fix: enable scenario attack execution and correct scenario status#17
Open
vinhhoala wants to merge 2 commits into
Open
fix: enable scenario attack execution and correct scenario status#17vinhhoala wants to merge 2 commits into
vinhhoala wants to merge 2 commits into
Conversation
Add mmt-attacker CLI (pip install mmt-attacker) as 7th tool with 14 attack variants across 5 categories: - Network layer: SYN/UDP/ICMP flood, Ping of Death, ARP spoof, DHCP starvation - Application layer: HTTP DoS, HTTP flood, Slowloris - Credentials: SSH and FTP brute force - Amplification: DNS (50-100x) and NTP (500x) - Protocol/replay: PCAP replay Adds tools/mag/setup.sh (auto-installs mag if missing) and tools/mag/run_mag.sh (thin forwarding wrapper). CategorySelector updated to reflect 7 tools / 3 frameworks. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three fixes required to make Scenario-based attack execution work end-to-end (verified live on mmt-pentester.montimage.eu): - ProcessManager: allow nmap/hydra/dirb in the command allowlist so recon and the attack labs can run. - ProcessManager: for network CLI tools (nmap, hydra, dirb, masscan, netcat, gobuster, sqlmap, nikto) use the command built by buildAttackCommand as-is instead of appending every parameter as --key=value (which produced invalid flags and made the tools exit immediately). - ScenarioService.finalizeScenario: keep the scenario RUNNING while any attack is still running, instead of defaulting to FAILED. checkScenarioCompletion then finalizes the real status on process exit. Previously every scenario showed "failed" even when its attack completed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three backend fixes that make Scenario-based attack execution work end-to-end, verified live on
mmt-pentester.montimage.euwith a contained lab target (nmap recon, Hydra SSH brute-force, dirb HTTP content discovery — all run and complete correctly).Changes
ProcessManagerallowlist — addnmap,hydra,dirbso reconnaissance and the attack labs are permitted to run (previously rejected with "Command not allowed").ProcessManagerargument handling — for network CLI tools (nmap,hydra,dirb,masscan,netcat,gobuster,sqlmap,nikto) use the command produced bybuildAttackCommandas-is, instead of appending every scenario parameter as--key=value. The appended flags were invalid options that made the tools exit immediately.ScenarioService.finalizeScenario— keep the scenarioRUNNINGwhile any attack is still running, instead of defaulting toFAILED.checkScenarioCompletionthen sets the real status on process exit. Previously every scenario showed failed even when its attack completed (because finalize ran before the async tool process finished, and the later completion update was gated onstatus === RUNNING).Verification
running → completed(previously stuck atfailed).Notes
tsc --noEmit).🤖 Generated with Claude Code