mirror of
https://github.com/0x4m4/hexstrike-ai.git
synced 2026-02-10 14:03:03 +00:00
Advanced Vulnerability Intelligence Enhancement
This commit is contained in:
Muhammad Osama
54
README.md
54
README.md
@@ -2,17 +2,18 @@
|
||||
|
||||
<img src="assets/hexstrike-logo.png" alt="HexStrike AI Logo" width="220" style="margin-bottom: 20px;"/>
|
||||
|
||||
# HexStrike AI MCP Agents v5.0
|
||||
### AI-Powered Cybersecurity Tool Integration via Model Context Protocol
|
||||
# HexStrike AI MCP Agents v6.0
|
||||
### AI-Powered Vulnerability Intelligence & Autonomous Cybersecurity Platform
|
||||
|
||||
[](https://www.python.org/)
|
||||
[](LICENSE)
|
||||
[](https://github.com/0x4m4/hexstrike-ai)
|
||||
[](https://github.com/0x4m4/hexstrike-ai)
|
||||
[](https://github.com/0x4m4/hexstrike-ai/releases)
|
||||
[](https://github.com/0x4m4/hexstrike-ai/releases)
|
||||
[](https://github.com/0x4m4/hexstrike-ai)
|
||||
[](https://github.com/0x4m4/hexstrike-ai)
|
||||
|
||||
**MCP Server that enables AI agents to perform autonomous cybersecurity testing and penetration testing through 70+ integrated security tools**
|
||||
**Next-generation MCP Server with Advanced Vulnerability Intelligence, AI-powered Exploit Generation, and Autonomous Threat Hunting capabilities**
|
||||
|
||||
[🏗️ Architecture](#️-architecture-overview) • [🚀 Installation](#quick-installation) • [🛠️ Features](#comprehensive-feature-set) • [🤖 AI Usage](#ai-agent-usage-examples) • [📡 API Reference](#api-reference) • [⭐ Star Us](https://github.com/0x4m4/hexstrike-ai)
|
||||
|
||||
@@ -206,6 +207,19 @@ Enable your AI agents to become autonomous cybersecurity experts with access to
|
||||
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><b>🧠 Advanced Vulnerability Intelligence (v6.0 NEW!)</b></summary>
|
||||
|
||||
- **CVE Intelligence** - Real-time CVE monitoring with AI exploitability analysis
|
||||
- **Exploit Generation** - AI-powered exploit development from vulnerability data
|
||||
- **Attack Chain Discovery** - Multi-stage attack path identification and optimization
|
||||
- **Threat Intelligence** - Advanced IOC correlation across multiple sources
|
||||
- **Zero-Day Research** - Automated vulnerability research and pattern recognition
|
||||
- **Advanced Payloads** - Nation-state level evasion techniques and obfuscation
|
||||
- **Threat Hunting** - AI-assisted threat hunting with vulnerability correlation
|
||||
|
||||
</details>
|
||||
|
||||
### 🤖 **AI-Powered Automation Features**
|
||||
|
||||
<details>
|
||||
@@ -411,7 +425,7 @@ Edit `~/.config/Claude/claude_desktop_config.json`:
|
||||
"/path/to/hexstrike-ai/hexstrike_mcp.py",
|
||||
"--server", "http://localhost:5000"
|
||||
],
|
||||
"description": "HexStrike AI MCP Agents v5.0"
|
||||
"description": "HexStrike AI MCP Agents v6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -578,9 +592,25 @@ python3 hexstrike_mcp.py --debug
|
||||
|
||||
---
|
||||
|
||||
## **What's New in v5.0**
|
||||
## **What's New in v6.0**
|
||||
|
||||
### 🔥 Major Enhancements
|
||||
### 🧠 Major Intelligence Enhancements
|
||||
- **Advanced Vulnerability Intelligence**: Real-time CVE monitoring with AI-powered exploitability analysis
|
||||
- **AI Exploit Generation**: Autonomous exploit development from vulnerability descriptions
|
||||
- **Attack Chain Discovery**: Multi-stage attack path identification with success probability calculations
|
||||
- **Threat Intelligence Correlation**: Advanced IOC analysis across multiple intelligence sources
|
||||
- **Zero-Day Research Automation**: AI-driven vulnerability research and pattern recognition
|
||||
- **Nation-State Payloads**: Advanced evasion techniques with environmental keying
