Sign inSign up

crhacky/blhackbox

By crhacky

•Updated 4 months ago

black-box pentesting

Image
Security
Machine learning & AI
0

10K+

crhacky/blhackbox repository overview

⁠BLHACKBOX — Docker Reference

MCP-based Autonomous Pentesting Framework


⁠Quick Reference

All custom images are published to a single Docker Hub repository, differentiated by tag.

Repositorycrhacky/blhackbox⁠
RegistryDocker Hub⁠
SourceGitHub⁠
LicenseMIT

⁠Images & Tags

Four custom images are published to crhacky/blhackbox on Docker Hub:

ServiceTagDockerfileBase Image
Kali MCPcrhacky/blhackbox:kali-mcpdocker/kali-mcp.Dockerfilekalilinux/kali-rolling
WireMCPcrhacky/blhackbox:wire-mcpdocker/wire-mcp.Dockerfiledebian:bookworm-slim
Screenshot MCPcrhacky/blhackbox:screenshot-mcpdocker/screenshot-mcp.Dockerfilepython:3.13-slim
Claude Codecrhacky/blhackbox:claude-codedocker/claude-code.Dockerfilenode:22-slim

Official images (pulled directly, no custom build):

ImagePurpose
portainer/portainer-ce:latestDocker management UI
docker/mcp-gateway:latestMCP Gateway (optional, --profile gateway)
neo4j:5Knowledge graph (optional, --profile neo4j)
⁠Pulling Images
docker compose pull    # pull ALL images (custom + official) in one command

⁠Architecture

In v2, Claude (or ChatGPT) IS the orchestrator natively via MCP.

⁠Claude Code in Docker — Direct SSE (no gateway)
Claude Code ──┬──▶ Kali MCP (SSE :9001)
(container)   │    70+ tools: nmap, sqlmap, hydra, msfconsole, msfvenom…
              │
              ├──▶ WireMCP (SSE :9003)
              │    7 tools: packet capture, pcap analysis, credential extraction
              │
              ├──▶ Screenshot MCP (SSE :9004)
              │    4 tools: web screenshots, element capture, annotations
              │
              │  After collecting raw outputs, Claude structures them directly:
              │    get_payload_schema() → parse/dedup/correlate → aggregate_results()
              │
              ▼
output/          Host-mounted directory for reports, screenshots, sessions
Portainer        Docker UI (https://localhost:9443)
Neo4j            Cross-session memory (optional)
⁠Claude Desktop / ChatGPT — via MCP Gateway
Claude Desktop ──▶ MCP Gateway (localhost:8080/mcp) ──┬──▶ Kali MCP
(host app)                                             ├──▶ WireMCP
                                                       └──▶ Screenshot MCP

⁠Usage

git clone https://github.com/valITino/blhackbox.git
cd blhackbox
./setup.sh    # interactive wizard: prereqs, .env, pull, start, health
⁠Manual — Core Stack (4 containers)
git clone https://github.com/valITino/blhackbox.git && cd blhackbox
cp .env.example .env
# REQUIRED: set ANTHROPIC_API_KEY=sk-ant-... in .env
mkdir -p output/reports output/screenshots output/sessions
docker compose pull
docker compose up -d
make claude-code    # builds + launches Claude Code in Docker
⁠With MCP Gateway (for Claude Desktop / ChatGPT)
make up-gateway     # starts core + gateway on port 8080
⁠With Neo4j
docker compose --profile neo4j up -d
⁠Verify
make status         # container status table
make health         # MCP server health check

⁠Compose Services

ServiceImagePortProfileRole
kali-mcpcrhacky/blhackbox:kali-mcp9001defaultKali Linux security tools + Metasploit (70+)
wire-mcpcrhacky/blhackbox:wire-mcp9003defaultWireshark / tshark (7 tools)
screenshot-mcpcrhacky/blhackbox:screenshot-mcp9004defaultScreenshot MCP (headless Chromium, 4 tools)
portainerportainer/portainer-ce:latest9443defaultDocker management UI (HTTPS)
claude-codecrhacky/blhackbox:claude-code—claude-codeClaude Code CLI client (Docker)
mcp-gatewaydocker/mcp-gateway:latest8080gatewaySingle MCP entry point (host clients)
neo4jneo4j:57474 / 7687neo4jCross-session knowledge graph

⁠MCP Connection Modes

⁠Claude Code in Docker (Direct SSE — no gateway)

The Claude Code container's .mcp.json connects directly to each server:

{
  "mcpServers": {
    "kali":       { "type": "sse", "url": "http://kali-mcp:9001/sse" },
    "wireshark":  { "type": "sse", "url": "http://wire-mcp:9003/sse" },
    "screenshot": { "type": "sse", "url": "http://screenshot-mcp:9004/sse" }
  }
}
⁠Claude Desktop (via MCP Gateway)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "blhackbox": {
      "transport": "streamable-http",
      "url": "http://localhost:8080/mcp"
    }
  }
}

Requires --profile gateway (make up-gateway).


