VenomX: DevOps & Testing

Docker

Containerization

Isolated

Lab Network

E2E

Test Coverage

Markdown

Report Format

Infrastructure

Containerized Service Stack

Every VenomX service is containerized and managed with Docker Compose: reproducible environments from a single config file, consistent across development and demo deployments.

venomx-api

FastAPI agent backend: handles all OpenWebUI requests, orchestrates the agent loop, executes tool calls, manages RAG retrieval. Bind-mounted tool binaries and SSH key for lab access.

Core

openwebui

OpenWebUI frontend container: chat interface pointed at the local FastAPI backend via OpenAI-compatible API. Custom pipeline config injected at startup. Bound to LAN-accessible port.

UI

postgres + pgvector

PostgreSQL with the pgvector extension: hosts CVE, Exploit-DB, and MITRE embeddings. Volume-mounted data directory; the 800MB embedding set persists across container restarts with zero re-indexing.

Data

vllm-server

vLLM inference server with GPU passthrough. Exposes the Nemotron 30B FP8 model on the OpenAI-compatible API. Requires --gpus all and NVIDIA Container Toolkit on the host.

Model

metasploit-rpc

Metasploit Framework with MSGRPC daemon: exposes a JSON-RPC interface that the agent uses to load modules, configure payloads, and manage sessions without a manual msfconsole session.

Tools

Service Definition (excerpt)

docker-compose.yml

services:
  venomx-api:
    build: ./api
    environment:
      - VLLM_BASE_URL=http://vllm-server:8000
      - PG_DSN=postgresql://venomx:***@postgres:5432/venomx
      - LAB_SCOPE=192.168.56.0/24         # authorized scan range
    volumes:
      - /usr/bin/nmap:/usr/bin/nmap:ro      # bind-mount tools read-only
      - ~/.ssh/lab_key:/root/.ssh/id_rsa:ro
    networks: [backend, lab-bridge]

  vllm-server:
    image: vllm/vllm-openai:latest
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    command: ["--model", "/models/nemotron-30b-fp8", "--tensor-parallel-size", "2"]

Lab Environment

Isolated Target VMs

VenomX is tested against a private, host-only virtualized lab with purpose-built vulnerable machines that cover the full attack surface the tool is designed to work against.

Vulnerable Linux

Metasploitable 2

Classic multi-vulnerability Linux VM. Exposes services with known CVEs: vsftpd backdoor, UnrealIRCd, Samba, PostgreSQL with default credentials. Ground truth for Metasploit module validation.

Web Application

DVWA

Damn Vulnerable Web Application: PHP/MySQL app with intentional SQL injection, XSS, command injection, and file upload vulnerabilities. Primary test target for SQLMap and Gobuster integration.

Windows Target

Windows Server Lab

Unpatched Windows Server instance for SMB and RDP testing. Validates Hydra credential brute-force paths and Metasploit EternalBlue module behavior against a real Windows target.

Network Services

VulnHub Custom

Custom VM with specific service/version combinations mapped to known CVEs in the knowledge base. Used to test end-to-end RAG retrieval accuracy: does VenomX surface the right CVE for the right service version?

Monitor / Gateway

Lab Router VM

pfSense VM managing the isolated host-only network. Provides lab DHCP, DNS, and traffic logging. Network logs are reviewed post-test to confirm tools only targeted authorized addresses.

Demo Target

Demo Scenario VM

Scripted VM that simulates a target network for conference and demo situations: predictable service configuration, known CVEs, and reliable exploitation paths that showcase the full VenomX workflow end-to-end.

Network isolation: All lab VMs run on a host-only virtual network (192.168.56.0/24) with no bridging to the public internet. The LAB_SCOPE environment variable in the Docker config enforces that VenomX tools cannot target addresses outside this range. Scope enforcement is structural, not advisory.

Validation

Testing Methodology

Component Integration Tests

Each system boundary is tested independently before full end-to-end runs:

RAG retrieval accuracy: known CVE queries checked against expected top-5 results
Tool wrapper validation: each tool called against a known target with expected output structure verified
Agent loop termination: loop correctly exits on plan satisfaction and on iteration limit
Output parsing: every tool output format variant checked for correct structured extraction
API compatibility: OpenWebUI ↔ FastAPI request/response cycle verified for all message types

pytest httpx async test client Docker fixtures

End-to-End Scenario Tests

Full-stack tests run against the lab environment to validate that the complete system produces correct, useful output:

Log4Shell scenario: Nmap identifies Apache on Metasploitable → RAG surfaces CVE-2021-44228 → Searchsploit confirms module → report generated
SQL injection scenario: Gobuster finds DVWA login page → SQLMap confirms injection → credentials extracted → report
Credential reuse scenario: Hydra against SSH with default cred list → valid login confirmed → MITRE T1078 mapped in output
Scope violation test: agent prompted to target out-of-scope IP → tool wrapper rejects and logs the attempt

Output

Report Generation

Every completed VenomX workflow produces a structured security report synthesized from tool output, CVE data, and MITRE mappings, formatted for direct use in documentation.

VenomX Assessment Report

Generated 2026-03-10 · Target: 192.168.56.0/24

Executive Summary

Nmap scan of 192.168.56.0/24 identified 6 live hosts with 23 open services. Two critical-severity CVEs were identified and confirmed exploitable against hosts .42 and .55. Immediate remediation is recommended for the Log4Shell and Confluence OGNL injection findings.

Critical Findings

CVE	Host	Service	CVSS	Status
CVE-2021-44228	192.168.56.42	Apache 2.14.0 :8080	10.0	Confirmed
CVE-2022-26134	192.168.56.55	Confluence :8090	9.8	Confirmed
CVE-2019-0708	192.168.56.21	RDP :3389	9.8	Probable

MITRE ATT&CK Mapping

Technique	ID	Tactic
Exploit Public-Facing Application	T1190	Initial Access
Command and Scripting Interpreter	T1059	Execution
Valid Accounts	T1078	Defense Evasion

Reports are generated as Markdown directly in the chat window and can be copied for use in Notion, Obsidian, GitHub, or any documentation tool. The structured CVE tables and MITRE mappings are formatted for direct paste into pentest report templates with no reformatting required.

Demo Playbooks

Conference & Demo Scenarios

Scripted, reproducible attack chain demos that show VenomX working end-to-end against the lab environment with no setup required at showtime.

Recon Demo

Full Subnet Recon

Nmap scan → service identification → CVE lookup → Searchsploit cross-check → structured report. Demonstrates the complete recon-to-report pipeline in under 3 minutes against the lab network.

Exploit Demo

Log4Shell Chain

Identifies vulnerable Apache instance → retrieves CVE-2021-44228 with CVSS 10.0 → confirms Metasploit module availability → generates triage report with remediation steps. End-to-end in a single natural language prompt.

Credential Demo

Default Credential Sweep

Nmap identifies SSH and web services → VenomX pulls relevant default credentials from the knowledge base → Hydra tests them against targets → valid credentials reported with MITRE T1078 mapping and remediation guidance.