|
||||
|
||||
### 🆕 New Intelligence Features
|
||||
- CVE database monitoring with CVSS scoring and exploitability assessment
|
||||
- Automatic exploit generation with multiple sophistication levels
|
||||
- Attack chain optimization with vulnerability correlation
|
||||
- Threat hunting assistance with AI-powered detection queries
|
||||
- Advanced payload generation with anti-analysis capabilities
|
||||
- Comprehensive vulnerability intelligence dashboard
|
||||
|
||||
### 🔥 Previous v5.0 Enhancements
|
||||
- **MCP Integration**: Full Model Context Protocol support for AI agents
|
||||
- **Advanced Process Control**: Real-time command termination and monitoring
|
||||
- **Enhanced Caching**: LRU cache with intelligent TTL management
|
||||
@@ -588,14 +618,6 @@ python3 hexstrike_mcp.py --debug
|
||||
- **AI Automation**: Intelligent payload generation and testing capabilities
|
||||
- **File Operations**: Complete file management system for AI agents
|
||||
|
||||
### 🆕 New Features
|
||||
- Real-time command output streaming
|
||||
- Progress indicators for long-running operations
|
||||
- Contextual payload generation system
|
||||
- Advanced API security testing (GraphQL, JWT)
|
||||
- Comprehensive process dashboard
|
||||
- Enhanced error handling with detailed logging
|
||||
|
||||
---
|
||||
|
||||
## 🔒 Security Considerations
|
||||
@@ -652,4 +674,4 @@ MIT License - see LICENSE file for details.
|
||||
|
||||
---
|
||||
|
||||
**HexStrike AI MCP Agents v5.0 - Empowering AI agents with autonomous cybersecurity capabilities!**
|
||||
**HexStrike AI MCP Agents v6.0 - Next-generation AI-powered vulnerability intelligence and autonomous cybersecurity platform!**
|
||||
399
hexstrike_mcp.py
399
hexstrike_mcp.py
@@ -2536,6 +2536,405 @@ def setup_mcp_server(hexstrike_client: HexStrikeClient) -> FastMCP:
|
||||
"stderr": f"Error executing command: {str(e)}"
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# ADVANCED VULNERABILITY INTELLIGENCE MCP TOOLS (v6.0 ENHANCEMENT)
|
||||
# ============================================================================
|
||||
|
||||
@mcp.tool()
|
||||
def monitor_cve_feeds(hours: int = 24, severity_filter: str = "HIGH,CRITICAL", keywords: str = "") -> Dict[str, Any]:
|
||||
"""
|
||||
Monitor CVE databases for new vulnerabilities with AI analysis.
|
||||
|
||||
Args:
|
||||
hours: Hours to look back for new CVEs (default: 24)
|
||||
severity_filter: Filter by CVSS severity - comma-separated values (LOW,MEDIUM,HIGH,CRITICAL,ALL)
|
||||
keywords: Filter CVEs by keywords in description (comma-separated)
|
||||
|
||||
Returns:
|
||||
Latest CVEs with exploitability analysis and threat intelligence
|
||||
|
||||
Example:
|
||||
monitor_cve_feeds(48, "CRITICAL", "remote code execution")
|
||||
"""
|
||||
data = {
|
||||
"hours": hours,
|
||||
"severity_filter": severity_filter,
|
||||
"keywords": keywords
|
||||
}
|
||||
logger.info(f"🔍 Monitoring CVE feeds for last {hours} hours | Severity: {severity_filter}")
|
||||
result = hexstrike_client.safe_post("api/vuln-intel/cve-monitor", data)
|
||||
|
||||
if result.get("success"):
|
||||
cve_count = len(result.get("cve_monitoring", {}).get("cves", []))
|
||||
exploit_analysis_count = len(result.get("exploitability_analysis", []))
|
||||
logger.info(f"✅ Found {cve_count} CVEs with {exploit_analysis_count} exploitability analyses")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def generate_exploit_from_cve(cve_id: str, target_os: str = "", target_arch: str = "x64", exploit_type: str = "poc", evasion_level: str = "none") -> Dict[str, Any]:
|
||||
"""
|
||||
Generate working exploits from CVE information using AI-powered analysis.
