vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok609hecl1pq6qi
2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

554
reverse-skill-repo/kali/scripts/bootstrap-manifest.json Normal file
View File

@@ -0,0 +1,554 @@
{
"platform": "kali-linux",
"targetVersion": "2026.1",
"kernel": "6.18",
"note": "Kali 2026.1 专供版 manifest。基于 2025.4 + 2026.1 新增工具优化。大量工具已预装，bootstrap 主要处理非预装工具和 MCP 注册。",
"kaliNewTools2026_1": [
"adaptixc2 — 后渗透与对抗模拟框架 (apt install adaptixc2)",
"atomic-operator — Atomic Red Team 测试执行器 (apt install atomic-operator)",
"fluxion — WiFi 社工审计工具 (apt install fluxion)",
"gef — GDB 增强调试框架 (apt install gef)",
"metasploitmcp — Metasploit MCP Server (apt install metasploitmcp)",
"sstimap — SSTI 自动检测工具 (apt install sstimap)",
"wpprobe — WordPress 插件枚举 (apt install wpprobe)",
"xsstrike — 高级 XSS 扫描器 (apt install xsstrike)"
],
"kaliNewTools2025_4": [
"bpf-linker — BPF 静态链接器 (apt install bpf-linker)",
"evil-winrm-py — Python 版 WinRM 远程执行 (apt install evil-winrm-py)",
"hexstrike-ai — AI MCP 安全自动化平台 (apt install hexstrike-ai)"
],
"kaliNativeMCP": [
"mcp-kali-server — Kali 官方 MCP Server，连接 AI 到 Kali 终端 (apt install mcp-kali-server, port 5000)",
"metasploitmcp — Metasploit MCP Server (apt install metasploitmcp, port 8085)",
"hexstrike-ai — 150+ 安全工具 MCP 自动化 (apt install hexstrike-ai)"
],
"capabilities": [
{
"name": "jadx",
"bootstrapKind": "github-release-tar",
"repo": "skylot/jadx",
"assetRegex": "^jadx-1\\.5\\.6\\.zip$",
"installDir": "$HOME/tools/jadx",
"docsUrl": "https://github.com/skylot/jadx",
"canAutoInstall": true,
"verifyCommand": "jadx",
"kaliNote": "Kali 无预装，从 GitHub Release 下载",
"releaseTag": "v1.5.6",
"assetSha256": "545ea2be9c242511bc145755cf4bda2485ade42966e096f8b4d3da2a230e8974"
},
{
"name": "apktool",
"bootstrapKind": "apt-package",
"aptPackage": "apktool",
"fallbackKind": "github-release-jar",
"repo": "iBotPeaches/Apktool",
"assetRegex": "^apktool_3\\.0\\.2\\.jar$",
"installDir": "$HOME/tools/apktool",
"docsUrl": "https://apktool.org/",
"canAutoInstall": true,
"verifyCommand": "apktool",
"kaliNote": "apt install apktool 即可，版本较旧时可从 GitHub 下载最新",
"releaseTag": "v3.0.2",
"assetSha256": "eee4669a704a14e0623407e6701b0b91887e61e1e4049cb7a82833e14ae8b5fd"
},
{
"name": "frida",
"bootstrapKind": "pip-package",
"pipPackage": "frida-tools==14.10.4",
"pinnedVersion": "14.10.4",
"docsUrl": "https://frida.re/",
"canAutoInstall": true,
"verifyCommand": "frida",
"kaliNote": "pip3 install frida-tools 或 apt install python3-frida-tools"
},
{
"name": "frida-ps",
"bootstrapKind": "pip-package",
"pipPackage": "frida-tools==14.10.4",
"pinnedVersion": "14.10.4",
"docsUrl": "https://frida.re/",
"canAutoInstall": true,
"verifyCommand": "frida-ps"
},
{
"name": "idalib-mcp",
"bootstrapKind": "pip-package",
"pipPackage": "ida-pro-mcp",
"pipSource": "git+https://github.com/mrexodia/ida-pro-mcp.git@f82e6e2517a161b77e738951c3071cd446480ba0",
"pinnedCommit": "f82e6e2517a161b77e738951c3071cd446480ba0",
"docsUrl": "https://github.com/mrexodia/ida-pro-mcp",
"canAutoInstall": true,
"verifyCommand": "ida-pro-mcp",
"postInstallSteps": [
"ida-pro-mcp --install (选择 Streamable HTTP + Global)",
"重启 IDA Pro 使插件生效",
"IDA 打开文件后 MCP 自动监听 127.0.0.1:13337"
],
"kaliNote": "需要 IDA Pro Linux 版本"
},
{
"name": "jeb-pro",
"bootstrapKind": "manual",
"docsUrl": "https://www.pnfsoftware.com/jeb/",
"canAutoInstall": false,
"verifyCommand": "jeb",
"manualInstallHint": "JEB Pro is commercial. Obtain a valid license from PNF Software, install it manually, then refresh the tool index. Optional community MCP bridges must pass the skill-supply-chain review before registration.",
"kaliNote": "JEB Pro Linux edition requires a user-provided license and manual installation."
},
{
"name": "reqable-mcp",
"bootstrapKind": "npm-mcp",
"npmPackage": "reqable-mcp-server@1.0.1",
"mcpNames": [
"reqable-mcp"
],
"mcpCommand": "npx",
"mcpArgs": [
"-y",
"reqable-mcp-server@1.0.1",
"--scope",
"minimal"
],
"docsUrl": "https://github.com/reqable/reqable-mcp-server",
"canAutoInstall": true,
"verifyCommand": "npx",
"pinnedVersion": "1.0.1",
"kaliNote": "Requires the separately installed Reqable desktop application and its local API."
},
{
"name": "jshookmcp",
"bootstrapKind": "npm-mcp",
"npmPackage": "@jshookmcp/jshook@0.3.4",
"mcpNames": [
"jshook"
],
"mcpCommand": "npx",
"mcpArgs": [
"-y",
"@jshookmcp/jshook@0.3.4"
],
"mcpEnv": {
"JSHOOK_BASE_PROFILE": "search"
},
"docsUrl": "https://github.com/vmoranv/jshookmcp",
"canAutoInstall": true,
"verifyCommand": "npx",
"pinnedVersion": "0.3.4"
},
{
"name": "anything-analyzer",
"bootstrapKind": "local-http-mcp",
"repoUrl": "https://github.com/Mouseww/anything-analyzer",
"installDir": "$HOME/tools/anything-analyzer",
"startupDirCandidates": [
"$HOME/tools/anything-analyzer"
],
"startCommand": "pnpm",
"startArgs": [
"dev"
],
"mcpNames": [
"anything-analyzer",
"local-mcp"
],
"mcpUrl": "http://localhost:23816/mcp",
"servicePort": 23816,
"docsUrl": "https://github.com/Mouseww/anything-analyzer",
"canAutoInstall": true,
"verificationMode": "service-or-registration"
},
{
"name": "idapro",
"bootstrapKind": "local-http-mcp",
"dependsOn": [
"idalib-mcp"
],
"mcpNames": [
"idapro"
],
"mcpUrl": "http://127.0.0.1:13337/mcp",
"servicePort": 13337,
"servicePortRange": [
13337,
13350
],
"portNote": "IDA 多实例时端口递增 (13337→13338→...)，检查 IDA Output 窗口的 [MCP] port=xxxxx 日志",
"startScript": "$SKILL_ROOT/../kali/scripts/ida-start.sh",
"docsUrl": "https://hex-rays.com/ida-pro/",
"canAutoInstall": true,
"verificationMode": "service-and-registration",
"kaliNote": "需要 IDA Pro Linux 版，安装到 /opt/idapro/"
},
{
"name": "r2",
"bootstrapKind": "apt-package",
"aptPackage": "radare2",
"fallbackKind": "github-release-tar",
"repo": "radareorg/radare2",
"assetRegex": "^radare2-.*-w64\\.zip$",
"docsUrl": "https://github.com/radareorg/radare2",
"canAutoInstall": true,
"verifyCommand": "r2",
"kaliNote": "Kali 预装。如需最新版可从 GitHub 下载 .deb",
"preferApiDigest": true
},
{
"name": "rabin2",
"bootstrapKind": "apt-package",
"aptPackage": "radare2",
"docsUrl": "https://github.com/radareorg/radare2",
"canAutoInstall": true,
"verifyCommand": "rabin2",
"kaliNote": "随 radare2 一起安装",
"assetRegex": "^radare2-.*-w64\\.zip$",
"preferApiDigest": true
},
{
"name": "adb",
"bootstrapKind": "apt-package",
"aptPackage": "adb",
"docsUrl": "https://developer.android.com/tools/releases/platform-tools",
"canAutoInstall": true,
"verifyCommand": "adb",
"kaliNote": "apt install adb"
},
{
"name": "agent-browser",
"bootstrapKind": "npm-global",
"npmPackage": "agent-browser@0.31.1",
"pinnedVersion": "0.31.1",
"postInstall": "npx playwright install chromium",
"docsUrl": "https://github.com/nicepkg/agent-browser",
"canAutoInstall": true,
"verifyCommand": "agent-browser"
},
{
"name": "ghidra-mcp",
"bootstrapKind": "apt-package",
"aptPackage": "ghidra",
"fallbackKind": "github-release-tar",
"repo": "NationalSecurityAgency/ghidra",
