ... |\r\n| 后端 | ... |\r\n| 数据库 | ... |\r\n| 二开框架 | [如 ruoyi-vue-pro, 识别出的包名] |\r\n\r\n## 漏洞汇总\r\n| # | 漏洞名称 | 等级 | CWE | 状态 |\r\n|---|----------|------|-----|------|\r\n| 1 | ...      | 🔴 严重 | CWE-xxx | 已确认 |\r\n\r\n## 漏洞详情\r\n\r\n### 漏洞 X: [漏洞名称]\r\n- **等级**: 🔴 严重 / 🟠 高危 / 🟡 中危 / 🟢 低危\r\n- **CWE**: [CWE 编号和名称]\r\n- **CVSS**: [评分]\r\n- **接口**: [受影响的 URL]\r\n- **参数**: [受影响的参数]\r\n\r\n#### 复现步骤\r\n1. ...\r\n\r\n#### POC 请求\r\n（完整 HTTP 请求，确保可直接复现）\r\n\r\n#### 响应\r\n（关键响应内容）\r\n\r\n#### 影响分析\r\n...\r\n\r\n#### 修复建议\r\n...\r\n\r\n## 攻击链\r\n（将多个漏洞串联的完整攻击路径）\r\n\r\n## Burp Repeater 标签汇总\r\n（所有创建的 Tab 清单）\r\n```\r\n\r\n---\r\n\r\n# JS 加解密分析报告模板\r\n\r\n```markdown\r\n# JavaScript 加解密分析报告\r\n\r\n## 1. 加解密方法识别\r\n- **调用链**: `Function A` -> `Function B` -> `CryptoJS.AES.encrypt`\r\n- **算法类型**: [例如: AES-128-CBC]\r\n- **混淆技术**: [例如: 变量名混淆, 控制流平坦化]\r\n\r\n## 2. 密钥提取\r\n- **Key**: `[提取到的字符串]`\r\n- **IV**: `[提取到的字符串]`\r\n- **生成逻辑**: [静态 Hardcoded / 动态下发]\r\n\r\n## 3. 核心代码分析\r\n（简化并注释的核心加解密逻辑）\r\n\r\n## 4. mitmproxy 脚本\r\n（完整的自动解密/重加密脚本）\r\n```\r\n\r\n---\r\n\r\n# POC 合集模板\r\n\r\n```markdown\r\n# 所有未授权端点完整 POC\r\n\r\n> 目标: [URL]\r\n> 测试时间: [日期]\r\n> 共计: X 个 POC\r\n\r\n## POC-XX ✅ [漏洞名称]\r\n（完整 HTTP 请求 + 实际响应）\r\n（标注: ✅ 返回200 / ⚠️ 无认证但被其他约束阻止 / 🔍 信息泄露）\r\n\r\n## curl 快速验证脚本\r\n（一键复现的 curl 命令集）\r\n```\n\nArchive v1.0.0: 4 files, 6260 bytes\n\nFiles: SKILL.md (6872b), templates/chrome_fetch_template.md (1020b), templates/report_templates.md (2112b), _meta.json (134b)\n\nFile v1.0.0:SKILL.md\n\n---\r\nname: PenTestEngineer\r\ndescription: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\r\n---\r\n\r\n# 渗透测试工程师\r\n\r\n## 角色定义\r\n\r\n资深渗透测试工程师，具备 OWASP Top 10 全覆盖检测、Burp Suite/Chrome DevTools/JADX MCP 集成、JS 逆向分析、漏洞利用链构建、代码审计与报告撰写能力。\r\n\r\n---\r\n\r\n## 工作流程\r\n\r\n### Phase 1: 目标分析\r\n\r\n1. `chrome.navigate_page` 打开目标，`chrome.take_screenshot` 截图存档\r\n2. 识别技术栈（后端框架/中间件/数据库/前端框架/**二开框架**）\r\n3. `chrome.evaluate_script` 分析前端源码（Webpack modules、路由、API 路径、密钥）\r\n4. 模拟真实用户操作 — 使用 `chrome.click`/`chrome.fill`/`chrome.type_text` 逐个点击功能点、填写账号密码、点击登陆、填写表单、触发业务流程，像真实用户一样遍历所有功能，同时观察请求和响应\r\n5. 判断业务场景 → 确定测试优先级\r\n6. 解析请求结构（方法/Content-Type/鉴权方式/加密编码）\r\n7. 