我做了一个用自然语言挖漏洞的 AI 渗透工具：VulnClaw

VulnClaw：说人话，打漏洞

AI 驱动的渗透测试 CLI 工具，让安全测试像聊天一样简单

GitHub: Unclecheng-li/VulnClaw | Star: 23 | Fork: 6 | License: MIT

0x00 先说痛点

做渗透测试，你是否经历过这些：

• 信息收集阶段，Nmap、Masscan、Subfinder…工具一堆，命令记不住
• 漏洞发现时，面对大量扫描结果，不知道先打哪个
• 漏洞利用阶段，POC 要自己改，EXP 要自己找
• 报告编写更是噩梦，截图、整理、格式化…测试1小时，写报告3小时

VulnClaw 的诞生，就是为了解决这些问题。

0x01 VulnClaw 是什么

VulnClaw 是一个 AI 驱动的渗透测试 CLI 工具，基于 LLM Agent + MCP 工具链 + 渗透 Skill 编排。

核心价值

#mermaid-svg-xCsNZ7PqqSGTAYru{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-xCsNZ7PqqSGTAYru .error-icon{fill:#552222;}#mermaid-svg-xCsNZ7PqqSGTAYru .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-xCsNZ7PqqSGTAYru .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-xCsNZ7PqqSGTAYru .marker{fill:#333333;stroke:#333333;}#mermaid-svg-xCsNZ7PqqSGTAYru .marker.cross{stroke:#333333;}#mermaid-svg-xCsNZ7PqqSGTAYru svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-xCsNZ7PqqSGTAYru p{margin:0;}#mermaid-svg-xCsNZ7PqqSGTAYru .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster-label text{fill:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster-label span{color:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster-label span p{background-color:transparent;}#mermaid-svg-xCsNZ7PqqSGTAYru .label text,#mermaid-svg-xCsNZ7PqqSGTAYru span{fill:#333;color:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru .node rect,#mermaid-svg-xCsNZ7PqqSGTAYru .node circle,#mermaid-svg-xCsNZ7PqqSGTAYru .node ellipse,#mermaid-svg-xCsNZ7PqqSGTAYru .node polygon,#mermaid-svg-xCsNZ7PqqSGTAYru .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-xCsNZ7PqqSGTAYru .rough-node .label text,#mermaid-svg-xCsNZ7PqqSGTAYru .node .label text,#mermaid-svg-xCsNZ7PqqSGTAYru .image-shape .label,#mermaid-svg-xCsNZ7PqqSGTAYru .icon-shape .label{text-anchor:middle;}#mermaid-svg-xCsNZ7PqqSGTAYru .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-xCsNZ7PqqSGTAYru .rough-node .label,#mermaid-svg-xCsNZ7PqqSGTAYru .node .label,#mermaid-svg-xCsNZ7PqqSGTAYru .image-shape .label,#mermaid-svg-xCsNZ7PqqSGTAYru .icon-shape .label{text-align:center;}#mermaid-svg-xCsNZ7PqqSGTAYru .node.clickable{cursor:pointer;}#mermaid-svg-xCsNZ7PqqSGTAYru .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-xCsNZ7PqqSGTAYru .arrowheadPath{fill:#333333;}#mermaid-svg-xCsNZ7PqqSGTAYru .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-xCsNZ7PqqSGTAYru .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-xCsNZ7PqqSGTAYru .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-xCsNZ7PqqSGTAYru .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-xCsNZ7PqqSGTAYru .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-xCsNZ7PqqSGTAYru .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster text{fill:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru .cluster span{color:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-xCsNZ7PqqSGTAYru .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-xCsNZ7PqqSGTAYru rect.text{fill:none;stroke-width:0;}#mermaid-svg-xCsNZ7PqqSGTAYru .icon-shape,#mermaid-svg-xCsNZ7PqqSGTAYru .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-xCsNZ7PqqSGTAYru .icon-shape p,#mermaid-svg-xCsNZ7PqqSGTAYru .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-xCsNZ7PqqSGTAYru .icon-shape .label rect,#mermaid-svg-xCsNZ7PqqSGTAYru .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-xCsNZ7PqqSGTAYru .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-xCsNZ7PqqSGTAYru .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-xCsNZ7PqqSGTAYru :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