"assetRegex": "^ghidra_.*_PUBLIC_.*\\.zip$",
"installDir": "$HOME/tools/ghidra",
"docsUrl": "https://ghidra-sre.org/",
"canAutoInstall": true,
"verifyCommand": "ghidra",
"postInstallSteps": [
"下载 GhidraMCP 插件: https://github.com/LaurieWired/GhidraMCP/releases",
"将插件 zip 安装到 Ghidra: File → Install Extensions → 选择下载的 zip",
"MCP server 在 Ghidra 项目打开后自动监听 localhost:8765"
],
"mcpNames": [
"ghidra"
],
"mcpUrl": "http://localhost:8765/mcp",
"servicePort": 8765,
"verificationMode": "service-or-registration",
"kaliNote": "apt install ghidra 或从 GitHub 下载",
"preferApiDigest": true
},
{
"name": "seclists",
"bootstrapKind": "apt-package",
"aptPackage": "seclists",
"installDir": "/usr/share/seclists",
"docsUrl": "https://github.com/danielmiessler/SecLists",
"canAutoInstall": true,
"verifyCommand": "",
"kaliNote": "apt install seclists，安装到 /usr/share/seclists/"
},
{
"name": "proxycat",
"bootstrapKind": "git-clone",
"repo": "https://github.com/honmashironeko/ProxyCat.git",
"pinnedCommit": "2309b713e2e4f574df14c2ace7e8fa6c00eb6941",
"installDir": "$HOME/tools/ProxyCat",
"docsUrl": "https://github.com/honmashironeko/ProxyCat",
"canAutoInstall": true,
"verifyCommand": "proxycat"
},
{
"name": "burpsuite-mcp",
"bootstrapKind": "manual",
"mcpNames": [
"burpsuite"
],
"mcpUrl": "http://localhost:9876/mcp",
"servicePort": 9876,
"docsUrl": "https://portswigger.net/burp",
"canAutoInstall": false,
"verificationMode": "service-or-registration",
"manualInstallHint": "Kali 预装 BurpSuite，在扩展市场搜索 MCP 插件安装，启动后监听 localhost:9876",
"kaliNote": "Kali 预装 BurpSuite Community，MCP 插件需手动安装"
},
{
"name": "nmap",
"bootstrapKind": "apt-package",
"aptPackage": "nmap",
"docsUrl": "https://nmap.org/",
"canAutoInstall": true,
"verifyCommand": "nmap",
"kaliNote": "Kali 预装"
},
{
"name": "sqlmap",
"bootstrapKind": "apt-package",
"aptPackage": "sqlmap",
"docsUrl": "https://sqlmap.org/",
"canAutoInstall": true,
"verifyCommand": "sqlmap",
"kaliNote": "Kali 预装"
},
{
"name": "hashcat",
"bootstrapKind": "apt-package",
"aptPackage": "hashcat",
"docsUrl": "https://hashcat.net/hashcat/",
"canAutoInstall": true,
"verifyCommand": "hashcat",
"kaliNote": "Kali 预装"
},
{
"name": "hydra",
"bootstrapKind": "apt-package",
"aptPackage": "hydra",
"docsUrl": "https://github.com/vanhauser-thc/thc-hydra",
"canAutoInstall": true,
"verifyCommand": "hydra",
"kaliNote": "Kali 预装"
},
{
"name": "gobuster",
"bootstrapKind": "apt-package",
"aptPackage": "gobuster",
"docsUrl": "https://github.com/OJ/gobuster",
"canAutoInstall": true,
"verifyCommand": "gobuster",
"kaliNote": "Kali 预装"
},
{
"name": "ffuf",
"bootstrapKind": "apt-package",
"aptPackage": "ffuf",
"docsUrl": "https://github.com/ffuf/ffuf",
"canAutoInstall": true,
"verifyCommand": "ffuf",
"kaliNote": "Kali 预装"
},
{
"name": "msfconsole",
"bootstrapKind": "apt-package",
"aptPackage": "metasploit-framework",
"docsUrl": "https://www.metasploit.com/",
"canAutoInstall": true,
"verifyCommand": "msfconsole",
"kaliNote": "Kali 预装"
},
{
"name": "nuclei",
"bootstrapKind": "go-install",
"goPackage": "github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.8.0",
"pinnedVersion": "v3.8.0",
"fallbackKind": "github-release-tar",
"repo": "projectdiscovery/nuclei",
"assetRegex": "^nuclei_.*_linux_amd64\\.zip$",
"releaseTag": "v3.8.0",
"preferApiDigest": true,
"docsUrl": "https://github.com/projectdiscovery/nuclei",
"canAutoInstall": true,
"verifyCommand": "nuclei",
"kaliNote": "go install 或从 GitHub Release 下载"
},
{
"name": "mcp-kali-server",
"bootstrapKind": "apt-package",
"aptPackage": "mcp-kali-server",
"mcpNames": [
"kali-server"
],
"mcpUrl": "http://localhost:5000",
"servicePort": 5000,
"docsUrl": "https://github.com/Wh0am123/MCP-Kali-Server",
"canAutoInstall": true,
"verifyCommand": "kali-server-mcp",
"verificationMode": "service-or-registration",
"kaliNote": "Kali 2026.1 官方收录。apt install 后用 kali-server-mcp 启动 API server，mcp-server 连接 AI 客户端。可直接调用 nmap/nxc/curl/gobuster 等任意终端工具。"
},
{
"name": "metasploitmcp",
"bootstrapKind": "apt-package",
"aptPackage": "metasploitmcp",
"mcpNames": [
"metasploit-mcp"
],
"mcpCommand": "metasploitmcp",
"mcpArgs": [
"--transport",
"stdio"
],
"mcpUrl": "http://127.0.0.1:8085",
"servicePort": 8085,
"docsUrl": "https://github.com/GH05TCREW/MetasploitMCP",
"canAutoInstall": true,
"verifyCommand": "metasploitmcp",
"verificationMode": "service-or-registration",
"kaliNote": "Kali 2026.1 新增。Metasploit Framework 的 MCP 接口，支持 HTTP 和 stdio 两种传输模式。"
},
{
"name": "hexstrike-ai",
"bootstrapKind": "apt-package",
"aptPackage": "hexstrike-ai",
"mcpNames": [
"hexstrike"
],
"docsUrl": "https://github.com/0x4m4/hexstrike-ai",
"canAutoInstall": true,
"verifyCommand": "hexstrike-ai",
"kaliNote": "Kali 2025.4 新增。AI MCP 安全自动化平台，150+ 安全工具通过 MCP 协议暴露给 AI agent。"
},
{
"name": "adaptixc2",
"bootstrapKind": "apt-package",
"aptPackage": "adaptixc2",
"docsUrl": "https://www.kali.org/tools/adaptixc2/",
"canAutoInstall": true,
"verifyCommand": "AdaptixServer",
"kaliNote": "Kali 2026.1 新增。可扩展后渗透与对抗模拟框架。"
},
{
"name": "atomic-operator",
"bootstrapKind": "apt-package",
"aptPackage": "atomic-operator",
"docsUrl": "https://www.kali.org/tools/atomic-operator/",
"canAutoInstall": true,
"verifyCommand": "atomic-operator",
"kaliNote": "Kali 2026.1 新增。跨平台执行 Atomic Red Team 测试用例。"
},
{
"name": "sstimap",
"bootstrapKind": "apt-package",
"aptPackage": "sstimap",
"docsUrl": "https://github.com/vladko312/SSTImap",
"canAutoInstall": true,
"verifyCommand": "sstimap",
"kaliNote": "Kali 2026.1 新增。自动 SSTI（服务端模板注入）检测与利用。"
},
{
"name": "xsstrike",
"bootstrapKind": "apt-package",
"aptPackage": "xsstrike",
"docsUrl": "https://github.com/s0md3v/XSStrike",
"canAutoInstall": true,
"verifyCommand": "xsstrike",
"kaliNote": "Kali 2026.1 新增。高级 XSS 扫描器，支持 DOM/反射/存储型检测。"
},
{
"name": "wpprobe",
"bootstrapKind": "apt-package",
"aptPackage": "wpprobe",
"docsUrl": "https://www.kali.org/tools/wpprobe/",
"canAutoInstall": true,
"verifyCommand": "wpprobe",
"kaliNote": "Kali 2026.1 新增。快速 WordPress 插件枚举工具。"
},
{
"name": "fluxion",
"bootstrapKind": "apt-package",
"aptPackage": "fluxion",
"docsUrl": "https://www.kali.org/tools/fluxion/",
"canAutoInstall": true,
"verifyCommand": "fluxion",
"kaliNote": "Kali 2026.1 新增。WiFi 安全审计与社会工程研究工具。"
},
{
"name": "gef",
"bootstrapKind": "apt-package",
"aptPackage": "gef",
"docsUrl": "https://www.kali.org/tools/gef/",
"canAutoInstall": true,
"verifyCommand": "gdb",
"kaliNote": "Kali 2026.1 新增。GDB Enhanced Features，现代化 GDB 调试体验。安装后 gdb 自动加载 GEF。"
},
{
"name": "evil-winrm-py",
"bootstrapKind": "apt-package",
"aptPackage": "evil-winrm-py",
"docsUrl": "https://www.kali.org/tools/evil-winrm-py/",
"canAutoInstall": true,
"verifyCommand": "evil-winrm-py",
"kaliNote": "Kali 2025.4 新增。Python 版 WinRM 远程命令执行，用于 Windows 后渗透。"
},
{
"name": "pentestswarm",
"bootstrapKind": "go-install",
"goPackage": "github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0",
