Offensive Set

OffensiveSET

Offensive Security Dataset Generator — An MCP server that generates high-quality, multi-turn pentesting conversation datasets for fine-tuning security-focused LLMs.

专为Qwen3.5等训练模型而设计，使其能够像专业渗透测试人员一样思考和行动。

______________________________________________________________________

它的作用

OffensiveSET以ShareGPT/ChatML JSONL格式生成逼真的渗透测试对话。每一次进入都是一次完整的最重要的参与——从侦察到开采再到专业报告——涉及：

• 多回合对话 （8-15圈）遵循真实的pentester工作流程
• 思维链推理 通过 `` 对戊酯如何分析攻击面进行建模
• 逼真的工具输出 --独特的nmap扫描、sqlmap转储、每个条目的核发现（无重复）
• 故障案例 --阻止攻击、WAF绕过、蜜罐检测和旋转策略
• 专业报告 --CVSS评分、CWE参考、证据PoC和安全代码修复
• Qwen3.5原生格式 — observation 角色， ` 内联标签 ` 推理

______________________________________________________________________

统计

______________________________________________________________________

快速开始

安装和设置

git clone https://github.com/PentesterFlow/OffensiveSET.git
cd OffensiveSET
npm install
npm run build

Claude代码（CLI）——最快速的安装

# Add the MCP server (run from inside the cloned repo)
claude mcp add offensiveset node $(pwd)/dist/index.js

# Verify
claude mcp list

# Start using it
claude

克劳德桌面（GUI）

打开MCP配置文件：

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• 视窗: %APPDATA%\Claude\claude_desktop_config.json

添加此块（更新克隆仓库的路径）：

{
  "mcpServers": {
    "offensiveset": {
      "command": "node",
      "args": ["/Users/YOUR_USER/OffensiveSET/dist/index.js"]
    }
  }
}

重新启动克劳德桌面。10个进攻设置工具将出现在工具菜单中。

VS代码/JetBrains（克劳德代码扩展）

# From the integrated terminal
claude mcp add offensiveset node /path/to/OffensiveSET/dist/index.js

或者添加一个 .mcp.json 到您的项目根目录：

{
  "mcpServers": {
    "offensiveset": {
      "command": "node",
      "args": ["/path/to/OffensiveSET/dist/index.js"]
    }
  }
}

一行安装（克隆+构建+注册）

git clone https://github.com/PentesterFlow/OffensiveSET.git && cd OffensiveSET && npm install && npm run build && claude mcp add offensiveset node $(pwd)/dist/index.js

生成数据集

连接后，请Claude使用以下工具：

> Generate a 5000 entry offensive security dataset with 60% thinking blocks

> List all available attack scenarios

> Preview a single entry for the NoSQL injection scenario

> Export my dataset to Qwen ChatML format

或者直接调用工具：

generate_dataset_v2
  count: 5000
  thinking_ratio: 0.6
  failure_ratio: 0.35
  thinking_style: "inline"

出口培训

export_for_training
  input_path: "./datasets/your_dataset.jsonl"
  output_format: "chatml_qwen"

______________________________________________________________________

MCP工具

______________________________________________________________________

数据集输出格式

每一行JSONL都是一个完整的渗透测试对话：

{
  "id": "offensiveset-owasp-a03-sqli-584721-42",
  "conversations": [
    {"from": "system", "value": "You are PentesterFlow, an expert offensive security AI..."},
    {"from": "human", "value": "Perform recon on acme-corp.com..."},
    {"from": "gpt", "value": "\nLet me analyze the attack surface...\n\n\n## Recon Results\n...", "tool_calls": [...]},
    {"from": "observation", "value": "[nmap] PORT STATE SERVICE...", "tool_results": [...]},
    {"from": "human", "value": "Exploit the SQLi finding..."},
    {"from": "gpt", "value": "\nThe parameter is injectable...\n\n\n## Exploitation\n..."},
    {"from": "gpt", "value": "## Finding Report\n| Severity | Critical 9.8 | ..."}
  ],
  "metadata": {
    "scenario_id": "owasp-a03-sqli",
    "category": "OWASP Top 10",
    "difficulty": "advanced",
    "tags": ["sqli", "injection"],
    "tools_used": ["nmap", "sqlmap", "curl"],
    "has_thinking": true,
    "has_failures": false,
    "turn_count": 12,
    "estimated_tokens": 4606,
    "cve_references": ["CWE-89"]
  }
}

______________________________________________________________________

场景覆盖范围

OWASP前10名（19种情况）

IDOR、管理面板旁路、JWT算法混淆、盲SQL注入、SSTI到RCE、业务逻辑缺陷、云配置错误、存储XSS、NoSQL注入、XXE、路径遍历、文件上传RCE、批量分配、CRLF注入、LDAP注入、OAuth令牌盗窃、2FA旁路、反序列化RCE

现代攻击（20种场景）

GraphQL批处理、HTTP请求走私、原型污染、竞争条件、WebSocket劫持、子域接管、CORS利用、缓存中毒、CI/CD管道攻击、容器逃逸、DNS重新绑定、Kubernetes RBAC逃逸、GitHub Actions Secret Exfiltration