|
||||
|
||||
Args:
|
||||
cve_id: CVE identifier (e.g., CVE-2024-1234)
|
||||
target_os: Target operating system (windows, linux, macos, any)
|
||||
target_arch: Target architecture (x86, x64, arm, any)
|
||||
exploit_type: Type of exploit to generate (poc, weaponized, stealth)
|
||||
evasion_level: Evasion sophistication (none, basic, advanced)
|
||||
|
||||
Returns:
|
||||
Generated exploit code with testing instructions and evasion techniques
|
||||
|
||||
Example:
|
||||
generate_exploit_from_cve("CVE-2024-1234", "linux", "x64", "weaponized", "advanced")
|
||||
"""
|
||||
data = {
|
||||
"cve_id": cve_id,
|
||||
"target_os": target_os,
|
||||
"target_arch": target_arch,
|
||||
"exploit_type": exploit_type,
|
||||
"evasion_level": evasion_level
|
||||
}
|
||||
logger.info(f"🤖 Generating {exploit_type} exploit for {cve_id} | Target: {target_os} {target_arch}")
|
||||
result = hexstrike_client.safe_post("api/vuln-intel/exploit-generate", data)
|
||||
|
||||
if result.get("success"):
|
||||
cve_analysis = result.get("cve_analysis", {})
|
||||
exploit_gen = result.get("exploit_generation", {})
|
||||
exploitability = cve_analysis.get("exploitability_level", "UNKNOWN")
|
||||
exploit_success = exploit_gen.get("success", False)
|
||||
|
||||
logger.info(f"📊 CVE Analysis: {exploitability} exploitability")
|
||||
logger.info(f"🎯 Exploit Generation: {'SUCCESS' if exploit_success else 'FAILED'}")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def discover_attack_chains(target_software: str, attack_depth: int = 3, include_zero_days: bool = False) -> Dict[str, Any]:
|
||||
"""
|
||||
Discover multi-stage attack chains for target software with vulnerability correlation.
|
||||
|
||||
Args:
|
||||
target_software: Target software/system (e.g., "Apache HTTP Server", "Windows Server 2019")
|
||||
attack_depth: Maximum number of stages in attack chain (1-5)
|
||||
include_zero_days: Include potential zero-day vulnerabilities in analysis
|
||||
|
||||
Returns:
|
||||
Attack chains with vulnerability combinations, success probabilities, and exploit availability
|
||||
|
||||
Example:
|
||||
discover_attack_chains("Apache HTTP Server 2.4", 4, True)
|
||||
"""
|
||||
data = {
|
||||
"target_software": target_software,
|
||||
"attack_depth": min(max(attack_depth, 1), 5), # Clamp between 1-5
|
||||
"include_zero_days": include_zero_days
|
||||
}
|
||||
logger.info(f"🔗 Discovering attack chains for {target_software} | Depth: {attack_depth} | Zero-days: {include_zero_days}")
|
||||
result = hexstrike_client.safe_post("api/vuln-intel/attack-chains", data)
|
||||
|
||||
if result.get("success"):
|
||||
chains = result.get("attack_chain_discovery", {}).get("attack_chains", [])
|
||||
enhanced_chains = result.get("attack_chain_discovery", {}).get("enhanced_chains", [])
|
||||
|
||||
logger.info(f"📊 Found {len(chains)} attack chains")
|
||||
if enhanced_chains:
|
||||
logger.info(f"🎯 Enhanced {len(enhanced_chains)} chains with exploit analysis")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def research_zero_day_opportunities(target_software: str, analysis_depth: str = "standard", source_code_url: str = "") -> Dict[str, Any]:
|
||||
"""
|
||||
Automated zero-day vulnerability research using AI analysis and pattern recognition.