"fallbackKind": "docker-image",
"dockerImage": "ghcr.io/armur-ai/pentestswarm:v0.1.0",
"mcpNames": [
"pentestswarm"
],
"mcpCommand": "pentestswarm",
"mcpArgs": [
"mcp",
"serve"
],
"docsUrl": "https://github.com/Armur-Ai/Pentest-Swarm-AI",
"canAutoInstall": true,
"verifyCommand": "pentestswarm",
"dependencies": [
"go",
"postgres",
"redis"
],
"kaliNote": "群体智能渗透框架。go install 或 Docker 运行。支持 MCP server 模式（pentestswarm mcp serve）。需要 Claude/Ollama API key。",
"pinnedVersion": "v0.1.0"
},
{
"name": "coercer",
"bootstrapKind": "apt-package",
"aptPackage": "coercer",
"docsUrl": "https://www.kali.org/tools/coercer/",
"canAutoInstall": true,
"verifyCommand": "coercer",
"kaliNote": "Windows 认证强制工具，用于 AD 攻击中的 NTLM relay。"
},
{
"name": "binwalk",
"bootstrapKind": "apt-package",
"aptPackage": "binwalk",
"docsUrl": "https://github.com/ReFirmLabs/binwalk",
"canAutoInstall": true,
"verifyCommand": "binwalk",
"kaliNote": "固件分析与提取。Kali 预装，apt 可更新。"
},
{
"name": "yara",
"bootstrapKind": "apt-package",
"aptPackage": "yara",
"docsUrl": "https://virustotal.github.io/yara/",
"canAutoInstall": true,
"verifyCommand": "yara",
"kaliNote": "恶意软件规则匹配引擎。Kali 预装，apt 可更新。"
},
{
"name": "pwntools",
"bootstrapKind": "pip-package",
"pipPackage": "pwntools==4.15.0",
"pinnedVersion": "4.15.0",
"docsUrl": "https://github.com/Gallopsled/pwntools",
"canAutoInstall": true,
"verifyCommand": "pwntools",
"kaliNote": "CTF pwn 利用开发框架。Kali 预装，pip 可更新。"
},
{
"name": "bkcrack",
"bootstrapKind": "apt-package",
"aptPackage": "bkcrack",
"docsUrl": "https://github.com/kimci86/bkcrack",
"canAutoInstall": true,
"verifyCommand": "bkcrack",
"kaliNote": "传统 ZipCrypto 已知明文攻击工具；Kali/Debian 可通过 apt 安装。"
}
]
}

715
reverse-skill-repo/kali/scripts/bootstrap-reverse.sh Normal file
View File

@@ -0,0 +1,715 @@
#!/usr/bin/env bash
# bootstrap-reverse.sh — Kali Linux 版自动安装/补齐工具
# 等价于 Windows 版的 bootstrap-reverse.ps1
#
# 用法:
# bash bootstrap-reverse.sh <capability1> [capability2] ... [--start-services] [--skip-refresh]
#
# 示例:
# bash bootstrap-reverse.sh jadx apktool frida
# bash bootstrap-reverse.sh idapro --start-services
# bash bootstrap-reverse.sh jshookmcp anything-analyzer
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
KALI_MANIFEST="$SCRIPT_DIR/bootstrap-manifest.json"
source "$SCRIPT_DIR/lib/tool-discovery.sh"
# ─── 参数解析 ──────────────────────────────────────────────────────────────────────
CAPABILITIES=()
START_SERVICES=false
SKIP_REFRESH=false
MANUAL_REQUIRED=false
LAST_CAPABILITY_MANUAL=false
for arg in "$@"; do
case "$arg" in
--start-services) START_SERVICES=true ;;
--skip-refresh) SKIP_REFRESH=true ;;
--list|-l)
echo "jadx apktool jeb-pro frida frida-ps idalib-mcp jshookmcp reqable-mcp anything-analyzer idapro r2 rabin2 adb agent-browser ghidra-mcp seclists proxycat burpsuite-mcp nmap pentestswarm bkcrack"
echo "mcp-kali-server metasploitmcp hexstrike-ai adaptixc2 atomic-operator sstimap xsstrike wpprobe fluxion gef coercer evil-winrm-py netexec responder bloodhound certipy"
exit 0
;;
-*) echo "未知选项: $arg"; exit 1 ;;
*) CAPABILITIES+=("$arg") ;;
esac
done
if [[ ${#CAPABILITIES[@]} -eq 0 ]]; then
echo "用法: $0 <capability1> [capability2] ... [--start-services] [--skip-refresh]"
echo ""
echo "可用能力:"
echo ""
echo " [逆向分析]"
echo " jadx apktool jeb-pro frida frida-ps idalib-mcp r2 rabin2 adb gef"
echo ""
echo " [渗透测试 - 经典工具]"
echo " nmap sqlmap hashcat hydra gobuster ffuf msfconsole nuclei"
echo " netexec responder crackmapexec bloodhound certipy wfuzz"
echo " aircrack-ng coercer evil-winrm-py"
echo ""
echo " [渗透测试 - Kali 2026.1 新增]"
echo " adaptixc2 atomic-operator sstimap xsstrike wpprobe fluxion"
echo ""
echo " [MCP 服务]"
echo " jshookmcp reqable-mcp anything-analyzer idapro agent-browser"
echo " mcp-kali-server metasploitmcp hexstrike-ai pentestswarm"
echo ""
echo " [CTF 压缩包]"
echo " bkcrack"
echo ""
echo " [其他]"
echo " ghidra-mcp seclists proxycat burpsuite-mcp"
echo ""
echo "示例:"
echo " $0 mcp-kali-server metasploitmcp hexstrike-ai pentestswarm # 全部渗透 MCP"
echo " $0 adaptixc2 sstimap xsstrike wpprobe # 安装 2026.1 新工具"
echo " $0 pentestswarm --start-services # 安装 Swarm AI"
echo " $0 idapro --start-services # 安装并启动 IDA MCP"
exit 1
fi
# ─── 辅助函数 ──────────────────────────────────────────────────────────────────────
log_info() { echo -e "\033[36m[INFO]\033[0m $*"; }
log_ok() { echo -e "\033[32m[OK]\033[0m $*"; }
log_warn() { echo -e "\033[33m[WARN]\033[0m $*"; }
log_err() { echo -e "\033[31m[ERR]\033[0m $*"; }
# 检查是否有 sudo 权限
check_sudo() {
if [[ $EUID -eq 0 ]]; then
return 0
fi
if sudo -n true 2>/dev/null; then
return 0
fi
log_warn "部分操作需要 sudo 权限"
return 1
}
# apt 安装
install_apt_package() {
local package="$1"
log_info "apt install $package ..."
if [[ $EUID -eq 0 ]]; then
apt-get update -qq && apt-get install -y -qq "$package"
else
sudo apt-get update -qq && sudo apt-get install -y -qq "$package"
fi
}
# pip 安装
install_pip_package() {
local package="$1"
local source="${2:-}"
local target="${source:-$package}"
log_info "pip3 install $target ..."
pip3 install --upgrade "$target" --break-system-packages 2>/dev/null \
|| pip3 install --upgrade "$target"
}
# npm 全局安装
install_npm_global() {
local package="$1"
log_info "npm install -g $package ..."
if [[ $EUID -eq 0 ]]; then
npm install -g "$package"
else
sudo npm install -g "$package" 2>/dev/null || npm install -g "$package"
fi
}
# Git clone at an immutable commit. Existing mismatched checkouts are rejected
# instead of being overwritten, so local operator changes are never discarded.
install_git_commit() {
local repo="$1"
local commit="$2"
local install_dir="$3"
if [[ -d "$install_dir/.git" ]]; then
local current
current=$(git -C "$install_dir" rev-parse HEAD 2>/dev/null || true)
if [[ "$current" != "$commit" ]]; then
log_err "Existing checkout is not at pinned commit $commit: $install_dir"
log_err "Move it aside explicitly, then retry; bootstrap will not overwrite local changes."
return 1
fi
return 0
fi
if [[ -e "$install_dir" ]]; then
log_err "Install path exists but is not a git checkout: $install_dir"
return 1
fi
mkdir -p "$(dirname "$install_dir")"
git init -q "$install_dir"
git -C "$install_dir" remote add origin "$repo"
git -C "$install_dir" fetch --depth 1 origin "$commit"
git -C "$install_dir" checkout -q --detach FETCH_HEAD
local resolved
resolved=$(git -C "$install_dir" rev-parse HEAD)
if [[ "$resolved" != "$commit" ]]; then
log_err "Pinned checkout verification failed (expected $commit, got $resolved)"
return 1
fi
}
# GitHub Release 下载并解压。
# Args: repo asset_regex install_dir [release_tag] [expected_sha256]
install_github_release() {
local repo="$1"
local asset_regex="$2"
local install_dir="$3"
local release_tag="${4:-}"
local expected_sha256="${5:-}"
if ! command -v jq &>/dev/null; then
log_err "jq is required to select and verify GitHub release assets"
return 1
fi
log_info "从 GitHub Release 下载: $repo ..."
