This repository contains the results of AI-assisted penetration testing proof of concepts using Claude Code with MCP-enabled security tools.
TryHackMe CTF challenge - complete system compromise achieved:
- Mass assignment vulnerability to bypass subscription
- SSRF to access internal RabbitMQ services
- Server-Side Template Injection (SSTI) for RCE
- Erlang RPC exploitation to extract credentials
- Privilege escalation to root
Key Findings:
- 2 CRITICAL vulnerabilities (SSTI, Insecure Credential Storage)
- 2 HIGH severity issues (Mass Assignment, SSRF)
- Full root access achieved
- Both flags captured
Complete penetration testing assessment of DVWA including:
- Network discovery and enumeration
- Vulnerability assessment (15 vulnerabilities identified)
- Exploitation demonstrations across all security levels
- Command injection bypass techniques
- Credential extraction and database access
- Attack chain visualization with Mermaid diagrams
Key Findings:
- 7 CRITICAL vulnerabilities
- 1 HIGH severity issue
- 7 MEDIUM severity issues
- Complete system compromise achieved
- Remote code execution as www-data
Comparative analysis of two AI-powered pentesting toolkits:
Tools Evaluated:
- Kali MCP - Dockerized Kali Linux via Model Context Protocol
- HexStrike AI - Specialized MCP security scanner (150+ tools)
Testing Approach:
- Hybrid methodology combining interactive exploitation and automated scanning
- 60 minutes total assessment time
- DVWA environment on 192.168.100.0/24
Key Insights:
- HexStrike AI: Superior automated vulnerability discovery (Nuclei, Feroxbuster)
- Kali MCP: Better for manual exploitation and precise control
- Combined approach: Optimal coverage and exploitation success
Testing Platform: Claude Code (Opus 4.5) via Model Context Protocol (MCP) Target Environments:
- DVWA on Debian (192.168.100.10)
- TryHackMe Rabbit Store (10.81.168.19)
Assessment Dates: January 29-30, 2026 Methodology: Human-in-the-loop AI-assisted pentesting
- nmap, gobuster, nikto, curl, netcat
- Direct command execution via Docker container
- Traditional pentesting workflow
- Nuclei (5,739 vulnerability templates)
- Feroxbuster (advanced directory enumeration)
- Arjun (parameter discovery)
- Automated scanning and payload generation
✅ Complete network mapping and service enumeration ✅ 15 distinct vulnerabilities discovered ✅ Command injection successful across all security levels ✅ Database credentials extracted (dvwa:p@ssw0rd) ✅ Full source code access via .git repository exposure ✅ Interactive reverse shell established ✅ Complete system compromise demonstrated
Critical (7):
- Git repository exposure (.git directory accessible)
- Backup file disclosure (config.inc.php.bak)
- Default credentials (admin:password)
- Remote File Inclusion enabled (allow_url_include=on)
- Command injection (all security levels)
- SQL injection endpoints
- File upload vulnerabilities
High (1):
- Database credential exposure in configuration files
Medium (7):
- Missing security headers
- PHP version disclosure
- Weak session management
- Cross-Site Scripting (XSS) vulnerabilities
- Cross-Site Request Forgery (CSRF) issues
- Local File Inclusion (LFI)
- Insecure Direct Object References (IDOR)
Network Discovery → Port Scanning → Automated Vuln Scan
↓
Default Credentials (admin:password)
↓
Command Injection (127.0.0.1;id)
↓
Security Bypass (Medium & High levels)
↓
Reverse Shell Establishment
↓
Credential Extraction (dvwa:p@ssw0rd)
↓
Data Exfiltration (source code, databases)
↓
COMPLETE SYSTEM COMPROMISE
- Use combined approach: Start with HexStrike AI for discovery, then Kali MCP for exploitation
- Leverage automation: Nuclei templates provide excellent coverage
- Human oversight: AI-assisted doesn't mean autonomous - validate all findings
- Remove default credentials immediately
- Disable .git exposure in production environments
- Implement input validation for all user-supplied data
- Enable security headers (CSP, X-Frame-Options, etc.)
- Restrict file uploads with proper validation
- Disable dangerous PHP functions (allow_url_include, etc.)
Author: Vito Rallo Organization: PeachStudio Tagline: Where AI and Cybersecurity Collide Website: www.peachstudio.be
Note: All testing was performed in an authorized lab environment. DVWA is an intentionally vulnerable application designed for security training purposes.
These reports are provided for educational and research purposes.
Disclaimer: The techniques and tools described in these reports should only be used in authorized testing environments. Unauthorized access to computer systems is illegal.