|
||||
|
||||
Args:
|
||||
target_software: Software to research for vulnerabilities (e.g., "nginx", "OpenSSL")
|
||||
analysis_depth: Depth of analysis (quick, standard, comprehensive)
|
||||
source_code_url: URL to source code repository for enhanced analysis
|
||||
|
||||
Returns:
|
||||
Potential vulnerability areas with exploitation feasibility and research recommendations
|
||||
|
||||
Example:
|
||||
research_zero_day_opportunities("nginx 1.20", "comprehensive", "https://github.com/nginx/nginx")
|
||||
"""
|
||||
if analysis_depth not in ["quick", "standard", "comprehensive"]:
|
||||
analysis_depth = "standard"
|
||||
|
||||
data = {
|
||||
"target_software": target_software,
|
||||
"analysis_depth": analysis_depth,
|
||||
"source_code_url": source_code_url
|
||||
}
|
||||
logger.info(f"🔬 Researching zero-day opportunities in {target_software} | Depth: {analysis_depth}")
|
||||
result = hexstrike_client.safe_post("api/vuln-intel/zero-day-research", data)
|
||||
|
||||
if result.get("success"):
|
||||
research = result.get("zero_day_research", {})
|
||||
potential_vulns = len(research.get("potential_vulnerabilities", []))
|
||||
risk_score = research.get("risk_assessment", {}).get("risk_score", 0)
|
||||
|
||||
logger.info(f"📊 Found {potential_vulns} potential vulnerability areas")
|
||||
logger.info(f"🎯 Risk Score: {risk_score}/100")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def correlate_threat_intelligence(indicators: str, timeframe: str = "30d", sources: str = "all") -> Dict[str, Any]:
|
||||
"""
|
||||
Correlate threat intelligence across multiple sources with advanced analysis.
|
||||
|
||||
Args:
|
||||
indicators: Comma-separated IOCs (IPs, domains, hashes, CVEs, etc.)
|
||||
timeframe: Time window for correlation (7d, 30d, 90d, 1y)
|
||||
sources: Intelligence sources to query (cve, exploit-db, github, twitter, all)
|
||||
|
||||
Returns:
|
||||
Correlated threat intelligence with attribution, timeline, and threat scoring
|
||||
|
||||
Example:
|
||||
correlate_threat_intelligence("CVE-2024-1234,192.168.1.100,malware.exe", "90d", "all")
|
||||
"""
|
||||
# Validate timeframe
|
||||
valid_timeframes = ["7d", "30d", "90d", "1y"]
|
||||
if timeframe not in valid_timeframes:
|
||||
timeframe = "30d"
|
||||
|
||||
# Parse indicators
|
||||
indicator_list = [i.strip() for i in indicators.split(",") if i.strip()]
|
||||
|
||||
if not indicator_list:
|
||||
logger.error("❌ No valid indicators provided")
|
||||
return {"success": False, "error": "No valid indicators provided"}
|
||||
|
||||
data = {
|
||||
"indicators": indicator_list,
|
||||
"timeframe": timeframe,
|
||||
"sources": sources
|
||||
}
|
||||
logger.info(f"🧠 Correlating threat intelligence for {len(indicator_list)} indicators | Timeframe: {timeframe}")
|
||||
result = hexstrike_client.safe_post("api/vuln-intel/threat-feeds", data)
|
||||
|
||||
if result.get("success"):
|
||||
threat_intel = result.get("threat_intelligence", {})
|
||||
correlations = len(threat_intel.get("correlations", []))
|
||||
threat_score = threat_intel.get("threat_score", 0)
|
||||
|
||||
logger.info(f"📊 Found {correlations} threat correlations")
|
||||
logger.info(f"🎯 Overall Threat Score: {threat_score:.1f}/100")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def advanced_payload_generation(attack_type: str, target_context: str = "", evasion_level: str = "standard", custom_constraints: str = "") -> Dict[str, Any]:
|
||||
"""
|
||||
Generate advanced payloads with AI-powered evasion techniques and contextual adaptation.