local api_url
if [[ -n "$release_tag" ]]; then
api_url="https://api.github.com/repos/${repo}/releases/tags/${release_tag}"
else
api_url="https://api.github.com/repos/${repo}/releases/latest"
fi
local release_json
release_json=$(curl --fail --silent --show-error --location "$api_url")
local asset
asset=$(printf '%s' "$release_json" | jq -cer --arg regex "$asset_regex" '.assets[] | select(.name | test($regex)) | {name, browser_download_url, digest}' | head -n1)
if [[ -z "$asset" || "$asset" == "null" ]]; then
log_err "未找到匹配 $asset_regex 的 release asset (tag=${release_tag:-latest})"
return 1
fi
local download_url filename api_digest
download_url=$(printf '%s' "$asset" | jq -r '.browser_download_url')
filename=$(printf '%s' "$asset" | jq -r '.name')
api_digest=$(printf '%s' "$asset" | jq -r '.digest // empty')
local tmp_file
tmp_file=$(mktemp "/tmp/reverse-bootstrap-${filename}.XXXXXX")
local tmp_extract=''
cleanup_github_release() {
rm -f "$tmp_file"
if [[ -n "$tmp_extract" ]]; then rm -rf "$tmp_extract"; fi
}
log_info "下载: $download_url"
if ! curl --fail --silent --show-error --location -o "$tmp_file" "$download_url"; then
cleanup_github_release
return 1
fi
local expected="${expected_sha256#sha256:}"
expected="${expected,,}"
if [[ -z "$expected" && -n "$api_digest" ]]; then
expected="${api_digest#sha256:}"
expected="${expected,,}"
fi
if [[ -z "$expected" ]]; then
log_err "缺少固定 SHA-256 或 GitHub digest，拒绝安装未校验资产: $filename"
cleanup_github_release
return 1
fi
local actual
actual=$(sha256sum "$tmp_file" | awk '{print tolower($1)}')
if [[ "$actual" != "$expected" ]]; then
log_err "SHA-256 不匹配: $filename (expected $expected, got $actual)"
cleanup_github_release
return 1
fi
log_ok "SHA-256 校验通过: $actual"
# 创建安装目录
mkdir -p "$install_dir"
# 根据文件类型解压
case "$filename" in
*.tar.gz|*.tgz)
tar -xzf "$tmp_file" -C "$install_dir" --strip-components=1 2>/dev/null \
|| tar -xzf "$tmp_file" -C "$install_dir"
;;
*.zip)
tmp_extract=$(mktemp -d /tmp/reverse-bootstrap-extract.XXXXXX)
unzip -qo "$tmp_file" -d "$tmp_extract"
# 如果只有一个顶层目录，strip 它
local top_dirs
top_dirs=$(find "$tmp_extract" -maxdepth 1 -mindepth 1 -type d)
if [[ $(printf '%s\n' "$top_dirs" | wc -l) -eq 1 ]]; then
cp -a "$top_dirs"/. "$install_dir/"
else
cp -a "$tmp_extract"/. "$install_dir/"
fi
;;
*.deb)
if [[ $EUID -eq 0 ]]; then
dpkg -i "$tmp_file" || apt-get install -f -y
else
sudo dpkg -i "$tmp_file" || sudo apt-get install -f -y
fi
;;
*)
cp "$tmp_file" "$install_dir/"
;;
esac
cleanup_github_release
# 把 bin 目录加入 PATH（当前 session）
if [[ -d "$install_dir/bin" ]]; then
export PATH="$install_dir/bin:$PATH"
else
export PATH="$install_dir:$PATH"
fi
log_ok "已安装到 $install_dir"
}
# 注册 MCP server 到 Claude 配置
register_mcp_server() {
local server_name="$1"
local config_json="$2" # JSON 格式的 server 配置
local config_path
config_path=$(get_claude_mcp_config_path)
local config_dir
config_dir=$(dirname "$config_path")
mkdir -p "$config_dir"
if [[ ! -f "$config_path" ]]; then
echo '{"mcpServers":{}}' > "$config_path"
fi
if command -v jq &>/dev/null; then
local tmp_file="/tmp/mcp-config-$$.json"
jq ".mcpServers.\"${server_name}\" = ${config_json}" "$config_path" > "$tmp_file"
mv "$tmp_file" "$config_path"
log_ok "MCP server '$server_name' 已注册到 $config_path"
else
log_warn "未安装 jq，无法自动注册 MCP server。请手动编辑 $config_path"
fi
}
# 等待端口就绪
wait_for_port() {
local port="$1"
local timeout="${2:-90}"
local elapsed=0
while [[ $elapsed -lt $timeout ]]; do
if test_tcp_port "$port" 2>/dev/null; then
return 0
fi
sleep 2
elapsed=$((elapsed + 2))
done
return 1
}
# ─── 能力安装逻辑 ──────────────────────────────────────────────────────────────────
manifest_field() {
local capability="$1"
local field="$2"
if [[ ! -f "$KALI_MANIFEST" ]] || ! command -v jq &>/dev/null; then
return 1
fi
jq -er --arg name "$capability" --arg field "$field" \
'.capabilities[] | select(.name == $name) | .[$field] // empty' "$KALI_MANIFEST"
}
install_manifest_release() {
local capability="$1"
local repo asset_regex install_dir release_tag asset_sha256
repo=$(manifest_field "$capability" repo) || {
log_err "manifest 中缺少 $capability.repo"
return 1
}
asset_regex=$(manifest_field "$capability" assetRegex) || {
log_err "manifest 中缺少 $capability.assetRegex"
return 1
}
install_dir=$(manifest_field "$capability" installDir) || {
log_err "manifest 中缺少 $capability.installDir"
return 1
}
release_tag=$(manifest_field "$capability" releaseTag) || {
log_err "manifest 中缺少 $capability.releaseTag；拒绝使用 latest"
return 1
}
asset_sha256=$(manifest_field "$capability" assetSha256) || {
log_err "manifest 中缺少 $capability.assetSha256；拒绝下载未固定资产"
return 1
}
install_dir="${install_dir/\$HOME/$HOME}"
install_github_release "$repo" "$asset_regex" "$install_dir" "$release_tag" "$asset_sha256"
}
ensure_capability() {
local name="$1"
# 先检查是否已可用
if command -v "$name" &>/dev/null; then
log_ok "$name 已可用: $(command -v "$name")"
return 0
fi
log_info "开始安装: $name"
case "$name" in
# ─── apt 预装/可装的工具 ───
nmap|sqlmap|hashcat|hydra|gobuster|ffuf|adb|bkcrack)
install_apt_package "$name"
;;
msfconsole)
install_apt_package "metasploit-framework"
;;
r2|rabin2|rasm2|radiff2|rahash2|rax2)
if ! command -v r2 &>/dev/null; then
install_apt_package "radare2"
fi
;;
apktool)
install_apt_package "apktool"
;;
seclists)
install_apt_package "seclists"
;;
# ─── Kali 2026.1 新增工具（全部 apt 直装） ───
adaptixc2)
install_apt_package "adaptixc2"
;;
atomic-operator)
install_apt_package "atomic-operator"
;;
fluxion)
install_apt_package "fluxion"
;;
gef)
install_apt_package "gef"
log_info "GEF 已安装。启动 gdb 时自动加载 GEF 增强功能。"
;;
sstimap)
install_apt_package "sstimap"
;;
xsstrike)
install_apt_package "xsstrike"
;;
wpprobe)
install_apt_package "wpprobe"
;;
evil-winrm-py)
install_apt_package "evil-winrm-py"
;;
coercer)
install_apt_package "coercer"
;;
netexec)
install_apt_package "netexec"
;;
responder)
install_apt_package "responder"
;;
crackmapexec)
install_apt_package "crackmapexec"
;;
bloodhound)
install_apt_package "bloodhound"
;;
certipy)
install_apt_package "certipy-ad"
;;
wfuzz)
install_apt_package "wfuzz"
;;
aircrack-ng)
install_apt_package "aircrack-ng"
;;
# ─── Kali 原生 MCP 工具（apt 安装 + MCP 注册） ───
mcp-kali-server)
install_apt_package "mcp-kali-server"
register_mcp_server "kali-server" '{
"command": "kali-server-mcp",
"args": ["--port", "5000"]
}'
log_info "启动方式: kali-server-mcp --port 5000"
log_info "然后用 mcp-server 连接 AI 客户端到 API server"
;;
metasploitmcp)
install_apt_package "metasploitmcp"
register_mcp_server "metasploit-mcp" '{
"command": "metasploitmcp",
"args": ["--transport", "stdio"]
}'
log_info "MetasploitMCP 支持 stdio 和 HTTP 两种模式"
log_info " stdio: metasploitmcp --transport stdio"
log_info " HTTP: metasploitmcp --transport http --port 8085"
;;
hexstrike-ai)
install_apt_package "hexstrike-ai"
register_mcp_server "hexstrike" '{
"command": "hexstrike-ai",
"args": []
}'
log_info "HexStrike AI 已安装。150+ 安全工具通过 MCP 暴露给 AI agent。"
;;
# ─── Pentest Swarm AI（群体智能渗透框架） ───
pentestswarm)
if command -v pentestswarm &>/dev/null; then
log_ok "pentestswarm 已可用"
elif command -v go &>/dev/null; then
log_info "go install pentestswarm ..."
go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0
elif command -v docker &>/dev/null; then
log_info "拉取 pentestswarm Docker 镜像 ..."
docker pull ghcr.io/armur-ai/pentestswarm:v0.1.0
log_info "使用方式: docker run --rm ghcr.io/armur-ai/pentestswarm:v0.1.0 scan <target> --scope <scope>"
else
log_warn "需要 Go 1.24+ 或 Docker 来安装 pentestswarm"
log_info "安装 Go: apt install golang-go"
log_info "然后: go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0"
return 1
fi
register_mcp_server "pentestswarm" '{
"command": "pentestswarm",
"args": ["mcp", "serve"]
}'
log_info "Pentest Swarm AI 已配置"
log_info " MCP 模式: pentestswarm mcp serve"
log_info " 扫描模式: pentestswarm scan <target> --scope <scope> --swarm"
log_info " 需要设置: export PENTESTSWARM_ORCHESTRATOR_API_KEY=<your-claude-key>"
;;
# ─── pip 安装 ───
frida|frida-ps)
install_pip_package "frida-tools==14.10.4"
;;
idalib-mcp)
install_pip_package "ida-pro-mcp" "git+https://github.com/mrexodia/ida-pro-mcp.git@f82e6e2517a161b77e738951c3071cd446480ba0"
log_info "运行 ida-pro-mcp --install 完成 IDA 插件安装"
;;
proxycat)
local proxycat_dir="$HOME/tools/ProxyCat"
install_git_commit \
"https://github.com/honmashironeko/ProxyCat.git" \
"2309b713e2e4f574df14c2ace7e8fa6c00eb6941" \
"$proxycat_dir"
pip3 install --upgrade -r "$proxycat_dir/requirements.txt" --break-system-packages 2>/dev/null \
|| pip3 install --upgrade -r "$proxycat_dir/requirements.txt"
local proxycat_bin_dir="$HOME/.local/bin"
local proxycat_wrapper="$proxycat_bin_dir/proxycat"
mkdir -p "$proxycat_bin_dir"
cat > "$proxycat_wrapper" <<EOF
#!/usr/bin/env bash
exec python3 "$proxycat_dir/ProxyCat.py" "\$@"
EOF
chmod 0755 "$proxycat_wrapper"
log_info "ProxyCat installed at pinned commit; command wrapper: $proxycat_wrapper"
if [[ ":$PATH:" != *":$proxycat_bin_dir:"* ]]; then
log_warn "Add $proxycat_bin_dir to PATH before using the proxycat command."
fi
;;
pwntools)
install_pip_package "pwntools==4.15.0"
;;
# ─── GitHub Release ───
jadx)
install_manifest_release "jadx"
chmod +x "$HOME/tools/jadx/bin/jadx" 2>/dev/null || true
;;
ghidra-mcp)
if command -v ghidra &>/dev/null; then
log_ok "ghidra 已通过 apt 安装"
else
install_apt_package "ghidra" 2>/dev/null \
|| install_github_release "NationalSecurityAgency/ghidra" "^ghidra_.*_PUBLIC_.*\\.zip$" "$HOME/tools/ghidra"
fi
log_warn "GhidraMCP 插件需手动安装: https://github.com/LaurieWired/GhidraMCP/releases"
;;
nuclei)
if command -v go &>/dev/null; then
log_info "go install nuclei ..."
