payload_search_tool

net.honeylabs/mcp · Verify this server

Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last week'. It matches text that literally appeared in the request, and nothing else. These do NOT work and will return an empty list: - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text. Use cve_lookup instead. This tool rejects them rather than answering emptily. - a product or vendor name ('Cisco FMC', '7-Zip'), which appears in an advisory, not in the request. Search the endpoint it exposes instead, e.g. '/ccmadmin' or the vulnerable path. - a description of behaviour ('SQL injection attempts'). Search a marker that occurs in the traffic, e.g. 'UNION SELECT' or '../'. An empty list is a real answer: it means no captured request in that window contained the string. Widen since/until before concluding the activity does not exist. Free to call; volume is metered like every other tool. since/until are ISO-8601 UTC strings.