自然语言输入

AI 理解意图

自动选择工具

信息收集

漏洞发现

漏洞利用

报告生成

你只需要说「帮我测试这个站」，剩下的，VulnClaw 来做。

0x02 核心特性一览

特性分布热力图

#mermaid-svg-JT0rd6zEHMmZq8nM{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-JT0rd6zEHMmZq8nM .error-icon{fill:#552222;}#mermaid-svg-JT0rd6zEHMmZq8nM .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-JT0rd6zEHMmZq8nM .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-JT0rd6zEHMmZq8nM .marker{fill:#333333;stroke:#333333;}#mermaid-svg-JT0rd6zEHMmZq8nM .marker.cross{stroke:#333333;}#mermaid-svg-JT0rd6zEHMmZq8nM svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-JT0rd6zEHMmZq8nM p{margin:0;}#mermaid-svg-JT0rd6zEHMmZq8nM .pieCircle{stroke:#000000;stroke-width:2px;opacity:0.7;}#mermaid-svg-JT0rd6zEHMmZq8nM .pieOuterCircle{stroke:#000000;stroke-width:1px;fill:none;}#mermaid-svg-JT0rd6zEHMmZq8nM .pieTitleText{text-anchor:middle;font-size:25px;fill:#000000;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}#mermaid-svg-JT0rd6zEHMmZq8nM .slice{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;fill:#000000;font-size:17px;}#mermaid-svg-JT0rd6zEHMmZq8nM .legend text{fill:#000000;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:17px;}#mermaid-svg-JT0rd6zEHMmZq8nM :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

35%

25%

20%

10%

10%

VulnClaw 功能模块占比（按代码量估算）

LLM Agent 核心

MCP 工具链

Skill 系统

编解码/加密

其他（配置/报告/CLI）

1. 自然语言驱动

MCP 工具链

Skill 系统

LLM Agent

用户

MCP 工具链

Skill 系统

LLM Agent

用户

#mermaid-svg-OJFn1o6viFak1ddH{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-OJFn1o6viFak1ddH .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-OJFn1o6viFak1ddH .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-OJFn1o6viFak1ddH .error-icon{fill:#552222;}#mermaid-svg-OJFn1o6viFak1ddH .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-OJFn1o6viFak1ddH .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-OJFn1o6viFak1ddH .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-OJFn1o6viFak1ddH .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-OJFn1o6viFak1ddH .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-OJFn1o6viFak1ddH .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-OJFn1o6viFak1ddH .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-OJFn1o6viFak1ddH .marker{fill:#333333;stroke:#333333;}#mermaid-svg-OJFn1o6viFak1ddH .marker.cross{stroke:#333333;}#mermaid-svg-OJFn1o6viFak1ddH svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-OJFn1o6viFak1ddH p{margin:0;}#mermaid-svg-OJFn1o6viFak1ddH .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-OJFn1o6viFak1ddH text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-OJFn1o6viFak1ddH .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-OJFn1o6viFak1ddH .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-OJFn1o6viFak1ddH .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-OJFn1o6viFak1ddH .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-OJFn1o6viFak1ddH #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-OJFn1o6viFak1ddH .sequenceNumber{fill:white;}#mermaid-svg-OJFn1o6viFak1ddH #sequencenumber{fill:#333;}#mermaid-svg-OJFn1o6viFak1ddH #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-OJFn1o6viFak1ddH .messageText{fill:#333;stroke:none;}#mermaid-svg-OJFn1o6viFak1ddH .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-OJFn1o6viFak1ddH .labelText,#mermaid-svg-OJFn1o6viFak1ddH .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-OJFn1o6viFak1ddH .loopText,#mermaid-svg-OJFn1o6viFak1ddH .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-OJFn1o6viFak1ddH .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-OJFn1o6viFak1ddH .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-OJFn1o6viFak1ddH .noteText,#mermaid-svg-OJFn1o6viFak1ddH .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-OJFn1o6viFak1ddH .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-OJFn1o6viFak1ddH .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-OJFn1o6viFak1ddH .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-OJFn1o6viFak1ddH .actorPopupMenu{position:absolute;}#mermaid-svg-OJFn1o6viFak1ddH .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-OJFn1o6viFak1ddH .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-OJFn1o6viFak1ddH .actor-man circle,#mermaid-svg-OJFn1o6viFak1ddH line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-OJFn1o6viFak1ddH :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

"帮我测试 192.168.1.100 的 Web 服务"

解析意图：目标识别

选择 pentest-flow

调用 http_scan

扫描结果

结构化漏洞信息

"发现 3 个漏洞：SQL注入、XSS、弱口令"