|
||||
|
||||
Args:
|
||||
attack_type: Type of attack (rce, privilege_escalation, persistence, exfiltration, xss, sqli)
|
||||
target_context: Target environment details (OS, software versions, security controls)
|
||||
evasion_level: Evasion sophistication (basic, standard, advanced, nation-state)
|
||||
custom_constraints: Custom payload constraints (size limits, character restrictions, etc.)
|
||||
|
||||
Returns:
|
||||
Advanced payloads with multiple evasion techniques and deployment instructions
|
||||
|
||||
Example:
|
||||
advanced_payload_generation("rce", "Windows 11 + Defender + AppLocker", "nation-state", "max_size:256,no_quotes")
|
||||
"""
|
||||
valid_attack_types = ["rce", "privilege_escalation", "persistence", "exfiltration", "xss", "sqli", "lfi", "ssrf"]
|
||||
valid_evasion_levels = ["basic", "standard", "advanced", "nation-state"]
|
||||
|
||||
if attack_type not in valid_attack_types:
|
||||
attack_type = "rce"
|
||||
|
||||
if evasion_level not in valid_evasion_levels:
|
||||
evasion_level = "standard"
|
||||
|
||||
data = {
|
||||
"attack_type": attack_type,
|
||||
"target_context": target_context,
|
||||
"evasion_level": evasion_level,
|
||||
"custom_constraints": custom_constraints
|
||||
}
|
||||
logger.info(f"🎯 Generating advanced {attack_type} payload | Evasion: {evasion_level}")
|
||||
if target_context:
|
||||
logger.info(f"🎯 Target Context: {target_context}")
|
||||
|
||||
result = hexstrike_client.safe_post("api/ai/advanced-payload-generation", data)
|
||||
|
||||
if result.get("success"):
|
||||
payload_gen = result.get("advanced_payload_generation", {})
|
||||
payload_count = payload_gen.get("payload_count", 0)
|
||||
evasion_applied = payload_gen.get("evasion_level", "none")
|
||||
|
||||
logger.info(f"📊 Generated {payload_count} advanced payloads")
|
||||
logger.info(f"🛡️ Evasion Level Applied: {evasion_applied}")
|
||||
|
||||
return result
|
||||
|
||||
@mcp.tool()
|
||||
def vulnerability_intelligence_dashboard() -> Dict[str, Any]:
|
||||
"""
|
||||
Get a comprehensive vulnerability intelligence dashboard with latest threats and trends.
|
||||
|
||||
Returns:
|
||||
Dashboard with latest CVEs, trending vulnerabilities, exploit availability, and threat landscape
|
||||
|
||||
Example:
|
||||
vulnerability_intelligence_dashboard()
|
||||
"""
|
||||
logger.info("📊 Generating vulnerability intelligence dashboard")
|
||||
|
||||
# Get latest critical CVEs
|
||||
latest_cves = hexstrike_client.safe_post("api/vuln-intel/cve-monitor", {
|
||||
"hours": 24,
|
||||
"severity_filter": "CRITICAL",
|
||||
"keywords": ""
|
||||
})
|
||||
|
||||
# Get trending attack types
|
||||
trending_research = hexstrike_client.safe_post("api/vuln-intel/zero-day-research", {
|
||||
"target_software": "web applications",
|
||||
"analysis_depth": "quick"
|
||||
})
|
||||
|
||||
# Compile dashboard
|
||||
dashboard = {
|
||||
"timestamp": time.time(),
|
||||
"latest_critical_cves": latest_cves.get("cve_monitoring", {}).get("cves", [])[:5],
|
||||
"threat_landscape": {
|
||||
"high_risk_software": ["Apache HTTP Server", "Microsoft Exchange", "VMware vCenter", "Fortinet FortiOS"],
|
||||
"trending_attack_vectors": ["Supply chain attacks", "Cloud misconfigurations", "Zero-day exploits", "AI-powered attacks"],
