The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"name": "CyberShield \u2014 Attack Executor",
"nodes": [
{
"parameters": {
"httpMethod": "POST",
"path": "attack-execute",
"responseMode": "responseNode",
"options": {}
},
"id": "node-webhook",
"name": "Webhook",
"type": "n8n-nodes-base.webhook",
"typeVersion": 1,
"position": [
240,
300
]
},
{
"parameters": {
"resource": "document",
"operation": "find",
"collection": "attack_templates",
"query": "={\"name\": \"{{ $json.body.attack_name }}\"}",
"options": {
"limit": 1
}
},
"id": "node-mongodb",
"name": "MongoDB \u2014 Buscar plantilla",
"type": "n8n-nodes-base.mongoDb",
"typeVersion": 1,
"position": [
460,
300
],
"credentials": {
"mongoDb": {
"name": "<your credential>"
}
},
"onError": "continueRegular"
},
{
"parameters": {
"jsCode": "const webhook = $('Webhook').first().json;\nconst webhookData = webhook.body || webhook || {};\nlet raw = [];\ntry {\n raw = $('MongoDB \u2014 Buscar plantilla').first().json;\n} catch (e) {\n raw = [];\n}\nconst tmpl = (Array.isArray(raw) && raw.length > 0) ? raw[0] : (raw && Object.keys(raw).length > 0 ? raw : null);\n\nconst parameters = webhookData.parameters || {};\nconst companyName = webhookData.company_name_val || webhookData.company_name || 'Empresa Auditada';\nconst reportId = webhookData.report_id || ('CS-RPT-' + new Date().toISOString().slice(0,10) + '-' + webhookData.attack_id);\n\nconst name = tmpl ? tmpl.name : webhookData.attack_name;\nconst mitre_id = tmpl ? tmpl.mitre_id : webhookData.mitre_id;\nconst risk_level = tmpl ? tmpl.risk_level : webhookData.risk_level;\nconst wazuh_rule_id = tmpl ? tmpl.wazuh_rule_id : webhookData.wazuh_rule_id;\nconst description = tmpl ? tmpl.description : webhookData.description;\n\nlet command = (tmpl ? tmpl.command : '') || webhookData.command;\nlet logger_command = (tmpl ? tmpl.logger_command : '') || webhookData.logger_command;\n\n// Reemplazo dinamico de par\u00e1metros en n8n como salvaguarda\nif (command && parameters) {\n for (const key in parameters) {\n const val = parameters[key];\n command = command.replace(new RegExp('{{' + key + '}}', 'g'), val || '');\n }\n}\nif (logger_command && parameters) {\n for (const key in parameters) {\n const val = parameters[key];\n logger_command = logger_command.replace(new RegExp('{{' + key + '}}', 'g'), val || '');\n }\n}\n\nreturn [{ \n json: {\n attack_id: webhookData.attack_id,\n attack_name: name,\n mitre_id: mitre_id,\n risk_level: risk_level,\n wazuh_rule_id: wazuh_rule_id,\n description: description,\n command: command,\n logger_command: logger_command,\n parameters: parameters,\n company_name: companyName,\n report_id: reportId,\n start_timestamp: new Date().toISOString()\n }\n}];"
},
"id": "node-code",
"name": "Code \u2014 Construir comandos",
"type": "n8n-nodes-base.code",
"typeVersion": 2,
"position": [
680,
300
]
},
{
"parameters": {
"resource": "command",
"operation": "execute",
"command": "=timeout 10s {{ $json.command }} ; {{ $json.logger_command ? $json.logger_command : '' }}"
},
"id": "node-ssh-attack",
"name": "SSH \u2014 Ejecutar ataque en Kali",
"type": "n8n-nodes-base.ssh",
"typeVersion": 1,
"position": [
900,
300
],
"credentials": {
"sshPassword": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"method": "POST",
"url": "http://host.docker.internal:3001/api/reports/generate",
"sendHeaders": true,
"headerParameters": {
"parameters": [
{
"name": "Content-Type",
"value": "application/json"
}
]
},
"sendBody": true,
"bodyContentType": "json",