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.8.0
else
install_github_release "projectdiscovery/nuclei" "^nuclei_.*_linux_amd64\\.zip$" "$HOME/tools/nuclei" "v3.8.0"
fi
;;
# ─── npm/MCP ───
jeb-pro)
log_warn "MANUAL_INSTALL_REQUIRED: jeb-pro"
log_warn "JEB Pro 是商业工具；请从 PNF Software 获取有效许可证后手动安装。社区 MCP 桥接必须先按 skill-supply-chain.md 审查。"
LAST_CAPABILITY_MANUAL=true
MANUAL_REQUIRED=true
return 0
;;
reqable-mcp)
if ! command -v node &>/dev/null; then
install_apt_package "nodejs"
fi
if ! command -v npm &>/dev/null; then
install_apt_package "npm"
fi
register_mcp_server "reqable-mcp" '{
"command": "npx",
"args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
}'
log_warn "Reqable MCP 需要单独安装 Reqable 桌面客户端并启用其本地 API。"
;;
jshookmcp)
if ! command -v node &>/dev/null; then
install_apt_package "nodejs"
fi
if ! command -v npm &>/dev/null; then
install_apt_package "npm"
fi
register_mcp_server "jshook" '{
"command": "npx",
"args": ["-y", "@jshookmcp/jshook@0.3.4"],
"env": {"JSHOOK_BASE_PROFILE": "search"}
}'
;;
agent-browser)
if ! command -v node &>/dev/null; then
install_apt_package "nodejs"
fi
install_npm_global "agent-browser@0.31.1"
npx playwright install chromium 2>/dev/null || true
;;
# ─── 本地 HTTP MCP 服务 ───
anything-analyzer)
register_mcp_server "anything-analyzer" "{\"url\": \"http://localhost:23816/mcp\"}"
if [[ "$START_SERVICES" == "true" ]]; then
start_anything_analyzer
fi
;;
idapro)
# 先确保 idalib-mcp 已安装
ensure_capability "idalib-mcp"
register_mcp_server "idapro" "{\"url\": \"http://127.0.0.1:13337/mcp\"}"
if [[ "$START_SERVICES" == "true" ]]; then
start_idapro_service
fi
;;
# ─── 手动安装 ───
burpsuite-mcp)
log_warn "MANUAL_INSTALL_REQUIRED: burpsuite-mcp"
log_warn "Kali 预装 BurpSuite，在扩展市场搜索 MCP 插件安装"
register_mcp_server "burpsuite" "{\"url\": \"http://localhost:9876/mcp\"}"
;;
*)
log_err "未知能力: $name"
return 1
;;
esac
}
# ─── 服务启动 ──────────────────────────────────────────────────────────────────────
start_anything_analyzer() {
if test_tcp_port 23816 2>/dev/null; then
log_ok "anything-analyzer 已在运行 (port 23816)"
return 0
fi
local repo_dir="$HOME/tools/anything-analyzer"
if [[ ! -d "$repo_dir" ]]; then
log_info "克隆 anything-analyzer ..."
git clone https://github.com/Mouseww/anything-analyzer.git "$repo_dir"
fi
if ! command -v pnpm &>/dev/null; then
npm install -g pnpm
fi
(cd "$repo_dir" && pnpm install && nohup pnpm dev > /tmp/anything-analyzer.log 2>&1 &)
log_info "等待 anything-analyzer 启动 (port 23816) ..."
if wait_for_port 23816 120; then
log_ok "anything-analyzer 已启动"
else
log_err "anything-analyzer 启动超时，查看日志: /tmp/anything-analyzer.log"
return 1
fi
}
start_idapro_service() {
if test_tcp_port 13337 2>/dev/null; then
log_ok "IDA Pro MCP 已在运行 (port 13337)"
return 0
fi
local ida_start_script="$SCRIPT_DIR/ida-start.sh"
if [[ -x "$ida_start_script" ]]; then
bash "$ida_start_script"
else
log_warn "IDA 启动脚本不存在: $ida_start_script"
log_warn "请手动启动 IDA Pro，插件会自动监听 13337 端口"
return 1
fi
}
# ─── 主流程 ────────────────────────────────────────────────────────────────────────
RESULTS=()
for cap in "${CAPABILITIES[@]}"; do
LAST_CAPABILITY_MANUAL=false
if ensure_capability "$cap"; then
if [[ "$LAST_CAPABILITY_MANUAL" == "true" ]]; then
RESULTS+=("{\"name\":\"$cap\",\"status\":\"manual-required\"}")
else
RESULTS+=("{\"name\":\"$cap\",\"status\":\"ready\"}")
fi
else
RESULTS+=("{\"name\":\"$cap\",\"status\":\"failed\"}")
fi
done
# 刷新工具索引
if [[ "$SKIP_REFRESH" != "true" ]]; then
log_info "刷新工具索引 ..."
bash "$SCRIPT_DIR/refresh-tool-index.sh" >/dev/null 2>&1 || true
fi
final_exit_code=0
if [[ "$MANUAL_REQUIRED" == "true" ]]; then
final_exit_code=2
fi
# 输出结果
echo ""
echo "═══════════════════════════════════════════"
echo " Bootstrap 完成"
echo "═══════════════════════════════════════════"
for r in "${RESULTS[@]}"; do
name=$(echo "$r" | jq -r '.name' 2>/dev/null || echo "$r")
status=$(echo "$r" | jq -r '.status' 2>/dev/null || echo "unknown")
if [[ "$status" == "ready" ]]; then
echo " ✓ $name"
elif [[ "$status" == "manual-required" ]]; then
echo " ! $name (manual install required)"
else
echo " ✗ $name (failed)"
fi
done
echo ""
exit "$final_exit_code"

58
reverse-skill-repo/kali/scripts/ida-start.sh Normal file
View File

@@ -0,0 +1,58 @@
#!/usr/bin/env bash
# ida-start.sh — 启动 IDA Pro MCP HTTP 服务 (Linux 版)
# 等价于 Windows 版的 ida-reverse/scripts/start.ps1
set -euo pipefail
# ─── 配置（根据你的实际安装修改） ─────────────────────────────────────────────────────
IDADIR="${IDADIR:-/opt/idapro}"
MCP_PORT="${IDA_MCP_PORT:-13337}"
# idalib-mcp 可执行文件路径（pip install 后通常在 PATH 中）
MCP_SERVER_CMD="${IDA_MCP_SERVER:-ida-pro-mcp}"
# ─── 检查 ─────────────────────────────────────────────────────────────────────────
if [[ ! -d "$IDADIR" ]]; then
echo "ERR: IDADIR 不存在: $IDADIR"
echo "请设置环境变量 IDADIR 指向 IDA Pro 安装目录"
exit 1
fi
if ! command -v "$MCP_SERVER_CMD" &>/dev/null; then
echo "ERR: $MCP_SERVER_CMD 未找到"
echo "请先运行: pip3 install git+https://github.com/mrexodia/ida-pro-mcp.git"
exit 1
fi
# ─── 杀掉旧进程 ───────────────────────────────────────────────────────────────────
pkill -f "ida-pro-mcp" 2>/dev/null || true
sleep 1
# ─── 启动服务 ──────────────────────────────────────────────────────────────────────
echo "INFO: 启动 IDA MCP HTTP 服务 (port $MCP_PORT) ..."
export IDADIR
nohup "$MCP_SERVER_CMD" --port "$MCP_PORT" > /tmp/ida-mcp.log 2>&1 &
MCP_PID=$!