|
||||
"active_threat_groups": ["APT29", "Lazarus Group", "FIN7", "REvil"],
|
||||
},
|
||||
"exploit_intelligence": {
|
||||
"new_public_exploits": "Simulated data - check exploit-db for real data",
|
||||
"weaponized_exploits": "Monitor threat intelligence feeds",
|
||||
"exploit_kits": "Track underground markets"
|
||||
},
|
||||
"recommendations": [
|
||||
"Prioritize patching for critical CVEs discovered in last 24h",
|
||||
"Monitor for zero-day activity in trending attack vectors",
|
||||
"Implement advanced threat detection for active threat groups",
|
||||
"Review security controls against nation-state level attacks"
|
||||
]
|
||||
}
|
||||
|
||||
logger.info("✅ Vulnerability intelligence dashboard generated")
|
||||
return {
|
||||
"success": True,
|
||||
"dashboard": dashboard
|
||||
}
|
||||
|
||||
@mcp.tool()
|
||||
def threat_hunting_assistant(target_environment: str, threat_indicators: str = "", hunt_focus: str = "general") -> Dict[str, Any]:
|
||||
"""
|
||||
AI-powered threat hunting assistant with vulnerability correlation and attack simulation.
|
||||
|
||||
Args:
|
||||
target_environment: Environment to hunt in (e.g., "Windows Domain", "Cloud Infrastructure")
|
||||
threat_indicators: Known IOCs or suspicious indicators to investigate
|
||||
hunt_focus: Focus area (general, apt, ransomware, insider_threat, supply_chain)
|
||||
|
||||
Returns:
|
||||
Threat hunting playbook with detection queries, IOCs, and investigation steps
|
||||
|
||||
Example:
|
||||
threat_hunting_assistant("Windows Domain", "suspicious_process.exe,192.168.1.100", "apt")
|
||||
"""
|
||||
valid_hunt_focus = ["general", "apt", "ransomware", "insider_threat", "supply_chain"]
|
||||
if hunt_focus not in valid_hunt_focus:
|
||||
hunt_focus = "general"
|
||||
|
||||
logger.info(f"🔍 Generating threat hunting playbook for {target_environment} | Focus: {hunt_focus}")
|
||||
|
||||
# Parse indicators if provided
|
||||
indicators = [i.strip() for i in threat_indicators.split(",") if i.strip()] if threat_indicators else []
|
||||
|
||||
# Generate hunting playbook
|
||||
hunting_playbook = {
|
||||
"target_environment": target_environment,
|
||||
"hunt_focus": hunt_focus,
|
||||
"indicators_analyzed": indicators,
|
||||
"detection_queries": [],
|
||||
"investigation_steps": [],
|
||||
"threat_scenarios": [],
|
||||
"mitigation_strategies": []
|
||||
}
|
||||
|
||||
# Environment-specific detection queries
|
||||
if "windows" in target_environment.lower():
|
||||
hunting_playbook["detection_queries"] = [
|
||||
"Get-WinEvent | Where-Object {$_.Id -eq 4688 -and $_.Message -like '*suspicious*'}",
|
||||
"Get-Process | Where-Object {$_.ProcessName -notin @('explorer.exe', 'svchost.exe')}",
|
||||
"Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"Get-NetTCPConnection | Where-Object {$_.State -eq 'Established' -and $_.RemoteAddress -notlike '10.*'}"
|
||||
]
|
||||
elif "cloud" in target_environment.lower():
|
||||
hunting_playbook["detection_queries"] = [
|
||||
"CloudTrail logs for unusual API calls",
|
||||
"Failed authentication attempts from unknown IPs",
|
||||
"Privilege escalation events",
|
||||
"Data exfiltration indicators"
|
||||
]
|
||||
|
||||
# Focus-specific threat scenarios
|
||||
focus_scenarios = {