API安全前十（6种场景）

BOLA+批量分配、过度数据暴露、功能级别授权中断、绕过速率限制

______________________________________________________________________

工具库（40种工具）

侦察： nmap、子索引器、聚光器、httpx、rustscan、puredns、dnsx

枚举： ffuf、gobuster、dirsearch、feroxbuster、katana、kiterunner、linkfinder、paramspider、gau、arjun

扫描： nucleus、nikto、wfuzz、trufflehog、semgrep、crlfuzz、corsy、secretfinder、testssl

开采： sqlmap、dalfox、commix、ssrfmap、jwttool、hydra、metasploit、caido、interact、nosqlmap

公用设施： curl、linpeas、报表生成器、gf

______________________________________________________________________

Qwen3.5培训

LLaMA工厂

# dataset_info.json
{
  "offensiveset": {
    "file_name": "dataset_chatml_qwen.jsonl",
    "formatting": "sharegpt",
    "columns": {
      "messages": "messages"
    },
    "tags": {
      "role_tag": "role",
      "content_tag": "content",
      "user_tag": "user",
      "assistant_tag": "assistant",
      "observation_tag": "observation",
      "system_tag": "system"
    }
  }
}

llamafactory-cli train \
  --model_name_or_path Qwen/Qwen3.5-7B \
  --stage sft \
  --dataset offensiveset \
  --template qwen \
  --output_dir ./offensiveset-model \
  --per_device_train_batch_size 2 \
  --gradient_accumulation_steps 8 \
  --learning_rate 1e-4 \
  --num_train_epochs 3 \
  --cutoff_len 8192 \
  --finetuning_type lora \
  --lora_rank 64 \
  --bf16 true

推荐设置

______________________________________________________________________

项目结构

src/
├── index.ts                          # Entry point (34 lines)
├── server/
│   ├── generate-tools.ts             # generate_dataset, generate_dataset_v2
│   ├── browse-tools.ts               # list_scenarios, list_tools, preview
│   ├── analysis-tools.ts             # stats, validate, quality_score
│   ├── export-tools.ts               # export, merge
│   └── resources.ts                  # MCP resources
├── generators/
│   ├── v1-generator.ts               # V1 generation engine
│   ├── v2/
│   │   ├── types.ts                  # Interfaces + config
│   │   ├── prompts.ts                # 120+ prompt templates
│   │   ├── system-prompts.ts         # System prompt rotation
│   │   ├── responses.ts             # Grounded response generation
│   │   ├── reports.ts                # Reports + remediation
│   │   ├── conversation.ts           # Conversation builder
│   │   ├── post-processor.ts         # Qwen compat + token control
│   │   ├── quality.ts                # Quality scoring engine
│   │   └── index.ts                  # Main generator
│   ├── outputs/
│   │   ├── helpers.ts                # RNG, TargetProfile, constants
│   │   ├── recon.ts                  # nmap, rustscan, subfinder...
│   │   ├── enum.ts                   # ffuf, feroxbuster, katana...
│   │   ├── vuln.ts                   # nuclei, semgrep, testssl...
│   │   ├── exploit.ts                # sqlmap, hydra, metasploit...
│   │   ├── cloud.ts                  # S3, env files
│   │   ├── failures.ts               # 13 failure patterns
│   │   └── index.ts                  # DynamicOutputEngine
│   └── thinking-engine.ts            # Chain-of-thought reasoning
├── templates/
│   └── scenarios/
│       ├── types.ts                  # ScenarioTemplate interface
│       ├── owasp.ts                  # OWASP Top 10 scenarios
│       ├── modern.ts                 # Modern attacks
│       ├── api.ts                    # API Security scenarios
│       ├── advanced.ts               # Advanced scenarios
│       └── index.ts                  # ALL_SCENARIOS
└── schemas/
    └── tools/
        ├── types.ts                  # ToolDefinition interface
        ├── recon.ts                  # Recon tools
        ├── enum.ts                   # Enumeration tools
        ├── scan.ts                   # Scanning tools
        ├── exploit.ts                # Exploitation tools
        ├── utility.ts                # Utility tools
        └── index.ts                  # PENTESTING_TOOLS

______________________________________________________________________

添加新内容

添加场景

编辑 src/templates/scenarios/advanced.ts （或创建新的类别文件）：

{
  id: "my-new-scenario",
  category: "OWASP Top 10",
  subcategory: "A03 - Injection",
  title: "My Custom Injection Scenario",
  difficulty: "advanced",
  description: "...",
  target_description: "...",
  attack_phases: [ /* 4-6 phases */ ],
  cve_references: ["CWE-89"],
  tools_involved: ["sqlmap", "curl"],
  tags: ["sqli", "injection"],
}

添加工具

在中编辑相关类别文件 src/schemas/tools/:

{
  name: "mytool",
  description: "...",
  category: "scanning",
  parameters: { /* ... */ },
  example_commands: ["mytool -u https://target.com"],
  typical_output: "...",
}

添加动态输出生成器

添加一个方法 src/generators/outputs/ 在相应的类别文件中，然后将其注册到 src/generators/outputs/index.ts.

______________________________________________________________________

许可证

麻省理工学院

______________________________________________________________________

作者

秘密 --攻击性安全研究员