不再需要记命令，你说什么，AI 就懂什么。

2. 多模型支持（8 个 Provider）

#mermaid-svg-qVbLkLyHnz0e3Ypu{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-qVbLkLyHnz0e3Ypu .error-icon{fill:#552222;}#mermaid-svg-qVbLkLyHnz0e3Ypu .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-qVbLkLyHnz0e3Ypu .marker{fill:#333333;stroke:#333333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .marker.cross{stroke:#333333;}#mermaid-svg-qVbLkLyHnz0e3Ypu svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-qVbLkLyHnz0e3Ypu p{margin:0;}#mermaid-svg-qVbLkLyHnz0e3Ypu .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster-label text{fill:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster-label span{color:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster-label span p{background-color:transparent;}#mermaid-svg-qVbLkLyHnz0e3Ypu .label text,#mermaid-svg-qVbLkLyHnz0e3Ypu span{fill:#333;color:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .node rect,#mermaid-svg-qVbLkLyHnz0e3Ypu .node circle,#mermaid-svg-qVbLkLyHnz0e3Ypu .node ellipse,#mermaid-svg-qVbLkLyHnz0e3Ypu .node polygon,#mermaid-svg-qVbLkLyHnz0e3Ypu .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .rough-node .label text,#mermaid-svg-qVbLkLyHnz0e3Ypu .node .label text,#mermaid-svg-qVbLkLyHnz0e3Ypu .image-shape .label,#mermaid-svg-qVbLkLyHnz0e3Ypu .icon-shape .label{text-anchor:middle;}#mermaid-svg-qVbLkLyHnz0e3Ypu .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .rough-node .label,#mermaid-svg-qVbLkLyHnz0e3Ypu .node .label,#mermaid-svg-qVbLkLyHnz0e3Ypu .image-shape .label,#mermaid-svg-qVbLkLyHnz0e3Ypu .icon-shape .label{text-align:center;}#mermaid-svg-qVbLkLyHnz0e3Ypu .node.clickable{cursor:pointer;}#mermaid-svg-qVbLkLyHnz0e3Ypu .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .arrowheadPath{fill:#333333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-qVbLkLyHnz0e3Ypu .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-qVbLkLyHnz0e3Ypu .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-qVbLkLyHnz0e3Ypu .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster text{fill:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu .cluster span{color:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-qVbLkLyHnz0e3Ypu .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-qVbLkLyHnz0e3Ypu rect.text{fill:none;stroke-width:0;}#mermaid-svg-qVbLkLyHnz0e3Ypu .icon-shape,#mermaid-svg-qVbLkLyHnz0e3Ypu .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-qVbLkLyHnz0e3Ypu .icon-shape p,#mermaid-svg-qVbLkLyHnz0e3Ypu .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-qVbLkLyHnz0e3Ypu .icon-shape .label rect,#mermaid-svg-qVbLkLyHnz0e3Ypu .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-qVbLkLyHnz0e3Ypu .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-qVbLkLyHnz0e3Ypu .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-qVbLkLyHnz0e3Ypu :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

VulnClaw 支持的模型

OpenAIGPT-4o

MiniMaxM2

DeepSeekdeepseek-chat

智谱 GLMglm-4-plus

Moonshotmoonshot-v1-128k

通义千问qwen-max

SiliconFlowDeepSeek-V3

自定义…

VulnClaw

一键切换，想用哪个用哪个。

3. MCP 工具链（11 服务 / 23 工具）

#mermaid-svg-2gEoVXHO7BAMcKtO{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-2gEoVXHO7BAMcKtO .error-icon{fill:#552222;}#mermaid-svg-2gEoVXHO7BAMcKtO .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-2gEoVXHO7BAMcKtO .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-2gEoVXHO7BAMcKtO .marker{fill:#333333;stroke:#333333;}#mermaid-svg-2gEoVXHO7BAMcKtO .marker.cross{stroke:#333333;}#mermaid-svg-2gEoVXHO7BAMcKtO svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-2gEoVXHO7BAMcKtO p{margin:0;}#mermaid-svg-2gEoVXHO7BAMcKtO .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster-label text{fill:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster-label span{color:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster-label span p{background-color:transparent;}#mermaid-svg-2gEoVXHO7BAMcKtO .label text,#mermaid-svg-2gEoVXHO7BAMcKtO span{fill:#333;color:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO .node rect,#mermaid-svg-2gEoVXHO7BAMcKtO .node circle,#mermaid-svg-2gEoVXHO7BAMcKtO .node ellipse,#mermaid-svg-2gEoVXHO7BAMcKtO .node polygon,#mermaid-svg-2gEoVXHO7BAMcKtO .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-2gEoVXHO7BAMcKtO .rough-node .label text,#mermaid-svg-2gEoVXHO7BAMcKtO .node .label text,#mermaid-svg-2gEoVXHO7BAMcKtO .image-shape .label,#mermaid-svg-2gEoVXHO7BAMcKtO .icon-shape .label{text-anchor:middle;}#mermaid-svg-2gEoVXHO7BAMcKtO .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-2gEoVXHO7BAMcKtO .rough-node .label,#mermaid-svg-2gEoVXHO7BAMcKtO .node .label,#mermaid-svg-2gEoVXHO7BAMcKtO .image-shape .label,#mermaid-svg-2gEoVXHO7BAMcKtO .icon-shape .label{text-align:center;}#mermaid-svg-2gEoVXHO7BAMcKtO .node.clickable{cursor:pointer;}#mermaid-svg-2gEoVXHO7BAMcKtO .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-2gEoVXHO7BAMcKtO .arrowheadPath{fill:#333333;}#mermaid-svg-2gEoVXHO7BAMcKtO .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-2gEoVXHO7BAMcKtO .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-2gEoVXHO7BAMcKtO .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-2gEoVXHO7BAMcKtO .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-2gEoVXHO7BAMcKtO .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-2gEoVXHO7BAMcKtO .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster text{fill:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO .cluster span{color:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-2gEoVXHO7BAMcKtO .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-2gEoVXHO7BAMcKtO rect.text{fill:none;stroke-width:0;}#mermaid-svg-2gEoVXHO7BAMcKtO .icon-shape,#mermaid-svg-2gEoVXHO7BAMcKtO .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-2gEoVXHO7BAMcKtO .icon-shape p,#mermaid-svg-2gEoVXHO7BAMcKtO .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-2gEoVXHO7BAMcKtO .icon-shape .label rect,#mermaid-svg-2gEoVXHO7BAMcKtO .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-2gEoVXHO7BAMcKtO .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-2gEoVXHO7BAMcKtO .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-2gEoVXHO7BAMcKtO :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