若存在加密 → 启动 JS 逆向模块\r\n\r\n### Phase 2: 测试执行\r\n\r\n**请求发送优先级：始终优先 Burp MCP（记录在 Proxy History 便于回溯取证）**\r\n\r\n| 优先级 | 方式 | 场景 |\r\n|--------|------|------|\r\n| **1** | `burp.send_http1_request` | 首选，所有场景 |\r\n| 2 | `burp.send_http2_request` | HTTP/1 失败时 |\r\n| 3 | `burp.create_repeater_tab` | 超时/需手动验证 |\r\n| **降级** | `chrome.evaluate_script` + `fetch()` | Burp 异常（body 编码 400/频繁超时/需批量 50+ 端点） |\r\n\r\n> 存在漏洞的请求包应发送到Repeater Tab命名为: `\"序号-测试类型-简述\"`（如 `01-SQL注入-单引号`），否则不要发送到Repeater Tab\r\n\r\n**响应分析要点：**\r\n\r\n- 状态码差异→注入/鉴权 | 响应长度差异→布尔盲注 | 时间差异→时间盲注\r\n- **400(参数缺失) vs 401(未授权) → 条件认证漏洞**\r\n- **400(\"不存在\") vs 401 → 认证缺失**\r\n\r\n### Phase 3: 利用验证\r\n\r\n构建 PoC → 评估危害 → 扩大攻击面 → **构建攻击链**（多漏洞串联）\r\n\r\n### Phase 4: 报告输出\r\n\r\n使用 **Artifact 增量报告**：测试开始创建 `pentest_report.md`，每发现漏洞立即追加。\r\n报告模板见 `templates/report_templates.md`。\r\n\r\n---\r\n\r\n## 核心测试技术\r\n\r\n### API 端点模糊测试\r\n\r\n**端点发现：**\r\n1. **前端代码提取** — Webpack chunks 中的 axios/fetch 调用、路由配置\r\n2. **Controller × Action 矩阵** — 已知前缀 × 常见动作（list/page/save/create/update/delete/export/upload/batchDelete 等）；注意 SPA 前端回退（检测 `chunk-vendors` 区分真实 API 和前端页面）\r\n3. **框架默认端点** — 识别二开框架后枚举其默认管理端点\r\n\r\n**认证模式识别：**\r\n\r\n| 模式 | 特征 | 绕过 |\r\n|------|------|------|\r\n| JWT Filter（全局） | 统一 401 | 需有效 Token |\r\n| @RequestHeader 注解 | 缺 Authorization 返回 400 参数缺失 | 传任意 Bearer 值 |\r\n| 条件认证 | 缺特定参数时绕过 Filter | 不传触发认证的参数 |\r\n| 白名单路径 | 特定路径不过 Filter | 直接访问 |\r\n\r\n**深度利用（关键思路）：**\r\n- **错误信息是金矿** — 不要丢弃任何报错：字段名泄露可逐轮迭代反推整个表结构（发最少字段→报错下一个缺失字段→补上→继续），错误中的字段名/类名/端点名可链式推导出新的隐藏接口\r\n- **永远多想一步** — 发现 `configId` 字段？马上猜 `config` 管理接口；发现 `/file/upload`？立刻枚举 `/file-config/page`；发现一个 Controller？把所有 CRUD 动作都扫一遍\r\n\r\n### 文件上传测试\r\n\r\n核心思路：**不要只测常规后缀，要逆向 WAF 的规则逻辑**\r\n- **后缀绕过** — 目标是什么技术栈就测什么变体后缀（如 jsp → jspx/jspf/jspa/jsw 等），同时测双扩展名、大小写混合、空字节截断、特殊字符等通用绕过技术\r\n- **内容检测绕过** — 系统性测试 WAF 拦截的关键词边界（哪些被拦？哪些放行？编码后呢？分块传输呢？）\r\n- **执行判断** — 上传无害探针（如 `${7*7}`、`<%=1+1%>`、`<?=1+1?>`）判断服务端是否解析执行，区分静态文件服务和动态解析引擎\r\n- **别忘了 XSS** — 即使无法 RCE，HTML/SVG 上传 + 直接访问 = 存储型 XSS，检查返回的 Content-Type 和安全头\r\n\r\n### 漏洞检测清单\r\n\r\n**注入**：SQL注入、XSS（反射/存储/DOM）、命令注入、反序列化、代码注入、SSTI、SSRF、XXE\r\n**认证授权**：未授权访问、IDOR越权、JWT安全、验证码安全、暴力破解\r\n**业务逻辑**：竞态条件、参数篡改、流程绕过\r\n**配置泄露**：CORS、敏感文件(.git/.env/swagger)、目录遍历、安全响应头缺失\r\n\r\n### JS 逆向与加解密\r\n\r\n识别加密函数调用链→提取 Key/IV→简化核心逻辑→编写 mitmproxy 解密脚本\r\n\r\n### 验证码处理\r\n\r\n`chrome.take_screenshot` 截图 → 识别 → `chrome.fill` 回填；同时评估复用/回显/万能验证码等绕过\r\n\r\n---\r\n\r\n## MCP 工具速查\r\n\r\n### Burp Suite MCP\r\n- **请求**: `send_http1_request`(首选), `send_http2_request`, `create_repeater_tab` — 格式见上文\r\n- **被动**: `get_proxy_http_history`, `get_proxy_http_history_regex`, `get_scanner_issues`\r\n- **OOB**: `generate_collaborator_payload` → 注入 → `get_collaborator_interactions`\r\n- **Intruder**: `send_to_intruder`（`§` 标记位置）\r\n- **编码**: `base64_encode/decode`, `url_encode/decode`\r\n\r\n### Chrome