|
||||
"apt": [
|
||||
"Spear phishing with weaponized documents",
|
||||
"Living-off-the-land techniques",
|
||||
"Lateral movement via stolen credentials",
|
||||
"Data staging and exfiltration"
|
||||
],
|
||||
"ransomware": [
|
||||
"Initial access via RDP/VPN",
|
||||
"Privilege escalation and persistence",
|
||||
"Shadow copy deletion",
|
||||
"Encryption and ransom note deployment"
|
||||
],
|
||||
"insider_threat": [
|
||||
"Unusual data access patterns",
|
||||
"After-hours activity",
|
||||
"Large data downloads",
|
||||
"Access to sensitive systems"
|
||||
]
|
||||
}
|
||||
|
||||
hunting_playbook["threat_scenarios"] = focus_scenarios.get(hunt_focus, [
|
||||
"Unauthorized access attempts",
|
||||
"Suspicious process execution",
|
||||
"Network anomalies",
|
||||
"Data access violations"
|
||||
])
|
||||
|
||||
# Investigation steps
|
||||
hunting_playbook["investigation_steps"] = [
|
||||
"1. Validate initial indicators and expand IOC list",
|
||||
"2. Run detection queries and analyze results",
|
||||
"3. Correlate events across multiple data sources",
|
||||
"4. Identify affected systems and user accounts",
|
||||
"5. Assess scope and impact of potential compromise",
|
||||
"6. Implement containment measures if threat confirmed",
|
||||
"7. Document findings and update detection rules"
|
||||
]
|
||||
|
||||
# Correlate with vulnerability intelligence if indicators provided
|
||||
if indicators:
|
||||
logger.info(f"🧠 Correlating {len(indicators)} indicators with threat intelligence")
|
||||
correlation_result = correlate_threat_intelligence(",".join(indicators), "30d", "all")
|
||||
|
||||
if correlation_result.get("success"):
|
||||
hunting_playbook["threat_correlation"] = correlation_result.get("threat_intelligence", {})
|
||||
|
||||
logger.info("✅ Threat hunting playbook generated")
|
||||
return {
|
||||
"success": True,
|
||||
"hunting_playbook": hunting_playbook
|
||||
}
|
||||
|
||||
return mcp
|
||||
|
||||
def parse_args():
|
||||
|
||||
1249
hexstrike_server.py
1249
hexstrike_server.py
File diff suppressed because it is too large
Load Diff
@@ -2,3 +2,9 @@ flask>=2.3.0
|
||||
psutil>=5.9.0
|
||||
requests>=2.31.0
|
||||
fastmcp>=0.2.0
|
||||
# Advanced Vulnerability Intelligence Dependencies
|
||||
nvdlib>=0.7.0
|
||||
feedparser>=6.0.10
|
||||
python-dateutil>=2.8.2
|
||||
beautifulsoup4>=4.12.0
|
||||
lxml>=4.9.3
|
||||
|
||||
102
vuln_intel_config.json
Normal file
102
vuln_intel_config.json
Normal file
@@ -0,0 +1,102 @@
|
||||
{
|
||||
"vulnerability_intelligence": {
|
||||
"enabled": true,
|
||||
"description": "Advanced vulnerability intelligence and exploit generation system",
|
||||
"version": "6.0",
|
||||
"features": {
|
||||
"cve_monitoring": {
|
||||
"enabled": true,
|
||||
"default_hours": 24,
|
||||
"default_severity": "HIGH,CRITICAL",
|
||||
"max_results": 100,
|
||||
"cache_ttl": 3600
|
||||
},
|
||||
"exploit_generation": {
|
||||
"enabled": true,
|
||||
"supported_types": ["poc", "weaponized", "stealth"],
|
||||
"supported_architectures": ["x86", "x64", "arm"],
|
||||
"supported_os": ["windows", "linux", "macos"],
|
||||
"evasion_levels": ["none", "basic", "advanced"]
|
||||
},
|
||||
"attack_chains": {
|
||||
"enabled": true,
|
||||
"max_depth": 5,
|
||||
"default_depth": 3,