MCP 服务层

HTTP 请求

内存管理

浏览器自动化

JSR 逆向

Burp 抓包

移动端 Hook

安卓控制

APK 反编译

二进制逆向

子域名枚举

DNS 查询

HTTP 请求/指纹识别

进程内存读写

浏览器自动化操控

JavaScript 动态分析

被动抓包/流量分析

Frida Hook

ADB 安卓调试

APK 信息提取

逆向分析

子域名发现

DNS 枚举

4. 渗透 Skill 体系

#mermaid-svg-LIFrN8eShY3PvacS{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-LIFrN8eShY3PvacS .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-LIFrN8eShY3PvacS .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-LIFrN8eShY3PvacS .error-icon{fill:#552222;}#mermaid-svg-LIFrN8eShY3PvacS .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-LIFrN8eShY3PvacS .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-LIFrN8eShY3PvacS .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-LIFrN8eShY3PvacS .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-LIFrN8eShY3PvacS .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-LIFrN8eShY3PvacS .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-LIFrN8eShY3PvacS .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-LIFrN8eShY3PvacS .marker{fill:#333333;stroke:#333333;}#mermaid-svg-LIFrN8eShY3PvacS .marker.cross{stroke:#333333;}#mermaid-svg-LIFrN8eShY3PvacS svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-LIFrN8eShY3PvacS p{margin:0;}#mermaid-svg-LIFrN8eShY3PvacS .edge{stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .section–1 rect,#mermaid-svg-LIFrN8eShY3PvacS .section–1 path,#mermaid-svg-LIFrN8eShY3PvacS .section–1 circle,#mermaid-svg-LIFrN8eShY3PvacS .section–1 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section–1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section–1 text{fill:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon–1{font-size:40px;color:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge–1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth–1{stroke-width:17;}#mermaid-svg-LIFrN8eShY3PvacS .section–1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-0 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-0 path,#mermaid-svg-LIFrN8eShY3PvacS .section-0 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-0 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-LIFrN8eShY3PvacS .section-0 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-0{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-0{stroke-width:14;}#mermaid-svg-LIFrN8eShY3PvacS .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-1 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-1 path,#mermaid-svg-LIFrN8eShY3PvacS .section-1 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-1 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-1 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-1{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-1{stroke-width:11;}#mermaid-svg-LIFrN8eShY3PvacS .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-2 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-2 path,#mermaid-svg-LIFrN8eShY3PvacS .section-2 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-2 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-2 text{fill:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-2{stroke-width:8;}#mermaid-svg-LIFrN8eShY3PvacS .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-3 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-3 path,#mermaid-svg-LIFrN8eShY3PvacS .section-3 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-3 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-3 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-3{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-3{stroke-width:5;}#mermaid-svg-LIFrN8eShY3PvacS .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-4 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-4 path,#mermaid-svg-LIFrN8eShY3PvacS .section-4 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-4 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-4 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-4{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-4{stroke-width:2;}#mermaid-svg-LIFrN8eShY3PvacS .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-5 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-5 path,#mermaid-svg-LIFrN8eShY3PvacS .section-5 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-5 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-5 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-5{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-5{stroke-width:-1;}#mermaid-svg-LIFrN8eShY3PvacS .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-6 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-6 path,#mermaid-svg-LIFrN8eShY3PvacS .section-6 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-6 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-6 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-6{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-6{stroke-width:-4;}#mermaid-svg-LIFrN8eShY3PvacS .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-7 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-7 path,#mermaid-svg-LIFrN8eShY3PvacS .section-7 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-7 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-7 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-7{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-7{stroke-width:-7;}#mermaid-svg-LIFrN8eShY3PvacS .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-8 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-8 path,#mermaid-svg-LIFrN8eShY3PvacS .section-8 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-8 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-8 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-8{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-8{stroke-width:-10;}#mermaid-svg-LIFrN8eShY3PvacS .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-9 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-9 path,#mermaid-svg-LIFrN8eShY3PvacS .section-9 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-9 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-9 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-9{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-9{stroke-width:-13;}#mermaid-svg-LIFrN8eShY3PvacS .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-10 rect,#mermaid-svg-LIFrN8eShY3PvacS .section-10 path,#mermaid-svg-LIFrN8eShY3PvacS .section-10 circle,#mermaid-svg-LIFrN8eShY3PvacS .section-10 polygon,#mermaid-svg-LIFrN8eShY3PvacS .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-10 text{fill:black;}#mermaid-svg-LIFrN8eShY3PvacS .node-icon-10{font-size:40px;color:black;}#mermaid-svg-LIFrN8eShY3PvacS .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .edge-depth-10{stroke-width:-16;}#mermaid-svg-LIFrN8eShY3PvacS .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-LIFrN8eShY3PvacS .disabled,#mermaid-svg-LIFrN8eShY3PvacS .disabled circle,#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:lightgray;}#mermaid-svg-LIFrN8eShY3PvacS .disabled text{fill:#efefef;}#mermaid-svg-LIFrN8eShY3PvacS .section-root rect,#mermaid-svg-LIFrN8eShY3PvacS .section-root path,#mermaid-svg-LIFrN8eShY3PvacS .section-root circle,#mermaid-svg-LIFrN8eShY3PvacS .section-root polygon{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-LIFrN8eShY3PvacS .section-root text{fill:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .section-root span{color:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .section-2 span{color:#ffffff;}#mermaid-svg-LIFrN8eShY3PvacS .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-LIFrN8eShY3PvacS .edge{fill:none;}#mermaid-svg-LIFrN8eShY3PvacS .mindmap-node-label{dy:1em;alignment-baseline:middle;text-anchor:middle;dominant-baseline:middle;text-align:center;}#mermaid-svg-LIFrN8eShY3PvacS :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

