mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-02-14 16:32:51 +00:00
fe50d4ef72
This commit implements a complete Python fuzzing workflow using Atheris: ## Python Worker (workers/python/) - Dockerfile with Python 3.11, Atheris, and build tools - Generic worker.py for dynamic workflow discovery - requirements.txt with temporalio, boto3, atheris dependencies - Added to docker-compose.temporal.yaml with dedicated cache volume ## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/) - Reusable module extending BaseModule - Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py) - Recursive search to find targets in nested directories - Dynamically loads TestOneInput() function - Configurable max_iterations and timeout - Real-time stats callback support for live monitoring - Returns findings as ModuleFinding objects ## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/) - Temporal workflow for orchestrating fuzzing - Downloads user code from MinIO - Executes AtherisFuzzer module - Uploads results to MinIO - Cleans up cache after execution - metadata.yaml with vertical: python for routing ## Test Project (test_projects/python_fuzz_waterfall/) - Demonstrates stateful waterfall vulnerability - main.py with check_secret() that leaks progress - fuzz_target.py with Atheris TestOneInput() harness - Complete README with usage instructions ## Backend Fixes - Fixed parameter merging in REST API endpoints (workflows.py) - Changed workflow parameter passing from positional args to kwargs (manager.py) - Default parameters now properly merged with user parameters ## Testing ✅ Worker discovered AtherisFuzzingWorkflow ✅ Workflow executed end-to-end successfully ✅ Fuzz target auto-discovered in nested directories ✅ Atheris ran 100,000 iterations ✅ Results uploaded and cache cleaned
48 lines
1.1 KiB
Docker
48 lines
1.1 KiB
Docker
# FuzzForge Vertical Worker: Python Fuzzing
|
|
#
|
|
# Pre-installed tools for Python fuzzing and security analysis:
|
|
# - Python 3.11
|
|
# - Atheris (Python fuzzing)
|
|
# - Common Python security tools
|
|
# - Temporal worker
|
|
|
|
FROM python:3.11-slim
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update && apt-get install -y \
|
|
# Build essentials for Atheris
|
|
build-essential \
|
|
clang \
|
|
llvm \
|
|
# Development tools
|
|
git \
|
|
curl \
|
|
wget \
|
|
# Cleanup
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Python dependencies for Temporal worker
|
|
COPY requirements.txt /tmp/requirements.txt
|
|
RUN pip3 install --no-cache-dir -r /tmp/requirements.txt && \
|
|
rm /tmp/requirements.txt
|
|
|
|
# Create cache directory for downloaded targets
|
|
RUN mkdir -p /cache && chmod 755 /cache
|
|
|
|
# Copy worker entrypoint
|
|
COPY worker.py /app/worker.py
|
|
|
|
# Add toolbox to Python path (mounted at runtime)
|
|
ENV PYTHONPATH="/app:/app/toolbox:${PYTHONPATH}"
|
|
ENV PYTHONUNBUFFERED=1
|
|
|
|
# Healthcheck
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
|
|
CMD python3 -c "import sys; sys.exit(0)"
|
|
|
|
# Run worker
|
|
CMD ["python3", "/app/worker.py"]
|