"jsonBody": "={{ JSON.stringify({ report_id: $('Code \u2014 Construir comandos').first().json.report_id, company_name: $('Code \u2014 Construir comandos').first().json.company_name, attack_id: $('Code \u2014 Construir comandos').first().json.attack_id, attack_name: $('Code \u2014 Construir comandos').first().json.attack_name, mitre_id: $('Code \u2014 Construir comandos').first().json.mitre_id, risk_level: $('Code \u2014 Construir comandos').first().json.risk_level, description: $('Code \u2014 Construir comandos').first().json.description, command_executed: $('Code \u2014 Construir comandos').first().json.command, parameters: $('Code \u2014 Construir comandos').first().json.parameters, ssh_output: $('SSH \u2014 Ejecutar ataque en Kali').first().json.stdout || '', ssh_exit_code: $('SSH \u2014 Ejecutar ataque en Kali').first().json.exitCode || 0, start_timestamp: $('Code \u2014 Construir comandos').first().json.start_timestamp, end_timestamp: new Date().toISOString(), wazuh_rule_id: $('Code \u2014 Construir comandos').first().json.wazuh_rule_id }) }}"
},
"id": "node-report",
"name": "HTTP \u2014 Generar PDF",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 4,
"position": [
1120,
300
]
},
{
"parameters": {
"respondWith": "json",
"responseBody": "={{ JSON.stringify({ success: true, attack_id: $('Code \u2014 Construir comandos').first().json.attack_id, report_id: $('Code \u2014 Construir comandos').first().json.report_id, pdf_url: $json.pdf_url || '', ssh_exit_code: $('SSH \u2014 Ejecutar ataque en Kali').first().json.exitCode || 0, wazuh_rule_id: $('Code \u2014 Construir comandos').first().json.wazuh_rule_id, start_timestamp: $('Code \u2014 Construir comandos').first().json.start_timestamp }) }}",
"options": {}
},
"id": "node-response",
"name": "Webhook Response",
"type": "n8n-nodes-base.respondToWebhook",
"typeVersion": 1,
"position": [
1340,
300
]
}
],
"connections": {
"Webhook": {
"main": [
[
{
"node": "MongoDB \u2014 Buscar plantilla",
"type": "main",
"index": 0
}
]
]
},
"MongoDB \u2014 Buscar plantilla": {
"main": [
[
{
"node": "Code \u2014 Construir comandos",
"type": "main",
"index": 0
}
]
]
},
"Code \u2014 Construir comandos": {
"main": [
[
{
"node": "SSH \u2014 Ejecutar ataque en Kali",
"type": "main",
"index": 0
}
]
]
},
"SSH \u2014 Ejecutar ataque en Kali": {
"main": [
[
{
"node": "HTTP \u2014 Generar PDF",
"type": "main",
"index": 0
}
]
]
},
"HTTP \u2014 Generar PDF": {
"main": [
[
{
"node": "Webhook Response",
"type": "main",
"index": 0
}
]
]
}
},
"settings": {
"executionOrder": "v1"
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
mongoDbsshPassword
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
CyberShield — Attack Executor. Uses mongoDb, ssh, httpRequest. Webhook trigger; 6 nodes.
Source: https://github.com/alexgc04/CyberShield-TFG/blob/7834323d7e19db1d166d84bc4520d4e401f21a5b/infrastructure/n8n-flows/attack-executor.json — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
CyberShield Universal Workflow v4. Uses mongoDb, ssh, httpRequest. Webhook trigger; 7 nodes.
MongoDB, Ssh, HTTP Request
CyberShield — Attack Executor. Uses mongoDb, ssh, httpRequest. Webhook trigger; 6 nodes.
MongoDB, Ssh, HTTP Request
CyberShield — Attack Executor. Uses mongoDb, ssh, httpRequest. Webhook trigger; 6 nodes.
MongoDB, Ssh, HTTP Request
Orquestador Multichain AcademicChain. Uses httpRequest, moveBinaryData, mongoDb. Webhook trigger; 23 nodes.
HTTP Request, Move Binary Data, MongoDB
UFRO PP3 Orchestrator Workflow. Uses httpRequest, mongoDb. Webhook trigger; 7 nodes.
HTTP Request, MongoDB