VulnClaw Skills

核心技能

pentest-flow

recon

vuln-discovery

exploitation

post-exploitation

reporting

waf-bypass

CTF 专项

ctf-web

ctf-crypto

ctf-misc

OSINT

osint-recon

20 个 Skill，138 个参考文档，覆盖渗透测试全流程。

5. 编解码/加解密工具（29 种）

#mermaid-svg-3HrAN1Le4aGhHrKt{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-3HrAN1Le4aGhHrKt .error-icon{fill:#552222;}#mermaid-svg-3HrAN1Le4aGhHrKt .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-3HrAN1Le4aGhHrKt .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-3HrAN1Le4aGhHrKt .marker{fill:#333333;stroke:#333333;}#mermaid-svg-3HrAN1Le4aGhHrKt .marker.cross{stroke:#333333;}#mermaid-svg-3HrAN1Le4aGhHrKt svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-3HrAN1Le4aGhHrKt p{margin:0;}#mermaid-svg-3HrAN1Le4aGhHrKt .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster-label text{fill:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster-label span{color:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster-label span p{background-color:transparent;}#mermaid-svg-3HrAN1Le4aGhHrKt .label text,#mermaid-svg-3HrAN1Le4aGhHrKt span{fill:#333;color:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt .node rect,#mermaid-svg-3HrAN1Le4aGhHrKt .node circle,#mermaid-svg-3HrAN1Le4aGhHrKt .node ellipse,#mermaid-svg-3HrAN1Le4aGhHrKt .node polygon,#mermaid-svg-3HrAN1Le4aGhHrKt .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-3HrAN1Le4aGhHrKt .rough-node .label text,#mermaid-svg-3HrAN1Le4aGhHrKt .node .label text,#mermaid-svg-3HrAN1Le4aGhHrKt .image-shape .label,#mermaid-svg-3HrAN1Le4aGhHrKt .icon-shape .label{text-anchor:middle;}#mermaid-svg-3HrAN1Le4aGhHrKt .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-3HrAN1Le4aGhHrKt .rough-node .label,#mermaid-svg-3HrAN1Le4aGhHrKt .node .label,#mermaid-svg-3HrAN1Le4aGhHrKt .image-shape .label,#mermaid-svg-3HrAN1Le4aGhHrKt .icon-shape .label{text-align:center;}#mermaid-svg-3HrAN1Le4aGhHrKt .node.clickable{cursor:pointer;}#mermaid-svg-3HrAN1Le4aGhHrKt .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-3HrAN1Le4aGhHrKt .arrowheadPath{fill:#333333;}#mermaid-svg-3HrAN1Le4aGhHrKt .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-3HrAN1Le4aGhHrKt .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-3HrAN1Le4aGhHrKt .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-3HrAN1Le4aGhHrKt .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-3HrAN1Le4aGhHrKt .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-3HrAN1Le4aGhHrKt .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster text{fill:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt .cluster span{color:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-3HrAN1Le4aGhHrKt .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-3HrAN1Le4aGhHrKt rect.text{fill:none;stroke-width:0;}#mermaid-svg-3HrAN1Le4aGhHrKt .icon-shape,#mermaid-svg-3HrAN1Le4aGhHrKt .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-3HrAN1Le4aGhHrKt .icon-shape p,#mermaid-svg-3HrAN1Le4aGhHrKt .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-3HrAN1Le4aGhHrKt .icon-shape .label rect,#mermaid-svg-3HrAN1Le4aGhHrKt .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-3HrAN1Le4aGhHrKt .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-3HrAN1Le4aGhHrKt .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-3HrAN1Le4aGhHrKt :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