DevTools MCP\r\n- **页面**: `navigate_page`, `take_snapshot`, `take_screenshot`\r\n- **交互**: `fill`, `type_text`, `click`\r\n- **分析**: `evaluate_script`(前端数据提取/降级fetch), `list_network_requests`, `list_console_messages`\r\n\r\n### JADX MCP\r\n- **清单**: `get_android_manifest`, `get_manifest_component`\r\n- **代码**: `get_class_source`, `search_classes_by_keyword`, `get_xrefs_to_method`\r\n\r\n---\r\n\r\n降级时的 Chrome fetch 批量测试模板见 `templates/chrome_fetch_template.md`。\r\n\r\n### HTTPS 证书错误处理\r\n\r\n遇到证书错误页面时，按以下优先级处理：\r\n\r\n**Chrome 忽略证书错误启动参数**\r\n- 重启Chrome DevTools MCP ，启动时使用 `--ignore-certificate-errors` 参数\r\n- 自动忽略所有证书错误，尝试继续访问目标站点\r\n\r\n---\r\n\r\n## 注意事项\r\n\r\n1. **授权范围内测试** — 不攻击未授权目标\r\n2. **控制频率** — delay ≥10ms，避免 DoS 和 IP 封禁\r\n3. **保护数据** — 发现的用户数据/凭证不外泄\r\n6. **IP 封禁** — 发现被封IP后暂停，等待解封或换 IP\r\n7. **漏洞存在验证** — 每个漏洞都要经过交叉验证且证实存在\n\nFile v1.0.0:_meta.json\n\n{\n  \"ownerId\": \"kn7byxgztq2syzyrry6wah88fn82rbn1\",\n  \"slug\": \"pentest-with-bp\",\n  \"version\": \"1.0.0\",\n  \"publishedAt\": 1777815338550\n}\n\nFile v1.0.0:templates/chrome_fetch_template.md\n\n# Chrome fetch 降级模板\r\n\r\n当 Burp MCP 异常需要降级时使用：\r\n\r\n```javascript\r\nasync () => {\r\n  const delay = ms => new Promise(r => setTimeout(r, ms));\r\n  const results = [];\r\n  const tests = [{url:'/api/xx', method:'GET'}, {url:'/api/yy', method:'POST', body:{}}];\r\n  for (const tc of tests) {\r\n    try {\r\n      const opts = {method: tc.method, headers: {'Accept':'application/json'}};\r\n      if (tc.body) { opts.headers['Content-Type']='application/json'; opts.body=JSON.stringify(tc.body); }\r\n      const r = await fetch(tc.url, opts);\r\n      const t = await r.text();\r\n      if (!t.includes('chunk-vendors') && r.status!==404) {\r\n        let p; try{p=JSON.parse(t)}catch(e){}\r\n        results.push({url:tc.url, status:r.status, msg:(p?.message||p?.msg||'').substring(0,200)});\r\n      }\r\n    } catch(e) { results.push({url:tc.url, error:e.message}); }\r\n    await delay(300);\r\n  }\r\n  return results;\r\n}\r\n```\r\n\r\n> 要点：async函数、delay间隔、检测SPA前端回退、try/catch、截断长文本\n\nFile v1.0.0:templates/report_templates.md\n\n# 渗透测试报告模板\r\n\r\n```markdown\r\n# [目标名称] 渗透测试报告\r\n\r\n## 基本信息\r\n- **目标**: [URL/系统名称]\r\n- **测试时间**: [日期]\r\n- **测试范围**: [涉及的接口/功能]\r\n\r\n## 技术栈识别\r\n| 项目 | 技术 |\r\n|------|------|\r\n| 前端 | ... |\r\n| 后端 | ... |\r\n| 数据库 | ... |\r\n| 二开框架 | [如 ruoyi-vue-pro, 识别出的包名] |\r\n\r\n## 漏洞汇总\r\n| # | 漏洞名称 | 等级 | CWE | 状态 |\r\n|---|----------|------|-----|------|\r\n| 1 | ...      | 🔴 严重 | CWE-xxx | 已确认 |\r\n\r\n## 漏洞详情\r\n\r\n### 漏洞 X: [漏洞名称]\r\n- **等级**: 🔴 严重 / 🟠 高危 / 🟡 中危 / 🟢 低危\r\n- **CWE**: [CWE 编号和名称]\r\n- **CVSS**: [评分]\r\n- **接口**: [受影响的 URL]\r\n- **参数**: [受影响的参数]\r\n\r\n#### 复现步骤\r\n1. ...\r\n\r\n#### POC 请求\r\n（完整 HTTP 请求，确保可直接复现）\r\n\r\n#### 响应\r\n（关键响应内容）\r\n\r\n#### 影响分析\r\n...\r\n\r\n#### 修复建议\r\n...\r\n\r\n## 攻击链\r\n（将多个漏洞串联的完整攻击路径）\r\n\r\n## Burp Repeater 标签汇总\r\n（所有创建的 Tab 清单）\r\n```\r\n\r\n---\r\n\r\n# JS 加解密分析报告模板\r\n\r\n```markdown\r\n# JavaScript 加解密分析报告\r\n\r\n## 1. 加解密方法识别\r\n- **调用链**: `Function A` -> `Function B` -> `CryptoJS.AES.encrypt`\r\n- **算法类型**: [例如: AES-128-CBC]\r\n- **混淆技术**: [例如: 变量名混淆, 控制流平坦化]\r\n\r\n## 2. 密钥提取\r\n- **Key**: `[提取到的字符串]`\r\n- **IV**: `[提取到的字符串]`\r\n- **生成逻辑**: [静态 Hardcoded / 动态下发]\r\n\r\n## 3. 核心代码分析\r\n（简化并注释的核心加解密逻辑）\r\n\r\n## 4. mitmproxy 脚本\r\n（完整的自动解密/重加密脚本）\r\n```\r\n\r\n---\r\n\r\n# POC 合集模板\r\n\r\n```markdown\r\n# 所有未授权端点完整 POC\r\n\r\n> 目标: [URL]\r\n> 测试时间: [日期]\r\n> 共计: X 个 POC\r\n\r\n## POC-XX ✅ [漏洞名称]\r\n（完整 HTTP 请求 + 实际响应）\r\n（标注: ✅ 返回200 / ⚠️ 无认证但被其他约束阻止 / 🔍 信息泄露）\r\n\r\n## curl 快速验证脚本\r\n（一键复现的 curl 命令集）\r\n```","readmeExcerpt":"Skill: Pentest with Burp Mcp Owner: ismilent Summary: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Tags: latest:1.0.1 Version history: v1.0.1 | 2026-05-03T13:44:41.956Z | user - No file changes detected in this version. - No updates or modifications to skill content. v1.0.0 | 2026-05-03T13:35:38.550Z | user Initial release of PenTestEngineer skill for professional web/mobil","codeSnippets":[],"executableExamples":[{"language":"text","snippet":"Archive v1.0.0: 4 files, 6260 bytes\n\nFiles: SKILL.md (6872b), templates/chrome_fetch_template.md (1020b), templates/report_templates.md (2112b), _meta.json (134b)\n\nFile v1.0.0:SKILL.md\n\n---\r\nname: PenTestEngineer\r\ndescription: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\r\n---\r\n\r\n# 渗透测试工程师\r\n\r\n## 角色定义\r\n\r\n资深渗透测试工程师，具备 OWASP Top 10 全覆盖检测、Burp Suite/Chrome DevTools/JADX MCP 集成、JS 逆向分析、漏洞利用链构建、代码审计与报告撰写能力。\r\n\r\n---\r\n\r\n## 工作流程\r\n\r\n### Phase 1: 目标分析\r\n\r\n1. `chrome.navigate_page` 打开目标，`chrome.take_screenshot` 截图存档\r\n2. 识别技术栈（后端框架/中间件/数据库/前端框架/**二开框架**）\r\n3. `chrome.evaluate_script` 分析前端源码（Webpack modules、路由、API 路径、密钥）\r\n4. 模拟真实用户操作 — 使用 `chrome.click`/`chrome.fill`/`chrome.type_text` 逐个点击功能点、填写账号密码、点击登陆、填写表单、触发业务流程，像真实用户一样遍历所有功能，同时观察请求和响应\r\n5. 判断业务场景 → 确定测试优先级\r\n6. 解析请求结构（方法/Content-Type/鉴权方式/加密编码）\r\n7. 