patchi 0.7.5__py3-none-any.whl

patchi/core/agents/api_fuzzer_agent.py

@@ -0,0 +1,141 @@
+"""
+ApiFuzzerAgent §5.3.1 — EvoMaster-style REST/GraphQL fuzz generation.
+
+From RouteMapper 18fw routes → generates malformed JSON, massive payloads,
+wrong Content-Types, injection strings via InputFuzzer. Optionally shells out
+to EvoMaster (WebFuzzing/EvoMaster) if `evomaster.jar` or docker is available,
+else falls back to local InputFuzzer + in-process HTTP smoke.
+
+Does NOT require a running server for generation; fuzz payloads are persisted
+to .patchi/fuzz/<route>.json for DAST replay via --with-fuzz.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+import subprocess
+from pathlib import Path
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+from patchi.core.brain.route_mapper import RouteInfo
+from patchi.core.fuzz.input_fuzzer import InputFuzzer
+
+_log = logging.getLogger("patchi.agents.api_fuzzer")
+
+_EVO_DOCKER = "evomaster/evomaster:latest"
+
+
+def _try_evomaster(routes: list[RouteInfo], out_dir: Path) -> int:
+    """Try EvoMaster jar/docker — returns count or 0 if not available."""
+    jar = shutil.which("evomaster.jar") or shutil.which("java")
+    docker = shutil.which("docker")
+    if not jar and not docker:
+        return 0
+    # Probe only if OpenAPI spec exists
+    if not (out_dir.parent / "openapi.json").exists() and not (out_dir.parent / "swagger.json").exists():
+        return 0
+    try:
+        # Use docker EvoMaster in blackbox mode against openapi.json if present
+        spec = out_dir.parent / "openapi.json"
+        if not spec.exists():
+            spec = out_dir.parent / "swagger.json"
+        cmd = ["docker", "run", "--rm", "-v", f"{spec}:/tmp/spec.json", _EVO_DOCKER, "--blackBox", "true", "--bbSwaggerUrl", "file:///tmp/spec.json", "--outputFolder", "/tmp/out", "--maxTime", "30s"] if docker else None
+        if not cmd:
+            return 0
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
+        return 1 if proc.returncode in (0, 1) else 0
+    except Exception as exc:  # noqa: BLE001
+        _log.debug("evomaster probe failed: %s", exc)
+        return 0
+
+
+@register
+class ApiFuzzerAgent(BaseAgent):
+    group = AgentGroup.SECURITY
+    name = "ApiFuzzerAgent"
+    description = "EvoMaster-style API fuzz payloads from RouteMapper routes (REST/GraphQL) → .patchi/fuzz/"
+    timeout = 90
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Routes from brain (RouteMapper) or live scan
+        routes: list[RouteInfo] = []
+        try:
+            from patchi.core.brain.file_corpus import FileCorpus
+            from patchi.core.brain.framework import FrameworkDetector
+            from patchi.core.brain.route_mapper import RouteMapper
+
+            corpus = FileCorpus(inp.root)
+            stack = FrameworkDetector(inp.root, corpus=corpus).detect()
+            mapper = RouteMapper(inp.root, stack)
+            # Use inp.brain routes if present to avoid re-parse
+            if inp.brain.get("routes"):
+                routes = [RouteInfo(**r) if isinstance(r, dict) else r for r in inp.brain.get("routes", [])]
+            else:
+                from patchi.core.brain.scanner import FileScanner
+                routes = mapper.extract(FileScanner(inp.root).scan())
+        except Exception as exc:  # noqa: BLE001
+            _log.debug("route extract failed: %s", exc)
+            routes = []
+
+        if not routes:
+            result.status = AgentStatus.SUCCEEDED
+            result.data["fuzz_count"] = 0
+            return
+
+        fuzzer = InputFuzzer(seed=0xF22A)
+        out_dir = inp.root / ".patchi" / "fuzz"
+        out_dir.mkdir(parents=True, exist_ok=True)
+
+        # Try EvoMaster first
+        evo = _try_evomaster(routes, out_dir)
+
+        fuzz_count = 0
+        for r in routes[:50]:  # cap 50 routes
+            # Skip health/static
+            if r.path in ("/health", "/healthz", "/metrics") or r.path.startswith("/static/"):