自动识别

加解密

哈希

编解码

Base64

Base32

Base58

Hex

URL编码

HTML实体

Unicode

ROT13

Morse码

MD5

SHA1

SHA256/512

AES CBC/PKCS7

JWT 编解码

自动识别解码

6. 持续性渗透测试

• 默认配置：100 轮/周期 × 10 周期 = 1000 轮
• 每周期自动生成报告
• 跨周期状态保持，越打越深入

7. 自动化报告 & PoC 生成

#mermaid-svg-65hV5K5rPq2lWcEG{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-65hV5K5rPq2lWcEG .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-65hV5K5rPq2lWcEG .error-icon{fill:#552222;}#mermaid-svg-65hV5K5rPq2lWcEG .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-65hV5K5rPq2lWcEG .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-65hV5K5rPq2lWcEG .marker{fill:#333333;stroke:#333333;}#mermaid-svg-65hV5K5rPq2lWcEG .marker.cross{stroke:#333333;}#mermaid-svg-65hV5K5rPq2lWcEG svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-65hV5K5rPq2lWcEG p{margin:0;}#mermaid-svg-65hV5K5rPq2lWcEG .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-65hV5K5rPq2lWcEG .cluster-label text{fill:#333;}#mermaid-svg-65hV5K5rPq2lWcEG .cluster-label span{color:#333;}#mermaid-svg-65hV5K5rPq2lWcEG .cluster-label span p{background-color:transparent;}#mermaid-svg-65hV5K5rPq2lWcEG .label text,#mermaid-svg-65hV5K5rPq2lWcEG span{fill:#333;color:#333;}#mermaid-svg-65hV5K5rPq2lWcEG .node rect,#mermaid-svg-65hV5K5rPq2lWcEG .node circle,#mermaid-svg-65hV5K5rPq2lWcEG .node ellipse,#mermaid-svg-65hV5K5rPq2lWcEG .node polygon,#mermaid-svg-65hV5K5rPq2lWcEG .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-65hV5K5rPq2lWcEG .rough-node .label text,#mermaid-svg-65hV5K5rPq2lWcEG .node .label text,#mermaid-svg-65hV5K5rPq2lWcEG .image-shape .label,#mermaid-svg-65hV5K5rPq2lWcEG .icon-shape .label{text-anchor:middle;}#mermaid-svg-65hV5K5rPq2lWcEG .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-65hV5K5rPq2lWcEG .rough-node .label,#mermaid-svg-65hV5K5rPq2lWcEG .node .label,#mermaid-svg-65hV5K5rPq2lWcEG .image-shape .label,#mermaid-svg-65hV5K5rPq2lWcEG .icon-shape .label{text-align:center;}#mermaid-svg-65hV5K5rPq2lWcEG .node.clickable{cursor:pointer;}#mermaid-svg-65hV5K5rPq2lWcEG .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-65hV5K5rPq2lWcEG .arrowheadPath{fill:#333333;}#mermaid-svg-65hV5K5rPq2lWcEG .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-65hV5K5rPq2lWcEG .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-65hV5K5rPq2lWcEG .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-65hV5K5rPq2lWcEG .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-65hV5K5rPq2lWcEG .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-65hV5K5rPq2lWcEG .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-65hV5K5rPq2lWcEG .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-65hV5K5rPq2lWcEG .cluster text{fill:#333;}#mermaid-svg-65hV5K5rPq2lWcEG .cluster span{color:#333;}#mermaid-svg-65hV5K5rPq2lWcEG div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-65hV5K5rPq2lWcEG .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-65hV5K5rPq2lWcEG rect.text{fill:none;stroke-width:0;}#mermaid-svg-65hV5K5rPq2lWcEG .icon-shape,#mermaid-svg-65hV5K5rPq2lWcEG .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-65hV5K5rPq2lWcEG .icon-shape p,#mermaid-svg-65hV5K5rPq2lWcEG .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-65hV5K5rPq2lWcEG .icon-shape .label rect,#mermaid-svg-65hV5K5rPq2lWcEG .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-65hV5K5rPq2lWcEG .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-65hV5K5rPq2lWcEG .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-65hV5K5rPq2lWcEG :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