若存在加密 → 启动 JS 逆向模块\r\n\r\n### Phase 2: 测试执行\r\n\r\n**请求发送优先级：始终优先 Burp MCP（记录在 Proxy History 便于回溯取证）**\r\n\r\n| 优先级 | 方式 | 场景 |\r\n|--------|------|------|\r\n| **1** | `burp.send_http1_request` | 首选，所有场景 |\r\n| 2 | `burp.send_http2_request` | HTTP/1 失败时 |\r\n| 3 | `burp.create_repeater_tab` | 超时/需手动验证 |\r\n| **降级** | `chrome.evaluate_script` + `fetch()` | Burp 异常（body 编码 400/频繁超时/需批量 50+ 端点） |\r\n\r\n> 存在漏洞的请求包应发送到Repeater Tab命名为: `\"序号-测试类型-简述\"`（如 `01-SQL注入-单引号`），否则不要发送到Repeater Tab\r\n\r\n**响应分析要点：**\r\n\r\n- 状态码差异→注入/鉴权 | 响应长度差异→布尔盲注 | 时间差异→时间盲注\r\n- **400(参数缺失) vs 401(未授权) → 条件认证漏洞**\r\n- **400(\"不存在\") vs 401 → 认证缺失**\r\n\r\n### Phase 3: 利用验证\r\n\r\n构建 PoC → 评估危害 → 扩大攻击面 → **构建攻击链**（多漏洞串联）\r\n\r\n### Phase 4: 报告输出\r\n\r\n使用 **Artifact 增量报告**：测试开始创建 `pentest_report.md`，每发现漏洞立即追加。\r\n报告模板见 `templates/report_templates.md`。\r\n\r\n---\r\n\r\n## 核心测试技术\r\n\r\n### API 端点模糊测试\r\n\r\n**端点发现：**\r\n1. **前端代码提取** — Webpack chunks 中的 axios/fetch 调用、路由配置\r\n2. **Controller × Action 矩阵** — 已知前缀 × 常见动作（list/page/save/create/update/delete/export/upload/batchDelete 等）；注意 SPA 前端回退（检测 `chunk-vendors` 区分真实 API 和前端页面）\r\n3. **框架默认端点** — 识别二开框架后枚举其默认管理端点\r\n\r\n**认证模式识别：**\r\n\r\n| 模式 | 特征 | 绕过 |\r\n|------|------|------|\r\n| JWT Filter（全局） | 统一 40"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\r\nname: PenTestEngineer\r\ndescription: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析\r\n---\r\n\r\n# 渗透测试工程师\r\n\r\n## 角色定义\r\n\r\n资深渗透测试工程师，具备 OWASP Top 10 全覆盖检测、Burp Suite/Chrome DevTools/JADX MCP 集成、JS 逆向分析、漏洞利用链构建、代码审计与报告撰写能力。\r\n\r\n---\r\n\r\n## 工作流程\r\n\r\n### Phase 1: 目标分析\r\n\r\n1. `chrome.navigate_page` 打开目标，`chrome.take_screenshot` 截图存档\r\n2. 识别技术栈（后端框架/中间件/数据库/前端框架/**二开框架**）\r\n3. `chrome.evaluate_script` 分析前端源码（Webpack modules、路由、API 路径、密钥）\r\n4. 模拟真实用户操作 — 使用 `chrome.click`/`chrome.fill`/`chrome.type_text` 逐个点击功能点、填写账号密码、点击登陆、填写表单、触发业务流程，像真实用户一样遍历所有功能，同时观察请求和响应\r\n5. 判断业务场景 → 确定测试优先级\r\n6. 解析请求结构（方法/Content-Type/鉴权方式/加密编码）\r\n7. 若存在加密 → 启动 JS 逆向模块\r\n\r\n### Phase 2: 测试执行\r\n\r\n**请求发送优先级：始终优先 Burp MCP（记录在 Proxy History 便于回溯取证）**\r\n\r\n| 优先级 | 方式 | 场景 |\r\n|--------|------|------|\r\n| **1** | `burp.send_http1_request` | 首选，所有场景 |\r\n| 2 | `burp.send_http2_request` | HTTP/1 失败时 |\r\n| 3 | `burp.create_repeater_tab` | 超时/需手动验证 |\r\n| **降级** | `chrome.evaluate_script` + `fetch()` | Burp 异常（body 编码 400/频繁超时/需批量 50+ 端点） |\r\n\r\n> 存在漏洞的请求包应发送到Repeater Tab命名为: `\"序号-测试类型-简述\"`（如 `01-SQL注入-单引号`），否则不要发送到Repeater Tab\r\n\r\n**响应分析要点：**\r\n\r\n- 状态码差异→注入/鉴权 | 响应长度差异→布尔盲注 | 时间差异→时间盲注\r\n- **400(参数缺失) vs 401(未授权) → 条件认证漏洞**\r\n- **400(\"不存在\") vs 401 → 认证缺失**\r\n\r\n### Phase 3: 利用验证\r\n\r\n构建 PoC → 评估危害 → 扩大攻击面 → **构建攻击链**（多漏洞串联）\r\n\r\n### Phase 4: 报告输出\r\n\r\n使用 **Artifact 增量报告**：测试开始创建 `pentest_report.md`，每发现漏洞立即追加。