toolbox

概述

Sectool是一个协作式应用安全测试工作台，弥合了人类在UI交互和认证方面的优势与AI代理在流量分析和变异能力之间的差距。该工具提供高保真HTTP代理（类似Burp），捕获所有浏览器流量，同时通过MCP工具使AI代理能够查询流量、重放修改后的请求、爬取端点、测试带外交互以及检测反射。这种方法结合人类专业知识和AI自动化，使安全测试更加全面，不易遗漏细微指标。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• workflow

  Select the appropriate workflow mode for security testing

  试试:Start an exploratory security testing workflow试试:Set up for validating a vulnerability report
• proxy_summary

  Review summary of captured proxy traffic

  试试:Show me a summary of what was captured in the proxy试试:List all requests to example.com
• replay_send

  Replay a captured request with modifications

  试试:Resend request flow 123 with modified headers试试:Replay flow 456 with an added header
• crawl_create

  Create a crawling session to discover endpoints

  试试:Crawl example.com starting from this URL试试:Create a crawling session from proxy history
• oast_create

  Set up out-of-band interaction testing session

  试试:Create an OAST session for testing blind vulnerabilities试试:Set up callback testing for potential SSRF
• diff

  Compare two flows to identify differences

  试试:Compare flow 123 and 456 to find differences试试:Show me the differences between these two requests
• reflected

  Detect request parameters reflected in responses

  试试:Check for reflected parameters in flow 123试试:Find request values that appear in the response
• jwt

  Inspect and decode JWT tokens

  试试:Analyze this JWT token for me试试:Decode and show the payload of this token
• oast_poll

  Poll OAST session for callbacks

  试试:Check for callbacks in my OAST session试试:Poll the OAST session for any interactions
• notes_save

  Save observations linked to flows

  试试:Save this observation about potential vulnerability试试:Note this interesting behavior for flow 123
• notes_list

  List all saved notes

  试试:Show me all my saved observations试试:List the notes for this session
• proxy_cookies

  Inspect cookies from captured traffic

  试试:Show me all cookies for example.com试试:List the session_id cookies from captured traffic

可对比工具

安装

go install github.com/go-appsec/toolbox/sectool@latest

sectool mcp

{
  "mcpServers": {
    "sectool": {
      "command": "sectool",
      "args": ["mcp"]
    }
  }
}

FAQ

这与传统安全扫描器有何不同？

Sectool不是扫描器，而是协作工作台。它结合了人类在处理认证和UI交互方面的专业知识与AI的流量分析能力，使复杂应用的安全测试更加全面。

我可以将其与Burp Suite一起使用吗？

是的。Sectool可以通过两种方式集成Burp Suite：使用Burp作为代理前端同时运行MCP服务器，或者使用Burp MCP扩展作为GUI来审查代理的操作。

toolbox 对比