Korean | 한국어

---

한국어

CTF (Capture The Flag) 과제에 대한 종합적인 도구를 제공하는 Model Context Protocol (MCP) 서버.

⚠️ 보안 경고

**IMPORTANT: 이 도구는 공인 보안 테스트를 위해 설계되었습니다. **

• ✅ ** 공인 사용 ** : CTF 경쟁, 서면 허가, 보안 연구, 교육 목적으로 테스트
• ❌Prohibited Use: 무단 액세스, 악성 공격, 불법 행위

**이 도구를 사용하여: **

1. 당신은 적당한 허가가 있는 것을 지킵니다
2. 상세한 보안 지침에 대한 SECURITY.md를 읽으십시오
3. 사용법 권고를 위한 BEST PRACTICES.md 검토
4. 사용하려는 도구의 위험 수준에 대해

리스크 레벨:

• LOW LOW : 정보 수집 (안전)
• MED MEDIUM : 취약점 검출 (인증 필요)
• HIGH HIGH : 폭발 도구 (필수)
• CRICTICAL: RCE/Deserialization 탑재량 (필요한 적출)

보안 감사 결과:

• ❤Total Security Decorators: 33 위험한 작업 보호
• CRITICAL: 14개의 공구 (RCE, deserialization)
• HI **HIGH ** : 13 도구 (확장, 주입)
• MED MEDIUM: 6 도구 (암호화, 코드 생성)

CTF-MCP

English | 中文

---

English

A Model Context Protocol (MCP) server providing comprehensive tools for CTF (Capture The Flag) challenges.

⚠️ Security Warning

IMPORTANT: This tool is designed for authorized security testing only.

• ✅ Authorized Use: CTF competitions, penetration testing with written permission, security research, educational purposes
• ❌ Prohibited Use: Unauthorized access, malicious attacks, illegal activities

Before using this tool:

1. Ensure you have proper authorization
2. Read SECURITY.md for detailed security guidelines
3. Review BEST_PRACTICES.md for usage recommendations
4. Understand the risk levels of tools you plan to use

Risk Levels:

• 🟢 LOW: Information gathering (safe)
• 🟡 MEDIUM: Vulnerability detection (requires authorization)
• 🟠 HIGH: Exploitation tools (explicit authorization required)
• 🔴 CRITICAL: RCE/Deserialization payloads (written authorization required)

Security Audit Results:

• 🔒 Total Security Decorators: 33 dangerous operations protected
• 🔴 CRITICAL: 14 tools (RCE, deserialization)
• 🟠 HIGH: 13 tools (exploitation, injection)
• 🟡 MEDIUM: 6 tools (weak crypto, code generation)
• See SECURITY.md for complete tool lists and descriptions

By using CTF-MCP, you agree to use it responsibly and legally.

Features

Crypto (53 tools)

• Base encoding (Base64, Base32, Base58, Base85)
• Classical ciphers (Caesar, Vigenere, Atbash, Affine, Rail Fence, Playfair, Hill)
• XOR operations and analysis
• Modern crypto (AES, DES, RC4)
• Hash functions and cracking
• RSA attacks (Wiener, Hastad, Common Modulus, Franklin-Reiter)
• Frequency analysis

Web (46 tools)

• SQL Injection (Union, Error, Blind, Time-based)
• XSS payloads and filter bypass
• SSTI (Server-Side Template Injection)
• SSRF, XXE, Command Injection
• JWT attacks (None algorithm, Key confusion)
• Deserialization (PHP, Python Pickle, Java, Node.js)
• HTTP Smuggling, GraphQL, WebSocket
• OAuth, CORS, Cache Poisoning

Pwn (27 tools)

• Shellcode generation (x64/x86)
• Cyclic pattern creation and offset finding
• ROP gadgets and chain building
• Format string exploits
• Heap exploitation (Tcache, Fastbin, House of Force/Spirit)
• Stack pivot techniques
• SROP (Sigreturn-oriented programming)
• Libc database and one_gadget

Reverse

• Disassembly helpers
• String extraction
• Binary analysis

Forensics

• File carving
• Memory analysis
• Network forensics

Misc

• Encoding/decoding utilities
• Steganography helpers

Installation

pip install -e .

Usage

As MCP Server

ctf-mcp

In Python

from ctf_mcp.tools.crypto import CryptoTools
from ctf_mcp.tools.web import WebTools
from ctf_mcp.tools.pwn import PwnTools

crypto = CryptoTools()
web = WebTools()
pwn = PwnTools()

# Generate SQL injection payloads
print(web.sql_payloads("mysql", "union"))