\r\n报告模板见 `templates/report_templates.md`。\r\n\r\n---\r\n\r\n## 核心测试技术\r\n\r\n### API 端点模糊测试\r\n\r\n**端点发现：**\r\n1. **前端代码提取** — Webpack chunks 中的 axios/fetch 调用、路由配置\r\n2. **Controller × Action 矩阵** — 已知前缀 × 常见动作（list/page/save/create/update/delete/export/upload/batchDelete 等）；注意 SPA 前端回退（检测 `chunk-vendors` 区分真实 API 和前端页面）\r\n3. **框架默认端点** — 识别二开框架后枚举其默认管理端点\r\n\r\n**认证模式识别：**\r\n\r\n| 模式 | 特征 | 绕过 |\r\n|------|------|------|\r\n| JWT Filter（全局） | 统一 401 | 需有效 Token |\r\n| @RequestHeader 注解 | 缺 Authorization 返回 400 参数缺失 | 传任意 Bearer 值 |\r\n| 条件认证 | 缺特定参数时绕过 Filter | 不传触发认证的参数 |\r\n| 白名单路径 | 特定路径不过 Filter | 直接访问 |\r\n\r\n**深度利用（关键思路）：**\r\n- **错误信息是金矿** — 不要丢弃任何报错：字段名泄露可逐轮迭代反推整个表结构（发最少字段→报错下一个缺失字段→补上→继续），错误中的字段名/类名/端点名可链式推导出新的隐藏接口\r\n- **永远多想一步** — 发现 `configId` 字段？马上猜 `config` 管理接口；发现 `/file/upload`？立刻枚举 `/file-config/page`；发现一个 Controller？把所有 CRUD 动作都扫一遍\r\n\r\n### 文件上传测试\r\n\r\n核心思路：**不要只测常规后缀，要逆向 WAF 的规则逻辑**\r\n- **后缀绕过** — 目标是什么技术栈就测什么变体后缀（如 jsp → jspx/jspf/jspa/jsw 等），同时测双扩展名、大小写混合、空字节截断、特殊字符等通用绕过技术\r\n- **内容检测绕过** — 系统性测试 WAF 拦截的关键词边界（哪些被拦？哪些放行？编码后呢？分块传输呢？）\r\n- **执行判断** — 上传无害探针（如 `${7*7}`、`<%=1+1%>`、`<?=1+1?>`）判断服务端是否解析执行，区分静态文件服务和动态解析引擎\r\n- **别忘了 XSS** — 即使无法 RCE，HTML/SVG 上传 + 直接访问 = 存储型 XSS，检查返回的 Content-Type 和安全头\r\n\r\n### 漏洞检测清单\r\n\r\n**注入**：SQL注入、XSS（反射/存储/DOM）、命令注入、反序列化、代码注入、SSTI、SSRF、XXE\r\n**认证授权**：未授权访问、IDOR越权、JWT安全、验证码安全、暴力破解\r\n**业务逻辑**：竞态条件、参数篡改、流程绕过\r\n**配置泄露**：CORS、敏感文件(.git/.env/swagger)、目录遍历、安全响应头缺失\r\n\r\n### JS 逆向与加解密\r\n\r\n识别加密函数调用链→提取 Key/IV→简化核心逻辑→编写 mitmproxy 解密脚本\r\n\r\n### 验证码处理\r\n\r\n`chrome.take_screenshot` 截图 → 识别 → `chrome.fill` 回填；同时评估复用/回显/万能验证码等绕过\r\n\r\n---\r\n\r\n## MCP 工具速查\r\n\r\n### Burp Suite MCP\r\n- **请求**: `send_http1_request`(首选), `sen"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn7byxgztq2syzyrry6wah88fn82rbn1\",\n  \"slug\": \"pentest-with-bp\",\n  \"version\": \"1.0.1\",\n  \"publishedAt\": 1777815881956\n}"},{"path":"skill-card.md","content":"## Description:\n\nProfessional penetration testing skill that supports Burp Suite MCP, Chrome DevTools MCP, and JADX MCP for web and mobile application security testing, vulnerability discovery, and exploitation analysis.