# ─── 等待就绪 ──────────────────────────────────────────────────────────────────────
TIMEOUT=45
ELAPSED=0
while [[ $ELAPSED -lt $TIMEOUT ]]; do
if nc -z 127.0.0.1 "$MCP_PORT" 2>/dev/null; then
echo "OK: IDA MCP 服务已就绪 (PID=$MCP_PID, port=$MCP_PORT)"
exit 0
fi
sleep 2
ELAPSED=$((ELAPSED + 2))
done
echo "ERR: 超时 ${TIMEOUT}s，服务未就绪"
echo "查看日志: /tmp/ida-mcp.log"
exit 1

252
reverse-skill-repo/kali/scripts/lib/tool-discovery.sh Normal file
View File

@@ -0,0 +1,252 @@
#!/usr/bin/env bash
# tool-discovery.sh — Kali Linux 版工具发现库
# 等价于 Windows 版的 ToolDiscovery.ps1
set -euo pipefail
# ─── 路径推导 ───────────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
KALI_SCRIPTS_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
KALI_DIR="$(cd "$KALI_SCRIPTS_DIR/.." && pwd)"
PROJECT_ROOT="$(cd "$KALI_DIR/.." && pwd)"
SKILL_ROOT="$PROJECT_ROOT/skills"
# ─── 工具目录定义 ─────────────────────────────────────────────────────────────────
# 每个工具的定义格式: name|skill|purpose|version_args|fallback_commands
# fallback_commands 用逗号分隔
declare -a TOOL_CATALOG=(
"jadx|apk-reverse|Java 反编译|--version|jadx,${HOME}/tools/jadx/bin/jadx,/opt/jadx/bin/jadx"
"apktool|apk-reverse|APK 解包与重建|--version|apktool,${HOME}/tools/apktool/apktool,/usr/local/bin/apktool"
"adb|apk-reverse|设备连接与 logcat|version|adb,${HOME}/Android/Sdk/platform-tools/adb"
"java|apk-reverse|运行 jar 与 Java 工具链|-version|java"
"apksigner|apk-reverse|APK 签名|--version|apksigner,${HOME}/Android/Sdk/build-tools/*/apksigner"
"zipalign|apk-reverse|APK 对齐||zipalign,${HOME}/Android/Sdk/build-tools/*/zipalign"
"frida|apk-reverse|Frida 动态注入|--version|frida"
"frida-ps|apk-reverse|Frida 进程枚举|--version|frida-ps"
"r2|radare2|radare2 主分析器|-v|r2,radare2,${HOME}/tools/radare2/bin/r2,/usr/bin/r2"
"rabin2|radare2|二进制侦察|-v|rabin2,${HOME}/tools/radare2/bin/rabin2,/usr/bin/rabin2"
"rasm2|radare2|汇编/反汇编|-v|rasm2,${HOME}/tools/radare2/bin/rasm2"
"radiff2|radare2|二进制差分|-v|radiff2,${HOME}/tools/radare2/bin/radiff2"
"rahash2|radare2|哈希与校验|-v|rahash2,${HOME}/tools/radare2/bin/rahash2"
"rax2|radare2|进制与位运算转换|-v|rax2,${HOME}/tools/radare2/bin/rax2"
"python|reverse-engineering|辅助脚本执行|--version|python3,python"
"pip|reverse-engineering|Python 包管理|--version|pip3,pip"
"node|js-reverse|运行 Node 侧 JS 复现与 MCP 客户端|--version|node"
"npx|js-reverse|运行临时 npm 包与 MCP 入口|--version|npx"
"jshookmcp|js-reverse|通过 npx 启动 @jshookmcp/jshook MCP||npx"
"reqable-mcp|pentest-tools|通过 npx 启动 Reqable 桌面客户端 MCP||npx"
"jeb-pro|apk-reverse|商业 Android/ARM 反编译器（手动许可安装）|--version|jeb,${HOME}/tools/JEB/jeb,${HOME}/JEB/jeb,/opt/jeb/jeb"
"agent-browser|browser-automation|浏览器自动化（Playwright）|--version|agent-browser"
"analyzeHeadless|reverse-engineering|Ghidra 无头分析||analyzeHeadless,${HOME}/tools/ghidra/support/analyzeHeadless,/opt/ghidra/support/analyzeHeadless,/usr/share/ghidra/support/analyzeHeadless"
"playwright|browser-automation|Playwright 浏览器引擎|--version|playwright,npx playwright"
"proxycat|pentest-tools|代理池管理与轮换|--version|proxycat"
"nmap|pentest-tools|端口扫描与服务识别|--version|nmap"
"sqlmap|pentest-tools|SQL 注入自动化|--version|sqlmap"
"hashcat|pentest-tools|密码破解|--version|hashcat"
"hydra|pentest-tools|在线密码爆破|-h|hydra"
"gobuster|pentest-tools|目录爆破|version|gobuster"
"ffuf|pentest-tools|模糊测试|-V|ffuf"
"msfconsole|pentest-tools|Metasploit 框架|--version|msfconsole"
"nikto|pentest-tools|Web 漏洞扫描|-Version|nikto"
"binwalk|reverse-engineering|固件分析与提取|--help|binwalk"
"bkcrack|reverse-engineering|CTF ZIP/PKZIP ZipCrypto 已知明文攻击|--version|bkcrack"
"gdb|reverse-engineering|调试器|--version|gdb"
"objdump|reverse-engineering|反汇编|--version|objdump"
"strings|reverse-engineering|字符串提取|--version|strings"
"file|reverse-engineering|文件类型识别|--version|file"
"nuclei|pentest-tools|漏洞扫描|-version|nuclei"
# ─── Kali 2026.1 新增工具 ───
"metasploitmcp|pentest-tools|Metasploit MCP Server|-h|metasploitmcp"
"mcp-kali-server|pentest-tools|Kali 官方 MCP Server（终端桥接）|-h|kali-server-mcp,mcp-server"
"hexstrike-ai|pentest-tools|AI MCP 安全自动化平台（150+ 工具）||hexstrike-ai"
"adaptixc2|pentest-tools|后渗透与对抗模拟框架||AdaptixServer"
"atomic-operator|pentest-tools|Atomic Red Team 测试执行|--help|atomic-operator"
"sstimap|pentest-tools|SSTI 自动检测与利用|-h|sstimap"
"xsstrike|pentest-tools|高级 XSS 扫描器|-h|xsstrike"
"wpprobe|pentest-tools|WordPress 插件枚举|--help|wpprobe"
"fluxion|pentest-tools|WiFi 安全审计与社工||fluxion"
"gef|reverse-engineering|GDB Enhanced Features（现代化调试）||gdb"
"evil-winrm-py|pentest-tools|Python WinRM 远程执行|-h|evil-winrm-py"
"coercer|pentest-tools|Windows 认证强制（AD 攻击）|-h|coercer"
"pentestswarm|pentest-tools|群体智能自主渗透框架（Swarm AI）|--version|pentestswarm"
# ─── Kali 经典预装但之前未列入的工具 ───
"netexec|pentest-tools|网络服务枚举与利用（CrackMapExec 继任）|--help|nxc,netexec"
"responder|pentest-tools|LLMNR/NBT-NS/MDNS 投毒|-h|responder"
"crackmapexec|pentest-tools|网络渗透瑞士军刀|--help|crackmapexec,cme"
"bloodhound|pentest-tools|AD 攻击路径可视化||bloodhound"
"certipy|pentest-tools|AD 证书服务攻击|--version|certipy"
"wfuzz|pentest-tools|Web 模糊测试|--help|wfuzz"
"john|pentest-tools|密码破解||john"
"aircrack-ng|pentest-tools|WiFi 破解套件|--help|aircrack-ng"
"wireshark|pentest-tools|网络协议分析|--version|wireshark,tshark"
"burpsuite|pentest-tools|Web 代理与漏洞扫描||burpsuite"
)
# 脚本引用映射
declare -A SCRIPT_REFS=(
["jadx"]="apk-reverse/scripts/decode.sh"
["apktool"]="apk-reverse/scripts/decode.sh,apk-reverse/scripts/rebuild-sign-install.sh"
["adb"]="apk-reverse/scripts/rebuild-sign-install.sh"
["java"]="apk-reverse/scripts/decode.sh"
["apksigner"]="apk-reverse/scripts/rebuild-sign-install.sh"
["zipalign"]="apk-reverse/scripts/rebuild-sign-install.sh"
["frida"]="apk-reverse/scripts/frida-run.sh"
["frida-ps"]="apk-reverse/scripts/frida-run.sh"
["r2"]="radare2/scripts/recon.sh"
["rabin2"]="radare2/scripts/recon.sh"
["rasm2"]="radare2/SKILL.md"
["radiff2"]="radare2/SKILL.md"
["rahash2"]="radare2/SKILL.md"
["rax2"]="radare2/SKILL.md"
["python"]="apk-reverse/scripts/frida-run.sh"
["node"]="js-reverse/SKILL.md"
["npx"]="js-reverse/SKILL.md"
["jshookmcp"]="js-reverse/SKILL.md"
["reqable-mcp"]="pentest-tools/SKILL.md"
["jeb-pro"]="apk-reverse/SKILL.md"
["agent-browser"]="browser-automation/SKILL.md"
["playwright"]="browser-automation/SKILL.md"
["nmap"]="pentest-tools/SKILL.md"
["proxycat"]="pentest-tools/SKILL.md"
["metasploitmcp"]="pentest-tools/SKILL.md"
["mcp-kali-server"]="pentest-tools/SKILL.md"
["hexstrike-ai"]="pentest-tools/SKILL.md"
["adaptixc2"]="pentest-tools/SKILL.md"
["sstimap"]="pentest-tools/SKILL.md"
["xsstrike"]="pentest-tools/SKILL.md"
["wpprobe"]="pentest-tools/SKILL.md"
