# Base Camp Exploits

This directory contains tools and scripts for testing the vulnerable MCP server and demonstrating the OWASP MCP07 (Insufficient Authentication & Authorization) and MCP01 (Token Mismanagement & Secret Exposure) vulnerabilities.

## Prerequisites

**Complete the camp-level setup first:**

```bash
cd camps/base-camp

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# One command setup
uv sync
```

This installs all dependencies (fastmcp, uvicorn, httpx, pytest) and sets up the vulnerable server in a single step.

See [SETUP.md](../SETUP.md) for complete setup instructions.

## Starting the Vulnerable Server

First, start the server in a separate terminal:

```bash
cd camps/base-camp/vulnerable-server
uv run --project .. python -m src.server
```

The `--project ..` flag uses the parent's pyproject.toml (no activation needed!).

The server will start on `http://localhost:8000/mcp`

Keep this terminal open while testing.

## Testing Methods

You can test the vulnerability in three different ways:

### Method 1: Python Exploit Script

Run the Python test script to demonstrate the vulnerability:

```bash
cd camps/base-camp/exploits
uv run --project .. python test_vulnerable.py
```

This script demonstrates:

- Server accessibility without authentication
- How an MCP tool call would be structured
- The lack of authorization checks

**Note:** This script shows the vulnerability structure but doesn't make actual MCP tool calls (which require the streamable-http transport). For full exploitation, use Method 2 or 3.

### Method 2: MCP Inspector (Recommended)

The MCP Inspector provides a visual interface for testing MCP servers:

```bash
cd camps/base-camp/exploits
./launch-inspector-http.sh
```

This will:

1. Start the vulnerable server on port 8000
2. Launch MCP Inspector UI on `http://localhost:6274`
3. Start inspector proxy on port 6277 (connects to the server)

**In the Inspector:**

1. Configure connection:
   - Transport Type: **Streamable HTTP**
   - URL: `http://127.0.0.1:8000/mcp`
2. Click "Connect" to establish MCP connection
3. Navigate to "Tools" tab
4. Click "List Tools" to see available tools
5. Select `get_user_info` tool
6. Enter any user_id: `user_001`, `user_002`, or `user_003`
7. Click "Run Tool"
8. Observe that you can access ANY user's sensitive data without authentication

**Expected behavior:**

- ✅ Connection succeeds without any credentials
- ✅ Tool call succeeds for ANY user_id
- 🚨 This demonstrates the vulnerability!

### Method 3: GitHub Copilot (If Configured)

If you've configured the vulnerable server in `.vscode/mcp.json`, you can test it directly through GitHub Copilot in VS Code.

**Ask Copilot:**
```
#base-camp-vulnerable user_002
```

Copilot will call the `get_user_info` tool and display Bob Smith's sensitive information, proving that no authentication is required.

## Understanding the Vulnerability

### OWASP MCP07: Insufficient Authentication & Authorization
### OWASP MCP01: Token Mismanagement & Secret Exposure

The vulnerable server demonstrates multiple security issues:

1. **No Authentication**
   - MCP server accepts connections from anyone
   - No API keys, tokens, or credentials required
   - No identity verification

2. **No Authorization**
   - `get_user_info` tool accepts ANY user_id
   - No check if requester should access that user's data
   - Resource URIs (user://user_001, etc.) are accessible to all

3. **Sensitive Data Exposure**
   - SSN (Social Security Numbers)
   - Email addresses
   - Salary information
   - All accessible without permission

### Attack Scenario

1. Attacker discovers the MCP server endpoint
2. Connects to MCP server (no credentials needed)
3. Lists available tools and resources
4. Calls `get_user_info` with different user_ids
5. Extracts sensitive data for ALL users

### Security Best Practices (Not Implemented Here)

To properly secure an MCP server, you should:

- ✅ Implement authentication (API keys, OAuth, etc.)
- ✅ Validate user identity before accepting connections
- ✅ Implement authorization checks in tool handlers
- ✅ Ensure users can only access their own data
- ✅ Use HTTPS/TLS for transport security
- ✅ Audit all access attempts
- ✅ Rate limiting and monitoring

**This server intentionally violates ALL of these practices for educational purposes!**

## Files in This Directory

- `test_vulnerable.py` - Python script demonstrating the vulnerability structure
- `launch-inspector-http.sh` - Bash script to launch MCP Inspector with HTTP transport
- `README.md` - This file

## Troubleshooting

### Server Won't Start

```bash
# Check if port 8000 is already in use
lsof -i :8000

# Kill any process using port 8000
lsof -ti:8000 | xargs kill -9 2>/dev/null
```

### MCP Inspector Connection Failed

```bash
# Check if port 6277 is already in use
lsof -i :6277

# Kill old inspector instances
pkill -f "@modelcontextprotocol/inspector"
```

### "Module Not Found" Errors

Make sure you've run `uv sync` from the camp root:

```bash
cd camps/base-camp
uv sync
```

## Next Steps

After understanding this vulnerability:

1. Review the server code in `vulnerable-server/src/server.py`
2. Identify where authentication/authorization should be added
3. Move on to Camp 1 to learn about implementing security controls
4. Explore other OWASP MCP Top 10 vulnerabilities

---

**Return to [Base Camp README](../README.md)** | **[Workshop Overview](../../../README.md)**