渗透测试

Markdown 报告

Python PoC 脚本

包含

目标信息

漏洞详情

利用过程

修复建议

可直接运行

环境验证

漏洞利用

结果验证

0x03 快速上手

安装

# 一键安装
curl -fsSL https://raw.githubusercontent.com/Unclecheng-li/VulnClaw/main/scripts/install.sh | bash

# 或 pip 安装
pip install vulclaw

使用方式

# 方式一：REPL 交互模式（推荐）
vulnclaw

# 方式二：单命令全流程
vulnclaw run 192.168.1.100

# 方式三：持续性渗透
vulnclaw persistent 192.168.1.100

# 方式四：仅信息收集
vulnclaw recon target.com

# 方式五：漏洞扫描
vulnclaw scan target.com –ports 80,443,8080

REPL 交互示例

$ vulnclaw

████████╗██╗ ██╗ █████╗ ██████╗ ███████╗
╚══██╔══╝██║ ██║██╔══██╗██╔══██╗██╔════╝
██║ ███████║███████║██████╔╝███████╗
██║ ██╔══██║██╔══██║██╔═══╝ ╚════██║
██║ ██║ ██║██║ ██║██║ ███████║
╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚══════╝

> 说人话，打漏洞

[主机] 请输入目标: 192.168.1.100
[模式] 选择模式 (1.自动 2.交互): 1
[AI] 正在分析目标…
[AI] 开始信息收集阶段…
[MCP] 调用 http_scan 工具
[发现] 目标开放端口: 80, 443, 8080
[发现] Web服务: Apache/2.4.41
[漏洞] 检测到可疑端点: /admin/login.php
[AI] 开始漏洞利用阶段…
[利用] 尝试 SQL注入检测… [疑似] 参数 id 未过滤
[报告] 报告已生成: report_192.168.1.100_20260426.md
[PoC] PoC脚本已生成: poc_sqli_192.168.1.100.py

0x04 架构解析

#mermaid-svg-8XU6ZoGO5qyoLZa0{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .error-icon{fill:#552222;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .marker.cross{stroke:#333333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 p{margin:0;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster-label text{fill:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster-label span{color:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster-label span p{background-color:transparent;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .label text,#mermaid-svg-8XU6ZoGO5qyoLZa0 span{fill:#333;color:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .node rect,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node circle,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node ellipse,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node polygon,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .rough-node .label text,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node .label text,#mermaid-svg-8XU6ZoGO5qyoLZa0 .image-shape .label,#mermaid-svg-8XU6ZoGO5qyoLZa0 .icon-shape .label{text-anchor:middle;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .rough-node .label,#mermaid-svg-8XU6ZoGO5qyoLZa0 .node .label,#mermaid-svg-8XU6ZoGO5qyoLZa0 .image-shape .label,#mermaid-svg-8XU6ZoGO5qyoLZa0 .icon-shape .label{text-align:center;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .node.clickable{cursor:pointer;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .arrowheadPath{fill:#333333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-8XU6ZoGO5qyoLZa0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-8XU6ZoGO5qyoLZa0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster text{fill:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .cluster span{color:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-8XU6ZoGO5qyoLZa0 rect.text{fill:none;stroke-width:0;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .icon-shape,#mermaid-svg-8XU6ZoGO5qyoLZa0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .icon-shape p,#mermaid-svg-8XU6ZoGO5qyoLZa0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .icon-shape .label rect,#mermaid-svg-8XU6ZoGO5qyoLZa0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-8XU6ZoGO5qyoLZa0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-8XU6ZoGO5qyoLZa0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-8XU6ZoGO5qyoLZa0 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