|
||||
"include_zero_days": false
|
||||
},
|
||||
"threat_intelligence": {
|
||||
"enabled": true,
|
||||
"supported_sources": ["cve", "exploit-db", "github", "twitter"],
|
||||
"timeframes": ["7d", "30d", "90d", "1y"],
|
||||
"max_indicators": 50
|
||||
},
|
||||
"advanced_payloads": {
|
||||
"enabled": true,
|
||||
"attack_types": ["rce", "privilege_escalation", "persistence", "exfiltration", "xss", "sqli", "lfi", "ssrf"],
|
||||
"evasion_levels": ["basic", "standard", "advanced", "nation-state"],
|
||||
"max_payload_size": 10240
|
||||
},
|
||||
"zero_day_research": {
|
||||
"enabled": true,
|
||||
"analysis_depths": ["quick", "standard", "comprehensive"],
|
||||
"max_vulnerabilities": 10
|
||||
}
|
||||
},
|
||||
"api_endpoints": {
|
||||
"cve_monitor": "/api/vuln-intel/cve-monitor",
|
||||
"exploit_generate": "/api/vuln-intel/exploit-generate",
|
||||
"attack_chains": "/api/vuln-intel/attack-chains",
|
||||
"threat_feeds": "/api/vuln-intel/threat-feeds",
|
||||
"zero_day_research": "/api/vuln-intel/zero-day-research",
|
||||
"advanced_payloads": "/api/ai/advanced-payload-generation"
|
||||
},
|
||||
"rate_limits": {
|
||||
"cve_monitor": "10/hour",
|
||||
"exploit_generate": "5/hour",
|
||||
"attack_chains": "3/hour",
|
||||
"threat_feeds": "20/hour",
|
||||
"zero_day_research": "2/hour",
|
||||
"advanced_payloads": "15/hour"
|
||||
},
|
||||
"security": {
|
||||
"require_authentication": false,
|
||||
"log_all_requests": true,
|
||||
"sanitize_outputs": true,
|
||||
"disclaimer_required": true
|
||||
}
|
||||
},
|
||||
"mcp_tools": {
|
||||
"monitor_cve_feeds": {
|
||||
"description": "Monitor CVE databases for new vulnerabilities with AI analysis",
|
||||
"parameters": ["hours", "severity_filter", "keywords"]
|
||||
},
|
||||
"generate_exploit_from_cve": {
|
||||
"description": "Generate working exploits from CVE information using AI",
|
||||
"parameters": ["cve_id", "target_os", "target_arch", "exploit_type", "evasion_level"]
|
||||
},
|
||||
"discover_attack_chains": {
|
||||
"description": "Discover multi-stage attack chains with vulnerability correlation",
|
||||
"parameters": ["target_software", "attack_depth", "include_zero_days"]
|
||||
},
|
||||
"research_zero_day_opportunities": {
|
||||
"description": "Automated zero-day vulnerability research using AI analysis",
|
||||
"parameters": ["target_software", "analysis_depth", "source_code_url"]
|
||||
},
|
||||
"correlate_threat_intelligence": {
|
||||
"description": "Correlate threat intelligence across multiple sources",
|
||||
"parameters": ["indicators", "timeframe", "sources"]
|
||||
},
|
||||
"advanced_payload_generation": {
|
||||
"description": "Generate advanced payloads with AI-powered evasion techniques",
|
||||
"parameters": ["attack_type", "target_context", "evasion_level", "custom_constraints"]
|
||||
},
|
||||
"vulnerability_intelligence_dashboard": {
|
||||
"description": "Get comprehensive vulnerability intelligence dashboard",
|
||||
"parameters": []
|
||||
},
|
||||
"threat_hunting_assistant": {
|
||||
"description": "AI-powered threat hunting assistant with vulnerability correlation",
|
||||
"parameters": ["target_environment", "threat_indicators", "hunt_focus"]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user