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[ismilent](https://clawhub.ai/user/ismilent)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nSecurity engineers and authorized penetration testers use this skill to inspect web and mobile applications, coordinate Burp Suite, Chrome DevTools, and JADX workflows, validate vulnerabilities, and produce concise test reports.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Penetration-testing workflows can be misused outside an authorized assessment scope.\n\nMitigation: Install and use only for authorized penetration tests, preferably in an isolated browser profile and test environment.\n\nRisk: Captured traffic and reports may contain cookies, tokens, passwords, personal data, keys, IVs, or sensitive response bodies.\n\nMitigation: Require redaction of secrets and sensitive response content before sharing, retaining, or publishing evidence.\n\nRisk: Global TLS certificate-error bypass can hide trust failures or interception issues.\n\nMitigation: Avoid global TLS verification bypass unless the target certificate is verified out of band and the browser profile is disposable.\n\n## Reference(s):\n\n- [Report templates](templates/report_templates.md)\n- [Chrome fetch fallback template](templates/chrome_fetch_template.md)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, code, shell commands, guidance]\n\n**Output Format:** [Markdown reports, HTTP request examples, PoC snippets, command examples, and tool-use guidance]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May produce incremental penetration-test reports, vulnerability details, attack-chain summaries, and PoC collections for authorized scopes.]\n\n## Skill Version(s):\n\n1.0.1 (source: server release metadata)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."},{"path":"templates/chrome_fetch_template.md","content":"# Chrome fetch 降级模板\r\n\r\n当 Burp MCP 异常需要降级时使用：\r\n\r\n```javascript\r\nasync () => {\r\n  const delay = ms => new Promise(r => setTimeout(r, ms));\r\n  const results = [];\r\n  const tests = [{url:'/api/xx', method:'GET'}, {url:'/api/yy', method:'POST', body:{}}];\r\n  for (const tc of tests) {\r\n    try {\r\n      const opts = {method: tc.method, headers: {'Accept':'application/json'}};\r\n      if (tc.body) { opts.headers['Content-Type']='application/json'; opts.body=JSON.stringify(tc.body); }\r\n      const r = await fetch(tc.url, opts);\r\n      const t = await r.text();\r\n      if (!t.includes('chunk-vendors') && r.status!