["coercer"]="pentest-tools/SKILL.md"
["pentestswarm"]="pentest-tools/SKILL.md"
["evil-winrm-py"]="pentest-tools/SKILL.md"
["gef"]="reverse-engineering/SKILL.md"
["bkcrack"]="reverse-engineering/crypto-decode-tools.md,../CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md"
["netexec"]="pentest-tools/SKILL.md"
["responder"]="pentest-tools/SKILL.md"
)
# ─── 工具发现函数 ─────────────────────────────────────────────────────────────────
# 查找命令的完整路径
find_command() {
local name="$1"
command -v "$name" 2>/dev/null || true
}
# 检测端口是否在监听
test_tcp_port() {
local port="$1"
local host="${2:-127.0.0.1}"
(echo >/dev/tcp/"$host"/"$port") 2>/dev/null && return 0
# fallback to nc
nc -z "$host" "$port" 2>/dev/null && return 0
return 1
}
# 获取工具版本
get_tool_version() {
local cmd="$1"
local version_args="$2"
if [[ -z "$version_args" ]]; then
echo ""
return
fi
local output
output=$("$cmd" $version_args 2>&1 | head -n1) || true
echo "$output"
}
# 解析工具定义并检测可用性
# 返回: name|skill|purpose|available|resolved_path|version|source
resolve_tool() {
local entry="$1"
IFS='|' read -r name skill purpose version_args fallbacks <<< "$entry"
IFS=',' read -ra candidates <<< "$fallbacks"
for candidate in "${candidates[@]}"; do
# 展开 glob（如 build-tools/*/apksigner）
local expanded
expanded=$(compgen -G "$candidate" 2>/dev/null | head -n1) || expanded=""
if [[ -n "$expanded" && -x "$expanded" ]]; then
local ver
ver=$(get_tool_version "$expanded" "$version_args")
echo "${name}|${skill}|${purpose}|yes|${expanded}|${ver}|path"
return
fi
# 尝试作为命令名查找
local cmd_path
cmd_path=$(find_command "$candidate")
if [[ -n "$cmd_path" ]]; then
local ver
ver=$(get_tool_version "$cmd_path" "$version_args")
echo "${name}|${skill}|${purpose}|yes|${cmd_path}|${ver}|command"
return
fi
done
# 未找到
echo "${name}|${skill}|${purpose}|no|||missing"
}
# 获取 MCP 配置路径（Claude Code）
get_claude_mcp_config_path() {
echo "${HOME}/.claude/mcp.json"
}
# 检查 MCP server 是否已注册
check_mcp_registered() {
local server_name="$1"
local config_path
config_path=$(get_claude_mcp_config_path)
if [[ ! -f "$config_path" ]]; then
echo "false"
return
fi
if command -v jq &>/dev/null; then
local result
result=$(jq -r ".mcpServers.\"${server_name}\" // empty" "$config_path" 2>/dev/null)
if [[ -n "$result" ]]; then
echo "true"
else
echo "false"
fi
else
# fallback: grep
if grep -q "\"${server_name}\"" "$config_path" 2>/dev/null; then
echo "true"
else
echo "false"
fi
fi
}
# 获取 bootstrap manifest 路径
get_bootstrap_manifest_path() {
echo "${KALI_SCRIPTS_DIR}/bootstrap-manifest.json"
}
# 从 manifest 获取能力定义（需要 jq）
get_capability_definition() {
local name="$1"
local manifest
manifest=$(get_bootstrap_manifest_path)
if [[ ! -f "$manifest" ]]; then
echo ""
return
fi
if command -v jq &>/dev/null; then
jq -r ".capabilities[] | select(.name == \"${name}\")" "$manifest" 2>/dev/null
else
echo ""
fi
}

244
reverse-skill-repo/kali/scripts/quick-setup.sh Normal file
View File

@@ -0,0 +1,244 @@
#!/usr/bin/env bash
# quick-setup.sh — Kali 2026.1 一键初始化
# 在全新 Kali 系统上运行此脚本，自动完成：
# 1. 系统更新
# 2. 安装 Kali 2026.1 新工具
# 3. 配置 Kali 原生 MCP
# 4. 安装非预装的逆向工具
# 5. 刷新工具索引
# 6. 输出配置报告
#
# 用法:
# sudo bash kali/scripts/quick-setup.sh [--skip-update] [--minimal]
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# ─── 参数 ──────────────────────────────────────────────────────────────────────────
SKIP_UPDATE=false
MINIMAL=false
for arg in "$@"; do
case "$arg" in
--skip-update) SKIP_UPDATE=true ;;
--minimal) MINIMAL=true ;;
esac
done
# ─── 颜色 ──────────────────────────────────────────────────────────────────────────
RED='\033[31m'
GREEN='\033[32m'
YELLOW='\033[33m'
CYAN='\033[36m'
BOLD='\033[1m'
RESET='\033[0m'
banner() { echo -e "\n${BOLD}${CYAN}═══ $* ═══${RESET}\n"; }
ok() { echo -e "${GREEN}[✓]${RESET} $*"; }
warn() { echo -e "${YELLOW}[!]${RESET} $*"; }
info() { echo -e "${CYAN}[i]${RESET} $*"; }
# ─── 检查权限 ──────────────────────────────────────────────────────────────────────
if [[ $EUID -ne 0 ]]; then
echo "请使用 root 权限运行: sudo bash $0"
exit 1
fi
# ─── 检查 Kali 版本 ────────────────────────────────────────────────────────────────
banner "检查系统版本"
if [[ -f /etc/os-release ]]; then
. /etc/os-release
info "系统: $PRETTY_NAME"
info "版本: ${VERSION:-unknown}"
info "内核: $(uname -r)"
else
warn "无法检测系统版本，继续执行..."
fi
# ─── 系统更新 ──────────────────────────────────────────────────────────────────────
if [[ "$SKIP_UPDATE" != "true" ]]; then
banner "系统更新"
apt-get update -qq
apt-get upgrade -y -qq
ok "系统已更新"
else
info "跳过系统更新 (--skip-update)"
fi
# ─── 安装 Kali 2026.1 新工具 ──────────────────────────────────────────────────────
banner "安装 Kali 2026.1 新工具"
NEW_TOOLS_2026_1=(
"adaptixc2"
"atomic-operator"
"fluxion"
"gef"
"metasploitmcp"
"sstimap"
"wpprobe"
"xsstrike"
)
NEW_TOOLS_2025_4=(
"evil-winrm-py"
"hexstrike-ai"
)
for tool in "${NEW_TOOLS_2026_1[@]}" "${NEW_TOOLS_2025_4[@]}"; do
if dpkg -l "$tool" &>/dev/null 2>&1; then
ok "$tool 已安装"
else
info "安装 $tool ..."
apt-get install -y -qq "$tool" 2>/dev/null && ok "$tool 安装成功" || warn "$tool 安装失败（可能尚未在你的源中）"
fi
done
# ─── 安装 Kali 原生 MCP ──────────────────────────────────────────────────────────
banner "配置 Kali 原生 MCP"
MCP_TOOLS=("mcp-kali-server" "metasploitmcp" "hexstrike-ai")
for tool in "${MCP_TOOLS[@]}"; do
if dpkg -l "$tool" &>/dev/null 2>&1; then
ok "$tool 已安装"
else
info "安装 $tool ..."
apt-get install -y -qq "$tool" 2>/dev/null && ok "$tool 安装成功" || warn "$tool 安装失败"
fi
done
# ─── 安装 AD/内网渗透工具 ─────────────────────────────────────────────────────────
if [[ "$MINIMAL" != "true" ]]; then
banner "安装 AD/内网渗透工具"
AD_TOOLS=("coercer" "netexec" "responder" "bloodhound" "certipy-ad")
for tool in "${AD_TOOLS[@]}"; do
if dpkg -l "$tool" &>/dev/null 2>&1; then
ok "$tool 已安装"
else
info "安装 $tool ..."
apt-get install -y -qq "$tool" 2>/dev/null && ok "$tool 安装成功" || warn "$tool 安装失败"
fi
done
fi
# ─── 安装非预装逆向工具 ───────────────────────────────────────────────────────────
banner "安装逆向分析工具"
# jadx（Kali 不预装，从 GitHub 下载）
if ! command -v jadx &>/dev/null; then
info "安装 jadx（从 GitHub Release）..."
bash "$SCRIPT_DIR/bootstrap-reverse.sh" jadx --skip-refresh 2>/dev/null && ok "jadx 安装成功" || warn "jadx 安装失败"
else
ok "jadx 已可用"
fi
# Node.js（部分 MCP 需要）
if ! command -v node &>/dev/null; then
info "安装 Node.js ..."
apt-get install -y -qq nodejs npm && ok "Node.js 安装成功" || warn "Node.js 安装失败"
else
ok "Node.js 已可用: $(node -v)"
fi
# frida-tools
if ! command -v frida &>/dev/null; then
info "安装 frida-tools ..."
