2026-01-26 14:38:50 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文介绍基于LangChain和MCP的智能渗透测试助手HackerAgent。该工具集成Kali常用工具，利用ReAct方法论实现从信息收集到权限提升的自动化流程。项目采用FastAPI后端与Flutter前端，提供现代化WebUI，支持流式对话与命令美化，旨在辅助渗透测试人员提升效率。 综合评分： 85 文章分类： 安全工具,AI安全,渗透测试,红队

cover_image

护网必备：一个能自己思考的攻击队AI 渗透测试助手

原创

0xSecDebug 0xSecDebug

0xSecDebug

2026年1月26日 12:50 陕西

Hacker Agent – AI 渗透测试助手

请勿利用文章内的相关技术从事非法渗透测试，由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。工具和内容均来自网络，仅做学习和记录使用，安全性自测，如有侵权请联系删除。

一个基于 LangChain 和 MCP (Model Context Protocol) 的智能渗透测试 Agent 系统，通过 AI 驱动自动化渗透测试流程，支持完整的 Web 用户界面。

项目简介

Hacker Agent 是一个专业的渗透测试 AI 助手，具备 OSCP、CEH 等专业认证知识体系。通过集成 MCP 服务器调用 Kali Linux 工具，实现从信息收集到权限提升的完整渗透测试流程。项目采用 ReAct (推理-行动) 方法论，让 AI 能够进行多步骤推理和决策，系统化地发现安全漏洞。

功能特性

核心能力

🎯 专业渗透测试: 基于标准渗透测试方法论（信息收集 → 漏洞扫描 → 漏洞利用 → 权限提升）
🤖 智能 Agent: 基于 LangChain ReAct 框架，支持流式输出和工具调用
🔌 MCP 工具集成: 通过 MCP 协议调用 Kali Linux 工具（nmap、sqlmap、metasploit 等）
📡 流式 API: FastAPI 实现的流式响应接口，支持实时输出
🌐 Web 界面: Flutter 开发的现代化 UI，支持多会话管理
🎨 命令输出美化: 命令和输出用 XML 标签包装，支持颜色编码显示

UI 特性

✅ 会话列表: 左侧栏显示所有会话，可新建、切换、删除
✅ 流式对话: 实时显示 AI 响应，支持打字机效果
✅ 命令高亮: 命令以紫色高亮显示，独立成行
✅输出美化:
退出码用颜色标识（绿色=成功，红色=失败）
stdout 用青色显示
stderr 用橙色显示
✅ 复制功能: 可一键复制命令和输出
✅ 暗色主题: 适合长时间使用的护眼界面

技术架构

技术栈

后端

Python 3.10+: 主要开发语言
LangChain: AI Agent 框架
FastAPI: 高性能 Web 框架
MCP (Model Context Protocol): 模型上下文协议
uvicorn: ASGI 服务器

前端

Flutter 3.38.6: 跨平台 UI 框架
Provider: 状态管理
http: HTTP 客户端
xml: XML 解析

架构图

┌─────────────────────────────────────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Flutter Web UI &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;┌──────────────┐ &nbsp;┌──────────────┐ &nbsp;┌──────────────┐ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ 会话列表 &nbsp; &nbsp; │ &nbsp;│ 聊天界面 &nbsp; &nbsp; │ &nbsp;│ 消息显示 &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ SessionList &nbsp;│ &nbsp;│ ChatView &nbsp; &nbsp; │ &nbsp;│ MessageWidget│ &nbsp; &nbsp; &nbsp;│
│ &nbsp;└──────────────┘ &nbsp;└──────────────┘ &nbsp;└──────────────┘ &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;└──────────────────┴──────────────────┘ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ChatProvider (状态管理) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ApiService (HTTP 客户端) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└───────────────────────────┼──────────────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ HTTP/SSE
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼
┌─────────────────────────────────────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;FastAPI 服务器 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;┌──────────────┐ &nbsp;┌──────────────┐ &nbsp;┌──────────────┐ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ /chat/stream │ &nbsp;│ /sessions/* &nbsp;│ &nbsp;│ /health &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ 流式聊天接口 │ &nbsp;│ 会话管理接口 │ &nbsp;│ 健康检查 &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;└──────────────┘ &nbsp;└──────────────┘ &nbsp;└──────────────┘ &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;└──────────────────┴──────────────┐ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LangChain Agent &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────────────┼────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌─────────────────────────┴─────────────┐
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌──────────────────┐ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;┌──────────────────┐
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;MCP Tool Adapter│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;System Prompt &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; └──────────┬───────┘ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;(渗透测试专家) &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;└──────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌──────────────────┐
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; MCP Servers &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;┌────────────┐ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│ Kali Tools │ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│ &nbsp;- nmap &nbsp; &nbsp;│ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│ &nbsp;- sqlmap &nbsp;│ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│ &nbsp;- nikto &nbsp; │ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│ &nbsp;- ... &nbsp; &nbsp; │ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;└────────────┘ &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; └──────────────────┘

快速开始

前置要求

Python 3.10+
Node.js 16+ (用于 MCP 服务器)
Flutter 3.10.7+ (前端开发/构建)

三、启动服务

方式 1: 手动启动

终端 1 – 启动 API 服务器:

source&nbsp;.venv/bin/activate &nbsp;# 激活虚拟环境
python api_server.py

终端 2 – 启动 Web 服务器:

cd&nbsp;frontend/build/web
python3 -m http.server 8080

验证服务:

# 验证 API 服务器
curl http://localhost:8000/health

# 访问 Web 界面
open http://localhost:8080 &nbsp;# macOS
# 或在浏览器打开 http://localhost:8080

停止服务

在对应的终端按 Ctrl+C 停止服务

四、使用指南

1. 打开 Web 界面

在浏览器访问 http://localhost:8080

2. 发送第一条消息

在输入框输入：

你好

AI 会进行自我介绍，说明其作为渗透测试专家的能力。

3. 执行命令

输入：

帮我执行命令：ls&nbsp;-la

你会看到：

紫色命令框: 显示 ls -la
显示命令执行结果
退出码（绿色=成功，红色=失败）
stdout（青色）
stderr（橙色）
绿色/红色输出框
显示命令执行结果

4. 会话管理

新建会话: 点击左上角的 + 按钮
切换会话: 点击左侧会话列表
删除会话: 点击会话右侧的删除图标
清空会话: 点击顶部的清空按钮

📖 项目地址

https://github.com/jasontan1024/hacker-agent

💻 威胁情报推送群

如果师傅们想要第一时间获取到最新的威胁情报，可以添加下面我创建的钉钉漏洞威胁情报群，便于师傅们可以及时获取最新的IOC。

如果师傅们想要获取网络安全相关知识内容，可以添加下面我创建的网络安全全栈知识库，便于师傅们的学习和使用：

覆盖渗透、安服、运营、代码审计、内网、移动、应急、工控、AI/LLM、数据、业务、情报、黑灰产、SOC、溯源、钓鱼、区块链等方向，内容还在持续整理中……。

点分享

点收藏

点在看

点点赞

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：0xSecDebug 0xSecDebug 0xSecDebug《护网必备：一个能自己思考的攻击队AI 渗透测试助手》