日本語 English

お問い合わせ

##英語

CTF(Capture The Flag)チャレンジのための包括的なツールを提供するモデルコンテキストプロトコル(MCP)サーバー。

⚠️セキュリティ警告

重要:この用具は公認の保証テストだけのために設計されています。

• ✅Authorized use:CTFの競争、書面による許可による貫通テスト、セキュリティ調査、教育目的のために
• ✓禁止使用:不正なアクセス、悪意のある攻撃、違法な活動

このツールを使用する前に:

1. 適切な承認を持っていることを確認してください
2. 詳細なセキュリティガイドラインについては、SECURITY.md をお読みください。
3. BEST PRACTICES.md の使用推奨事項のレビュー
4. 使用するツールのリスクレベルを理解する

リスクレベル:

• 低い:情報収集(安全)
• 🟡のMEDIUM:脆弱性の検出(要求の承認)
• 🟠 High: 搾取ツール(明示的な認可が必要)
• ∟ CRITICAL: RCE/Deserialization のペイロード(必須書かれた承認)

セキュリティ監査結果:

• トータルセキュリティデコレータ*:保護された33危険な操作
• ♠CRITICAL: 14 ツール(RCE、deserialization)
• 🟠HIGH:13ツール(露光、注射)
• 🟡MEDIUM: 6つのツール(暗号化、コード生成を弱い)

CTF-MCP

English | 中文

---

English

A Model Context Protocol (MCP) server providing comprehensive tools for CTF (Capture The Flag) challenges.

⚠️ Security Warning

IMPORTANT: This tool is designed for authorized security testing only.

• ✅ Authorized Use: CTF competitions, penetration testing with written permission, security research, educational purposes
• ❌ Prohibited Use: Unauthorized access, malicious attacks, illegal activities

Before using this tool:

1. Ensure you have proper authorization
2. Read SECURITY.md for detailed security guidelines
3. Review BEST_PRACTICES.md for usage recommendations
4. Understand the risk levels of tools you plan to use

Risk Levels:

• 🟢 LOW: Information gathering (safe)
• 🟡 MEDIUM: Vulnerability detection (requires authorization)
• 🟠 HIGH: Exploitation tools (explicit authorization required)
• 🔴 CRITICAL: RCE/Deserialization payloads (written authorization required)

Security Audit Results:

• 🔒 Total Security Decorators: 33 dangerous operations protected
• 🔴 CRITICAL: 14 tools (RCE, deserialization)
• 🟠 HIGH: 13 tools (exploitation, injection)
• 🟡 MEDIUM: 6 tools (weak crypto, code generation)
• See SECURITY.md for complete tool lists and descriptions

By using CTF-MCP, you agree to use it responsibly and legally.

Features

Crypto (53 tools)

• Base encoding (Base64, Base32, Base58, Base85)
• Classical ciphers (Caesar, Vigenere, Atbash, Affine, Rail Fence, Playfair, Hill)
• XOR operations and analysis
• Modern crypto (AES, DES, RC4)
• Hash functions and cracking
• RSA attacks (Wiener, Hastad, Common Modulus, Franklin-Reiter)
• Frequency analysis

Web (46 tools)

• SQL Injection (Union, Error, Blind, Time-based)
• XSS payloads and filter bypass
• SSTI (Server-Side Template Injection)
• SSRF, XXE, Command Injection
• JWT attacks (None algorithm, Key confusion)
• Deserialization (PHP, Python Pickle, Java, Node.js)
• HTTP Smuggling, GraphQL, WebSocket
• OAuth, CORS, Cache Poisoning

Pwn (27 tools)

• Shellcode generation (x64/x86)
• Cyclic pattern creation and offset finding
• ROP gadgets and chain building
• Format string exploits
• Heap exploitation (Tcache, Fastbin, House of Force/Spirit)
• Stack pivot techniques
• SROP (Sigreturn-oriented programming)
• Libc database and one_gadget

Reverse

• Disassembly helpers
• String extraction
• Binary analysis

Forensics

• File carving
• Memory analysis
• Network forensics

Misc

• Encoding/decoding utilities
• Steganography helpers

Installation

pip install -e .

Usage

As MCP Server

ctf-mcp

In Python

from ctf_mcp.tools.crypto import CryptoTools
from ctf_mcp.tools.web import WebTools
from ctf_mcp.tools.pwn import PwnTools

crypto = CryptoTools()
web = WebTools()
pwn = PwnTools()

# Generate SQL injection payloads
print(web.sql_payloads("mysql", "union"))