pip3 install --break-system-packages frida-tools 2>/dev/null && ok "frida-tools 安装成功" || warn "frida-tools 安装失败"
else
ok "frida 已可用"
fi
# ─── 配置 MCP 客户端 ──────────────────────────────────────────────────────────────
banner "配置 MCP 客户端"
# 检测实际用户（sudo 下 $HOME 可能是 /root）
REAL_USER="${SUDO_USER:-root}"
REAL_HOME="$(getent passwd "$REAL_USER" 2>/dev/null | cut -d: -f6 || true)"
if [[ -z "$REAL_HOME" || ! -d "$REAL_HOME" ]]; then
REAL_USER="root"
REAL_HOME="$(getent passwd root 2>/dev/null | cut -d: -f6 || true)"
fi
if [[ -z "$REAL_HOME" || ! -d "$REAL_HOME" ]]; then
REAL_HOME="/root"
fi
MCP_CONFIG_DIR="$REAL_HOME/.claude"
MCP_CONFIG="$MCP_CONFIG_DIR/mcp.json"
if command -v jq &>/dev/null; then
mkdir -p "$MCP_CONFIG_DIR"
if [[ ! -f "$MCP_CONFIG" ]]; then
echo '{"mcpServers":{}}' > "$MCP_CONFIG"
fi
# 注册 kali-server
jq '.mcpServers["kali-server"] = {"command": "kali-server-mcp", "args": ["--port", "5000"]}' "$MCP_CONFIG" > /tmp/mcp-tmp.json && mv /tmp/mcp-tmp.json "$MCP_CONFIG"
# 注册 metasploit-mcp
jq '.mcpServers["metasploit-mcp"] = {"command": "metasploitmcp", "args": ["--transport", "stdio"]}' "$MCP_CONFIG" > /tmp/mcp-tmp.json && mv /tmp/mcp-tmp.json "$MCP_CONFIG"
# 注册 hexstrike
jq '.mcpServers["hexstrike"] = {"command": "hexstrike-ai", "args": []}' "$MCP_CONFIG" > /tmp/mcp-tmp.json && mv /tmp/mcp-tmp.json "$MCP_CONFIG"
# 注册 jshook
jq '.mcpServers["jshook"] = {"command": "npx", "args": ["-y", "@jshookmcp/jshook@0.3.4"], "env": {"JSHOOK_BASE_PROFILE": "search"}}' "$MCP_CONFIG" > /tmp/mcp-tmp.json && mv /tmp/mcp-tmp.json "$MCP_CONFIG"
chown "$REAL_USER:$REAL_USER" "$MCP_CONFIG" "$MCP_CONFIG_DIR"
ok "MCP 配置已写入: $MCP_CONFIG"
else
warn "未安装 jq，无法自动配置 MCP。请手动复制 kali/mcp-kali-example.json"
info "安装 jq: apt install jq"
fi
# ─── 刷新工具索引 ──────────────────────────────────────────────────────────────────
banner "刷新工具索引"
chmod +x "$SCRIPT_DIR"/*.sh "$SCRIPT_DIR"/lib/*.sh
sudo -u "$REAL_USER" bash "$SCRIPT_DIR/refresh-tool-index.sh" 2>/dev/null || bash "$SCRIPT_DIR/refresh-tool-index.sh"
ok "工具索引已刷新"
# ─── 输出报告 ──────────────────────────────────────────────────────────────────────
banner "配置完成"
echo -e "${BOLD}✅ Kali 2026.1 逆向技能路由包已配置完成${RESET}"
echo ""
echo " 安装路径: $(cd "$SCRIPT_DIR/../.." && pwd)"
echo " MCP 配置: $MCP_CONFIG"
echo " 工具索引: $(cd "$SCRIPT_DIR/../.." && pwd)/skills/tool-index.md"
echo ""
echo " Kali 原生 MCP:"
command -v kali-server-mcp &>/dev/null && echo " ✓ mcp-kali-server" || echo " ✗ mcp-kali-server"
command -v metasploitmcp &>/dev/null && echo " ✓ metasploitmcp" || echo " ✗ metasploitmcp"
command -v hexstrike-ai &>/dev/null && echo " ✓ hexstrike-ai" || echo " ✗ hexstrike-ai"
echo ""
echo " 2026.1 新工具:"
for tool in "${NEW_TOOLS_2026_1[@]}"; do
if dpkg -l "$tool" &>/dev/null 2>&1; then
echo " ✓ $tool"
else
echo " ✗ $tool"
fi
done
echo ""
echo " 下一步:"
echo " 1. 告诉你的 AI 客户端读取 kali/RULES-kali.md"
echo " 2. 或者直接问 AI：'读一下 kali/RULES-kali.md 并执行配置'"
echo " 3. 之后遇到安全/逆向任务会自动路由"
echo ""

189
reverse-skill-repo/kali/scripts/refresh-tool-index.sh Normal file
View File

@@ -0,0 +1,189 @@
#!/usr/bin/env bash
# refresh-tool-index.sh — Kali Linux 版工具索引刷新
# 等价于 Windows 版的 refresh-tool-index.ps1
# 输出: skills/tool-index.md + skills/tool-index.json
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/lib/tool-discovery.sh"
OUTPUT_MD="${1:-${SKILL_ROOT}/tool-index.md}"
OUTPUT_JSON="${2:-${SKILL_ROOT}/tool-index.json}"
GENERATED_AT=$(date '+%Y-%m-%d %H:%M:%S %z')
# ─── 生成 Markdown ────────────────────────────────────────────────────────────────
{
echo "# 逆向工具索引"
echo ""
echo "- 扫描时间: $GENERATED_AT"
echo "- 扫描平台: Kali Linux ($(uname -r))"
echo "- 路由入口: \`SKILL.md\` → \`routing.md\` → 对应子 skill"
echo "- 说明: 本表由 \`kali/scripts/refresh-tool-index.sh\` 自动生成。"
echo "- 注意: 对于 jshookmcp 这类 MCP server，\`yes\` 只表示本机具备通过 node/npx 拉起它的条件，不表示它已经在 MCP 配置里注册并启用。"
echo ""
echo "| 工具 | 归属 skill | 作用 | 可用 | 路径 | 版本 | 来源 | 脚本引用 |"
echo "|---|---|---|---|---|---|---|---|"
for entry in "${TOOL_CATALOG[@]}"; do
result=$(resolve_tool "$entry")
IFS='|' read -r name skill purpose available resolved_path version source <<< "$result"
# 获取脚本引用
refs="${SCRIPT_REFS[$name]:-—}"
refs_display="${refs//,/<br>}"
path_display="${resolved_path:-—}"
version_display="${version:-—}"
echo "| $name | $skill | $purpose | $available | $path_display | $version_display | $source | $refs_display |"
done
} > "$OUTPUT_MD"
# ─── 能力状态视图 ──────────────────────────────────────────────────────────────────
{
echo ""
echo "---"
echo ""
echo "## 能力状态视图 (Capability Status)"
echo ""
echo "| 能力 | 工具可用 | MCP 已注册 | 服务在线 | 可自动安装 | 安装方式 |"
echo "|------|---------|-----------|---------|-----------|---------|"
CAPABILITY_NAMES=("jadx" "apktool" "jeb-pro" "frida" "idalib-mcp" "jshookmcp" "reqable-mcp" "anything-analyzer" "idapro" "r2" "adb" "agent-browser" "ghidra-mcp" "seclists" "proxycat" "burpsuite-mcp" "nmap" "sqlmap" "hashcat" "hydra" "gobuster" "ffuf" "msfconsole" "nuclei" "bkcrack")
for cap_name in "${CAPABILITY_NAMES[@]}"; do
# 检查工具是否可用
tool_available="✗"
case "$cap_name" in
jeb-pro)
if command -v jeb &>/dev/null || [[ -x "$HOME/tools/JEB/jeb" ]] || [[ -x "$HOME/JEB/jeb" ]] || [[ -x "/opt/jeb/jeb" ]]; then
tool_available="✓"
fi
;;
reqable-mcp|jshookmcp)
if command -v npx &>/dev/null; then tool_available="✓"; fi
;;
*)
if command -v "$cap_name" &>/dev/null; then tool_available="✓"; fi
;;
esac
# 检查 MCP 注册状态
mcp_registered="—"
mcp_name="$cap_name"
case "$cap_name" in
jshookmcp) mcp_name="jshook" ;;
esac
mcp_check=$(check_mcp_registered "$mcp_name")
if [[ "$mcp_check" == "true" ]]; then
mcp_registered="✓"
fi
# 检查服务在线状态
service_online="—"
case "$cap_name" in
idapro)
if test_tcp_port 13337 2>/dev/null; then service_online="✓"; fi
;;
anything-analyzer)
if test_tcp_port 23816 2>/dev/null; then service_online="✓"; fi
;;
ghidra-mcp)
if test_tcp_port 8765 2>/dev/null; then service_online="✓"; fi
;;
burpsuite-mcp)
if test_tcp_port 9876 2>/dev/null; then service_online="✓"; fi
;;
esac
# 获取安装方式
can_auto="✓"
bootstrap_kind="apt-package"
case "$cap_name" in
jadx|ghidra-mcp|seclists)
bootstrap_kind="github-release"
;;
frida|idalib-mcp|proxycat)
bootstrap_kind="pip-package"
;;
jshookmcp|reqable-mcp|agent-browser)
bootstrap_kind="npm-mcp"
;;
jeb-pro)
bootstrap_kind="manual"
can_auto="✗"
;;
anything-analyzer|idapro)
bootstrap_kind="local-http-mcp"
;;
burpsuite-mcp)
bootstrap_kind="manual"
can_auto="✗"
;;
esac
echo "| $cap_name | $tool_available | $mcp_registered | $service_online | $can_auto | $bootstrap_kind |"
done
echo ""
echo "> ✓ = 是 | ✗ = 否 | — = 不适用或未检测"
echo ""
} >> "$OUTPUT_MD"
# ─── 生成 JSON ─────────────────────────────────────────────────────────────────────
if command -v jq &>/dev/null; then
# 使用 jq 生成结构化 JSON
json_tools="[]"
for entry in "${TOOL_CATALOG[@]}"; do
result=$(resolve_tool "$entry")
IFS='|' read -r name skill purpose available resolved_path version source <<< "$result"
refs="${SCRIPT_REFS[$name]:-}"
avail_bool="false"
[[ "$available" == "yes" ]] && avail_bool="true"
json_tools=$(echo "$json_tools" | jq \
--arg name "$name" \
--arg skill "$skill" \
--arg purpose "$purpose" \
--argjson available "$avail_bool" \
--arg resolved_path "$resolved_path" \
--arg version "$version" \
--arg source "$source" \
--arg script_refs "$refs" \
'. + [{
name: $name,
skill: $skill,
purpose: $purpose,
available: $available,
resolved_path: $resolved_path,
version: $version,
source: $source,
script_refs: ($script_refs | split(","))
}]')
done
jq -n \
--arg generated_at "$GENERATED_AT" \
--arg platform "kali-linux" \
--argjson tools "$json_tools" \
'{
generated_at: $generated_at,
platform: $platform,
routing_entry: ["SKILL.md", "routing.md"],
tools: $tools
}' > "$OUTPUT_JSON"
else
# 无 jq 时生成简易 JSON
echo "{\"generated_at\": \"$GENERATED_AT\", \"platform\": \"kali-linux\", \"note\": \"install jq for full JSON output\"}" > "$OUTPUT_JSON"
fi
echo "✅ 工具索引已刷新"
echo " markdown=$OUTPUT_MD"
echo " json=$OUTPUT_JSON"
echo " tools=${#TOOL_CATALOG[@]}"