File size: 4,841 Bytes
256c9c2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 | # External Knowledge & Tool Integrations
Rhodawk now embeds three external knowledge / capability sources directly
into the runtime so the orchestrator and analysis engines can use them
offline, without round-tripping to the public web on every audit.
| Vendor | Lives at | Python module | What it gives Rhodawk |
|-------------------------------------------------------------|-----------------------------------|---------------------------|------------------------|
| [`jo-inc/camofox-browser`](https://github.com/jo-inc/camofox-browser) | `/opt/camofox` (npm) + node server | `camofox_client.py` | Anti-detection Firefox-fork browsing for live web tasks (cve_intel, repo_harvester, knowledge_rag, red_team_fuzzer, bounty_gateway) |
| [`0xmaximus/Galaxy-Bugbounty-Checklist`](https://github.com/0xmaximus/Galaxy-Bugbounty-Checklist) | `vendor/galaxy_bugbounty/` | `bugbounty_checklist.py` | 24-category bug bounty methodology + payload corpora keyed by CWE / vuln tag |
| [`zomasec/client-side-bugs-resources`](https://github.com/zomasec/client-side-bugs-resources) | `vendor/clientside_bugs/` | `clientside_resources.py` | Curated client-side (XSS / CSP / postMessage / prototype-pollution / CORS) reading list — section-indexed |
| [`PrathamLearnsToCode/paper2code`](https://github.com/PrathamLearnsToCode/paper2code) | `vendor/paper2code/` | `paper2code_engine.py` | arXiv-paper → citation-anchored, ambiguity-audited Python scaffold (uses the existing OpenClaude gRPC bridge for LLM calls) |
## Where they plug into the existing engines
### `bugbounty_checklist.py`
* **`vuln_classifier.py`** — after CWE classification, call
`bugbounty_checklist.match_for_tag(cwe)` to surface the canonical
Galaxy checklist for that class (24 categories covered: XSS, SSRF,
SQLi, OAuth, CSRF bypass, IDOR, file upload, request smuggling,
rate-limit bypass, password reset, IIS, Log4Shell, WordPress, …).
* **`red_team_fuzzer.py` / `harness_factory.py`** — call
`payloads_for("sql_injection")` to seed the SQLi corpus from
Galaxy's `SQL.txt`, or `payloads_for("xss")` to harvest inline
XSS payload snippets from the README.
* **`hermes_orchestrator.py`** — call
`hints_for_finding(cwe=..., label=..., description=...)` to inject
hand-curated tradecraft bullets into the triage prompt.
### `clientside_resources.py`
* **`knowledge_rag.py`** — `seed_urls()` returns a flat unique list of
the upstream README's links, perfect as initial input to the
embedding-store ingest loop.
* **`red_team_fuzzer.py`** — `for_tag("postmessage")` returns the
reference write-ups to attach to a generated client-side PoC.
* **`vuln_classifier.py`** — `search("dompurify")` etc. surfaces
reference research write-ups when classifying client-side findings.
### `paper2code_engine.py`
* **`hermes_orchestrator.py`** Night-Hunt mode — when a new primitive
surfaces in the wild, call `paper2code_engine.run(arxiv_url)` to
scaffold a reproduction under `/data/paper2code/{slug}/` with an
ambiguity audit. The orchestrator can then hand the scaffold to
the OpenClaude gRPC bridge for completion.
* **`training_store.py`** — register the scaffold's
`REPRODUCTION_NOTES.md` + `ambiguity_audit.json` as a training
example for the data flywheel.
* **`knowledge_rag.py`** — the ambiguity audit (per-dimension
SPECIFIED / PARTIALLY_SPECIFIED / UNSPECIFIED classification) is
embedded alongside the paper text so the RAG store learns *what is
uncertain*, not just *what was written*.
## Quick programmatic checks
```python
import bugbounty_checklist as bb
print(bb.stats()) # {'categories': 24, 'total_payloads': ...}
print(bb.list_categories())
print(bb.payloads_for('sqli', limit=5))
print(bb.hints_for_finding(cwe='CWE-918'))
import clientside_resources as cs
print(cs.stats()) # sections + resource count
print(cs.for_tag('prototype_pollution'))
import paper2code_engine as p2c
print(p2c.stats()) # vendor + LLM availability
result = p2c.run('https://arxiv.org/abs/1706.03762') # heuristic mode if no LLM
print(result.to_dict())
```
## Vendoring policy
* All three repos are mirrored under `vendor/` so the runtime is
self-contained and reproducible — no surprise upstream changes can
break a Rhodawk scan in the middle of an engagement.
* Re-vendoring is a manual operation (just `git clone` the upstream
and copy the relevant directories) — version pinning is implicit
through git history.
* Source licenses (MIT for camofox-browser and clientside-bugs,
MIT for paper2code, MIT for Galaxy-Bugbounty-Checklist) are
preserved alongside the vendored content.
|