""" Atheris fuzzing target for the waterfall vulnerability. This file is automatically discovered by FuzzForge's AtherisFuzzer module. The fuzzer looks for files named: fuzz_*.py, *_fuzz.py, or fuzz_target.py """ import sys import atheris # Import the vulnerable function from main import check_secret def TestOneInput(data): """ Atheris fuzzing entry point. This function is called by Atheris for each fuzzing iteration. The fuzzer will try to find inputs that cause crashes. Args: data: Bytes to test (generated by Atheris) The waterfall vulnerability means: - Random inputs will mostly fail (progress = 0) - Atheris will discover inputs that make progress - Eventually Atheris will find the complete secret "FUZZINGLABS" - When found, check_secret() will crash with SystemError """ try: check_secret(bytes(data)) except SystemError: # Let Atheris detect the crash # This is the vulnerability we're trying to find! raise if __name__ == "__main__": """ Standalone fuzzing mode. Run directly: python fuzz_target.py """ print("=" * 60) print("Atheris Fuzzing - Waterfall Vulnerability") print("=" * 60) print("Fuzzing will try to discover the secret string...") print("Watch for progress indicators: [DEBUG] Progress: X/11") print() print("Press Ctrl+C to stop fuzzing") print("=" * 60) print() # Setup Atheris with command-line args atheris.Setup(sys.argv, TestOneInput) # Start fuzzing atheris.Fuzz()