⁠Environment Variables

VariableDefaultDescription
ANTHROPIC_API_KEY—Required for Claude Code in Docker
MCP_GATEWAY_PORT8080MCP Gateway host port (optional)
MSF_TIMEOUT300Metasploit command timeout in seconds
NEO4J_URIbolt://neo4j:7687Neo4j connection URI (optional)
NEO4J_USERneo4jNeo4j username (optional)
NEO4J_PASSWORD—Neo4j password, min 8 chars (optional)
SCREENSHOT_MCP_PORT9004Screenshot MCP server port
OPENAI_API_KEY—For OpenAI MCP clients (optional)

⁠Image Details

⁠Kali MCP — crhacky/blhackbox:kali-mcp
Basekalilinux/kali-rolling
TransportSSE on port 9001
PrivilegedYes (raw socket access)
Entrypointentrypoint.sh (starts PostgreSQL for MSF DB, then MCP server)

Tools (70+): nmap, masscan, hping3, subfinder, amass, fierce, dnsenum, dnsrecon, theharvester, nikto, gobuster, dirb, dirsearch, ffuf, feroxbuster, whatweb, wafw00f, wpscan, arjun, dalfox, sqlmap, hydra, medusa, john, hashcat, crackmapexec, evil-winrm, enum4linux-ng, responder, netexec, aircrack-ng, bettercap, binwalk, foremost, exiftool, steghide, curl, wget, netcat, socat, msfconsole, msfvenom, and more.

Metasploit: Integrated via CLI (msfconsole -qx) — no msfrpcd daemon needed. Includes PostgreSQL for Metasploit DB support.

MCP Tools: run_kali_tool, run_shell_command, list_available_tools, msf_search, msf_module_info, msf_run_module, msf_payload_generate, msf_console_execute, msf_status

⁠WireMCP — crhacky/blhackbox:wire-mcp
Basedebian:bookworm-slim
TransportSSE on port 9003
PrivilegedYes (packet capture)
EntrypointWireMCP server (server.py)

Tools (7): capture_packets, read_pcap, get_conversations, get_statistics, extract_credentials, follow_stream, list_interfaces

Inspired by: 0xKoda/WireMCP⁠, khuynh22/mcp-wireshark⁠

⁠Screenshot MCP — crhacky/blhackbox:screenshot-mcp
Basepython:3.13-slim
TransportSSE on port 9004
EntrypointScreenshot MCP server (FastMCP + Playwright headless Chromium)

Tools (4): take_screenshot (full-page web capture), take_element_screenshot (CSS selector targeting), annotate_screenshot (labels and highlight boxes), list_screenshots (evidence inventory)

⁠Claude Code — crhacky/blhackbox:claude-code
Basenode:22-slim
Entrypointclaude-code-entrypoint.sh (health checks + launch)
MCP configDirect SSE to each server (no gateway dependency)
RequiresANTHROPIC_API_KEY in .env

⁠Portainer

Portainer CE provides a web dashboard for all blhackbox containers.

URLhttps://localhost:9443
First runCreate an admin account within 5 minutes of startup
Missed the window?docker compose restart portainer

Note: Your browser will warn about the self-signed HTTPS certificate. This is expected — click "Advanced" and proceed.


⁠Volumes

⁠Named volumes (persistent data)
VolumeServicePurpose
neo4j_dataneo4jNeo4j graph database (optional)
neo4j_logsneo4jNeo4j logs (optional)
portainer_dataportainerPortainer configuration
wordlists—Fuzzing wordlists
⁠Host bind mounts (accessible on your local filesystem)
Host PathContainer PathContents
./output/reports//root/reports/Generated pentest reports (.md, .pdf)
./output/screenshots//tmp/screenshots/PoC evidence screenshots (.png)
./output/sessions//root/results/Aggregated session JSON files

⁠CI/CD Pipeline

Four custom images are built and pushed to Docker Hub via GitHub Actions:

PR opened  ─────▶  CI (lint + test + pip-audit)
                        │
PR merged  ─────▶  CI  ─────▶  Build & Push (4 images)  ─────▶  Docker Hub
                                (on CI success)

Tag v*     ──────────────────▶  Build & Push (4 images)  ─────▶  Docker Hub

Manual     ──────────────────▶  Build & Push (4 images)  ─────▶  Docker Hub

⁠Useful Commands

make setup              # Interactive setup wizard (first-time setup)
docker compose pull     # Pull all pre-built images
docker compose up -d    # Start core stack (4 containers)
make up-gateway         # Start with MCP Gateway (5 containers)
make claude-code        # Launch Claude Code in Docker
make health             # Health check all MCP servers
make status             # Container status table
make logs-kali          # Kali MCP logs
make logs-wireshark     # WireMCP logs
make logs-screenshot    # Screenshot MCP logs
make gateway-logs       # MCP Gateway logs
make down               # Stop all services
make clean              # Stop + remove volumes

⁠Security

  • Docker socket — MCP Gateway (optional) and Portainer mount /var/run/docker.sock. This grants effective root on the host. Never expose ports 8080 or 9443 to the public internet.
  • Authorization — Ensure you have written permission before scanning any target.
  • Neo4j — Set a strong password in .env. Never use defaults in production.
  • Portainer — Uses HTTPS with a self-signed certificate. Create a strong admin password on first run.

This tool is for authorized security testing only. Unauthorized access to computer systems is illegal.


⁠Source

GitHub Repository⁠ · Docker Hub⁠

Tag summary

Content type

Image

Digest

sha256:5c329a315…

Size

253.1 MB

Last updated

4 months ago

docker pull crhacky/blhackbox:claude-code