+                continue
+            payloads = []
+            # 1. Boundary JSON
+            payloads.extend([f.to_dict() for f in fuzzer.fuzz_dict({"id": 1, "name": "test"}, count=5)])
+            # 2. Injection strings as query/body values
+            for fi in fuzzer.fuzz_string(r.path, count=6):
+                payloads.append({"strategy": fi.strategy, "value": fi.value, "label": fi.label})
+            # 3. Method fuzz: wrong method
+            payloads.append({"strategy": "method", "value": "WRONG_METHOD", "label": "method_fuzz"})
+            # Persist
+            fname = f"{r.method.lower()}_{r.path.strip('/').replace('/','_') or 'root'}.json"
+            fname = "".join(c if c.isalnum() or c in "._-" else "_" for c in fname)[:120]
+            try:
+                (out_dir / fname).write_text(json.dumps({"route": r.to_dict(), "payloads": payloads[:12]}, indent=2), encoding="utf-8")
+                fuzz_count += 1
+            except OSError as exc:
+                _log.warning("ApiFuzzer write failed: %s", exc)
+
+            # Finding per route with high-risk payload count
+            result.findings.append(
+                make_finding(
+                    severity=Severity.INFO,
+                    file=r.file,
+                    line_start=r.line,
+                    title=f"Fuzz payloads for {r.method} {r.path}",
+                    description=f"Generated {len(payloads[:12])} EvoMaster/InputFuzzer payloads (boundary/injection/encoding) for DAST replay --with-fuzz. EvoMaster: {'yes' if evo else 'local'}",
+                    evidence=r.path,
+                    finding_type="fuzz_payload",
+                )
+            )
+
+        result.status = AgentStatus.SUCCEEDED
+        result.data["fuzz_count"] = fuzz_count
+        result.data["evomaster"] = bool(evo)
+        result.files_scanned = len(routes)

patchi/core/agents/attack_agent.py

@@ -0,0 +1,242 @@
+"""
+AttackAgent — Metasploit auxiliary/scanner probe integration.
+
+Uses pymetasploit3 bridge to msfrpcd to run auxiliary/scanner modules
+against the local project. Never targets external hosts — localhost only.
+
+Flow:
+  1. Read project brain data (framework, ports, routes)
+  2. Pick relevant auxiliary/scanner modules based on framework
+  3. Connect to msfrpcd on localhost:55553
+  4. Run each module against 127.0.0.1
+  5. Return findings as structured JSON
+
+Optional dependency: pymetasploit3 (pip install patchi[msf])
+"""
+
+from __future__ import annotations
+
+import json
+from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import TimeoutError as FutureTimeout
+
+from .base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+)
+
+# ── Framework → auxiliary/scanner module mapping ──────────────────────────────
+
+# Shared module groups to avoid duplication
+_HTTP_COMMON = [
+    "scanner/http/http_header_xss",
+    "scanner/http/http_version",
+    "scanner/http/options",
+]
+
+_FRAMEWORK_MODULES: dict[str, list[str]] = {
+    "flask": [*_HTTP_COMMON, "scanner/http/http_methods"],
+    "django": [*_HTTP_COMMON, "scanner/http/http_methods"],
+    "fastapi": _HTTP_COMMON,
+    "express": _HTTP_COMMON,
+    "react": [
+        "scanner/http/http_header_xss",
+        "scanner/http/http_version",
+    ],
+    "spring": [*_HTTP_COMMON, "scanner/http/http_methods"],
+}
+
+_FALLBACK_MODULES = _HTTP_COMMON
+
+_DEFAULT_PORT = 8000
+
+
+@register
+class AttackAgent(BaseAgent):
+    """Metasploit auxiliary/scanner probe integration (localhost only)."""
+
+    group = AgentGroup.TEST
+    name = "AttackAgent"
+    timeout = 120  # Metasploit modules can take a while
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # ── 1. Check if pymetasploit3 is available ────────────────────────────
+        try:
+            import pymetasploit3  # noqa: F401
+        except ImportError:
+            # Optional dependency — skip cleanly, never FAIL the agent run.