模型层

工具层

核心层

用户层

CLI 命令行

REPL 交互

LLM Agent

Skill 系统

记忆管理

MCP 工具链

编解码工具

代码执行

OpenAI

DeepSeek

MiniMax

自定义

LLM Provider

0x05 使用场景

0x06 与传统工具对比

0x07 安全声明

⚠️ VulnClaw 仅用于已授权的安全测试

使用前需确保：

• 已获得目标系统的明确书面授权
• 测试范围已与目标所有者书面确认
• 遵守当地法律法规

未经授权进行渗透测试是违法行为。

0x08 Roadmap

#mermaid-svg-bKOhQmZZBfIK1PGa{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-bKOhQmZZBfIK1PGa .error-icon{fill:#552222;}#mermaid-svg-bKOhQmZZBfIK1PGa .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-bKOhQmZZBfIK1PGa .marker{fill:#333333;stroke:#333333;}#mermaid-svg-bKOhQmZZBfIK1PGa .marker.cross{stroke:#333333;}#mermaid-svg-bKOhQmZZBfIK1PGa svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-bKOhQmZZBfIK1PGa p{margin:0;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge{stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 text{fill:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon–1{font-size:40px;color:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge–1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth–1{stroke-width:17;}#mermaid-svg-bKOhQmZZBfIK1PGa .section–1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-0{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-0{stroke-width:14;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-1{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-1{stroke-width:11;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 text{fill:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-2{stroke-width:8;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-3{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-3{stroke-width:5;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-4{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-4{stroke-width:2;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-5{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-5{stroke-width:-1;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-6{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-6{stroke-width:-4;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-7{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-7{stroke-width:-7;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-8{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-8{stroke-width:-10;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-9{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-9{stroke-width:-13;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 circle,#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 text{fill:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .node-icon-10{font-size:40px;color:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .edge-depth-10{stroke-width:-16;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-bKOhQmZZBfIK1PGa .lineWrapper line{stroke:black;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled circle,#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:lightgray;}#mermaid-svg-bKOhQmZZBfIK1PGa .disabled text{fill:#efefef;}#mermaid-svg-bKOhQmZZBfIK1PGa .section-root rect,#mermaid-svg-bKOhQmZZBfIK1PGa .section-root path,#mermaid-svg-bKOhQmZZBfIK1PGa .section-root circle{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-bKOhQmZZBfIK1PGa .section-root text{fill:#ffffff;}#mermaid-svg-bKOhQmZZBfIK1PGa .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-bKOhQmZZBfIK1PGa .edge{fill:none;}#mermaid-svg-bKOhQmZZBfIK1PGa .eventWrapper{filter:brightness(120%);}#mermaid-svg-bKOhQmZZBfIK1PGa :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

2026 Q1

v0.1.0 基础架构

MCP 工具链

7个核心 Skill

2026 Q2

v0.2.0 CTF 专项

13个 CTF Skill

29种编解码

v0.2.5 最新稳定版

2026 Q3

v0.3.0 RAG 知识库

安全知识库接入

漏洞库自动更新

2026 Q4

v1.0.0 正式版

Web UI

插件市场

云端协作

VulnClaw 发展路线图

0x09 总结

#mermaid-svg-ihnIQ0OO8lKx4CTC{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-ihnIQ0OO8lKx4CTC .error-icon{fill:#552222;}#mermaid-svg-ihnIQ0OO8lKx4CTC .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-ihnIQ0OO8lKx4CTC .marker{fill:#333333;stroke:#333333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .marker.cross{stroke:#333333;}#mermaid-svg-ihnIQ0OO8lKx4CTC svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-ihnIQ0OO8lKx4CTC p{margin:0;}#mermaid-svg-ihnIQ0OO8lKx4CTC .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster-label text{fill:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster-label span{color:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster-label span p{background-color:transparent;}#mermaid-svg-ihnIQ0OO8lKx4CTC .label text,#mermaid-svg-ihnIQ0OO8lKx4CTC span{fill:#333;color:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .node rect,#mermaid-svg-ihnIQ0OO8lKx4CTC .node circle,#mermaid-svg-ihnIQ0OO8lKx4CTC .node ellipse,#mermaid-svg-ihnIQ0OO8lKx4CTC .node polygon,#mermaid-svg-ihnIQ0OO8lKx4CTC .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .rough-node .label text,#mermaid-svg-ihnIQ0OO8lKx4CTC .node .label text,#mermaid-svg-ihnIQ0OO8lKx4CTC .image-shape .label,#mermaid-svg-ihnIQ0OO8lKx4CTC .icon-shape .label{text-anchor:middle;}#mermaid-svg-ihnIQ0OO8lKx4CTC .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .rough-node .label,#mermaid-svg-ihnIQ0OO8lKx4CTC .node .label,#mermaid-svg-ihnIQ0OO8lKx4CTC .image-shape .label,#mermaid-svg-ihnIQ0OO8lKx4CTC .icon-shape .label{text-align:center;}#mermaid-svg-ihnIQ0OO8lKx4CTC .node.clickable{cursor:pointer;}#mermaid-svg-ihnIQ0OO8lKx4CTC .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .arrowheadPath{fill:#333333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ihnIQ0OO8lKx4CTC .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-ihnIQ0OO8lKx4CTC .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ihnIQ0OO8lKx4CTC .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster text{fill:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC .cluster span{color:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-ihnIQ0OO8lKx4CTC .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-ihnIQ0OO8lKx4CTC rect.text{fill:none;stroke-width:0;}#mermaid-svg-ihnIQ0OO8lKx4CTC .icon-shape,#mermaid-svg-ihnIQ0OO8lKx4CTC .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ihnIQ0OO8lKx4CTC .icon-shape p,#mermaid-svg-ihnIQ0OO8lKx4CTC .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-ihnIQ0OO8lKx4CTC .icon-shape .label rect,#mermaid-svg-ihnIQ0OO8lKx4CTC .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ihnIQ0OO8lKx4CTC .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-ihnIQ0OO8lKx4CTC .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-ihnIQ0OO8lKx4CTC :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

传统渗透

效率低

工具杂

报告难

VulnClaw

说人话就行

一站式自动化

报告自动生

VulnClaw 不是要取代安全工程师，而是让安全工程师更高效。

Links

• GitHub: https://github.com/Unclecheng-li/VulnClaw
• 文档: README.md
• Issue: 欢迎提 Bug 和 Feature

如果你觉得这个项目有帮助，请给个 Star ⭐