==404) {\r\n        let p; try{p=JSON.parse(t)}catch(e){}\r\n        results.push({url:tc.url, status:r.status, msg:(p?.message||p?.msg||'').substring(0,200)});\r\n      }\r\n    } catch(e) { results.push({url:tc.url, error:e.message}); }\r\n    await delay(300);\r\n  }\r\n  return results;\r\n}\r\n```\r\n\r\n> 要点：async函数、delay间隔、检测SPA前端回退、try/catch、截断长文本"},{"path":"templates/report_templates.md","content":"# 渗透测试报告模板\r\n\r\n```markdown\r\n# [目标名称] 渗透测试报告\r\n\r\n## 基本信息\r\n- **目标**: [URL/系统名称]\r\n- **测试时间**: [日期]\r\n- **测试范围**: [涉及的接口/功能]\r\n\r\n## 技术栈识别\r\n| 项目 | 技术 |\r\n|------|------|\r\n| 前端 | ... |\r\n| 后端 | ... |\r\n| 数据库 | ... |\r\n| 二开框架 | [如 ruoyi-vue-pro, 识别出的包名] |\r\n\r\n## 漏洞汇总\r\n| # | 漏洞名称 | 等级 | CWE | 状态 |\r\n|---|----------|------|-----|------|\r\n| 1 | ...      | 🔴 严重 | CWE-xxx | 已确认 |\r\n\r\n## 漏洞详情\r\n\r\n### 漏洞 X: [漏洞名称]\r\n- **等级**: 🔴 严重 / 🟠 高危 / 🟡 中危 / 🟢 低危\r\n- **CWE**: [CWE 编号和名称]\r\n- **CVSS**: [评分]\r\n- **接口**: [受影响的 URL]\r\n- **参数**: [受影响的参数]\r\n\r\n#### 复现步骤\r\n1. ...\r\n\r\n#### POC 请求\r\n（完整 HTTP 请求，确保可直接复现）\r\n\r\n#### 响应\r\n（关键响应内容）\r\n\r\n#### 影响分析\r\n...\r\n\r\n#### 修复建议\r\n...\r\n\r\n## 攻击链\r\n（将多个漏洞串联的完整攻击路径）\r\n\r\n## Burp Repeater 标签汇总\r\n（所有创建的 Tab 清单）\r\n```\r\n\r\n---\r\n\r\n# JS 加解密分析报告模板\r\n\r\n```markdown\r\n# JavaScript 加解密分析报告\r\n\r\n## 1. 加解密方法识别\r\n- **调用链**: `Function A` -> `Function B` -> `CryptoJS.AES.encrypt`\r\n- **算法类型**: [例如: AES-128-CBC]\r\n- **混淆技术**: [例如: 变量名混淆, 控制流平坦化]\r\n\r\n## 2. 密钥提取\r\n- **Key**: `[提取到的字符串]`\r\n- **IV**: `[提取到的字符串]`\r\n- **生成逻辑**: [静态 Hardcoded / 动态下发]\r\n\r\n## 3. 核心代码分析\r\n（简化并注释的核心加解密逻辑）\r\n\r\n## 4. mitmproxy 脚本\r\n（完整的自动解密/重加密脚本）\r\n```\r\n\r\n---\r\n\r\n# POC 合集模板\r\n\r\n```markdown\r\n# 所有未授权端点完整 POC\r\n\r\n> 目标: [URL]\r\n> 测试时间: [日期]\r\n> 共计: X 个 POC\r\n\r\n## POC-XX ✅ [漏洞名称]\r\n（完整 HTTP 请求 + 实际响应）\r\n（标注: ✅ 返回200 / ⚠️ 无认证但被其他约束阻止 / 🔍 信息泄露）\r\n\r\n## curl 快速验证脚本\r\n（一键复现的 curl 命令集）\r\n```"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Skill: Pentest with Burp Mcp Owner: ismilent Summary: 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 Tags: latest:1.0.1 Version history: v1.0.1 | 2026-05-03T13:44:41.956Z | user - No file changes detected in this version. - No updates or modifications to skill content. v1.0.0 | 2026-05-03T13:35:38.550Z | user Initial release of PenTestEngineer skill for professional web/mobil","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":964,"uniquenessScore":56,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T03:39:28.743Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-11T07:41:46.427Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}