+            self.skip(result, "pymetasploit3 not installed. Run: pip install patchi[msf]")
+            return
+
+        # ── 2. Read brain data for framework / port hints ─────────────────────
+        brain = inp.brain
+        frameworks = _get_frameworks(brain)
+        routes = brain.get("routes", [])
+
+        # Determine target port from config, routes, or default
+        target_port = _pick_port(brain, routes)
+        target_ip = "127.0.0.1"
+        result.data["target"] = f"{target_ip}:{target_port}"
+        result.data["frameworks"] = frameworks
+
+        # ── 3. Pick modules ──────────────────────────────────────────────────
+        modules = _pick_modules(frameworks)
+
+        result.data["modules_selected"] = modules
+
+        # ── 4. Connect to msfrpcd and run modules ────────────────────────────
+        from pymetasploit3.msfrpc import MsfRpcClient
+
+        password = inp.extra.get("msf_password", "")
+        msf_port = inp.extra.get("msf_port", 55553)
+        msf_ssl = inp.extra.get("msf_ssl", True)
+        msf_module_timeout = inp.extra.get("msf_module_timeout", 30)
+
+        try:
+            client = MsfRpcClient(password, port=msf_port, ssl=msf_ssl)
+        except Exception as exc:
+            result.add_error(
+                f"Cannot connect to msfrpcd at 127.0.0.1:{msf_port} — {exc}. "
+                f"Make sure msfrpcd is running (msfrpcd -P your_password -S -a 127.0.0.1 -p {msf_port})"
+            )
+            return
+
+        with ThreadPoolExecutor(max_workers=1) as pool:
+            for module_name in modules:
+                future = pool.submit(
+                    self._run_module, client, module_name, target_ip, target_port, modules, result
+                )
+                try:
+                    finding = future.result(timeout=msf_module_timeout)
+                    if finding:
+                        result.findings.append(finding)
+                except FutureTimeout:
+                    result.errors.append(f"{module_name}: timed out after {msf_module_timeout}s")
+                except Exception as exc:
+                    result.errors.append(f"{module_name}: {exc}")
+
+    def _run_module(
+        self,
+        client,
+        module_name: str,
+        target_ip: str,
+        target_port: int,
+        modules: list[str],
+        result: AgentResult,
+    ) -> Finding | None:
+        """Run a single auxiliary/scanner module and return a Finding."""
+        try:
+            aux = client.modules.use("auxiliary", module_name)
+            aux["RHOSTS"] = target_ip
+            aux["RPORT"] = target_port
+            raw = aux.execute()
+        except Exception as exc:
+            result.errors.append(f"{module_name}: {exc}")
+            return None
+
+        if not raw:
+            return None
+
+        # Normalise result to dict
+        if isinstance(raw, str):
+            try:
+                parsed = json.loads(raw)
+            except (json.JSONDecodeError, ValueError):
+                parsed = {"raw_output": raw[:500]}
+        else:
+            parsed = raw if isinstance(raw, dict) else {"data": str(raw)}
+
+        # Determine severity based on module output
+        severity = _classify_severity(module_name, parsed)
+
+        # Store full result in data
+        result.data.setdefault("module_results", {})[module_name] = parsed
+
+        # Build a Finding for display
+        message = f"{module_name} — {severity.value}"
+        detail_lines = []
+        if isinstance(parsed, dict):
+            for k, v in list(parsed.items())[:5]:
+                detail_lines.append(f"{k}: {v}")
+        detail = "\n".join(detail_lines)
+
+        return Finding(
+            agent=self.name,
+            type="metasploit_aux",
+            severity=severity,
+            file="metasploit",
+            line=0,
+            message=message[:120],
+            detail=detail[:1000] or "No detail returned",
+            extra={
+                "module": module_name,
+                "target": f"{target_ip}:{target_port}",
+                "raw": parsed if isinstance(parsed, dict) else {"output": str(parsed)[:500]},
+            },
+        )
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+
+def _get_frameworks(brain: dict) -> list[str]:
+    """Extract framework names from brain data."""
+    frameworks = []
+    fw_raw = brain.get("framework", "")
+    if fw_raw and fw_raw != "Unknown":
+        frameworks.append(fw_raw.lower())
+
+    fws_raw = brain.get("frameworks", [])
+    for fw in fws_raw:
+        name = ""
+        if isinstance(fw, dict):
+            name = fw.get("name", "")
+        elif isinstance(fw, str):
+            name = fw
+        if name and name.lower() not in frameworks:
+            frameworks.append(name.lower())
+    return frameworks
+
+
+def _pick_port(brain: dict, routes: list) -> int:
+    """Pick the most likely target port from brain/routes data."""
+    config_fallback = brain.get("config", {}).get("port", None)
+    if config_fallback:
+        return int(config_fallback)
+    return _DEFAULT_PORT
+
+
+def _pick_modules(frameworks: list[str]) -> list[str]:
+    """Select relevant auxiliary/scanner modules based on detected frameworks."""
+    selected: list[str] = []
+    seen: set[str] = set()
+    for fw in frameworks:
+        for mod in _FRAMEWORK_MODULES.get(fw, []):
+            if mod not in seen:
+                selected.append(mod)
+                seen.add(mod)
+    if not selected:
+        selected = list(_FALLBACK_MODULES)
+    return selected
+
+
+def _classify_severity(module_name: str, result: dict) -> Severity:
+    """Heuristic to map module results to a severity level."""
+    job_id = result.get("job_id")
+    if job_id is not None:
+        return Severity.INFO
+
+    raw_out = str(result).lower()
+    vuln_keywords = ["vulnerable", "found", "detected", "xss", "cve", "open", "leaked"]
+    if any(kw in raw_out for kw in vuln_keywords):
+        return Severity.MEDIUM
+
+    if result.get("error"):
+        return Severity.LOW
+
+    return Severity.INFO