dicom-fuzzer 1.7.2

A professional-grade DICOM fuzzing tool for healthcare security testing

DICOM Fuzzer

Security testing framework for DICOM medical imaging systems. Identifies vulnerabilities in PACS servers, medical imaging viewers, and DICOM parsers through automated fuzzing.

Installation

git clone https://github.com/Dashtid/DICOM-Fuzzer.git
cd DICOM-Fuzzer
uv sync
source .venv/bin/activate  # or .venv\Scripts\activate on Windows

Quick Start

# Basic fuzzing
dicom-fuzzer input.dcm -c 100 -o ./artifacts/output

# With target application testing
dicom-fuzzer input.dcm -c 1000 -t ./viewer.exe --timeout 10

# Generate HTML report
dicom-fuzzer report ./artifacts/output --format html

Features

Fuzzing

• Mutation-based and grammar-aware DICOM fuzzing
• CVE-based security mutations enabled by default (12+ real CVEs)
• Coverage-guided fuzzing with corpus management
• 3D series fuzzing (CT/MRI volumetric data)
• Network protocol fuzzing (DIMSE, TLS)

Analysis

• Automatic crash detection and deduplication
• Crash triaging with severity/exploitability scoring
• Test case minimization (delta debugging)
• Stability tracking for non-deterministic behavior

Integration

• CLI with 10+ subcommands
• Python API for custom workflows
• Docker targets (DCMTK, Orthanc)
• CI/CD pipeline ready

CLI Reference

dicom-fuzzer --help              # Main help
dicom-fuzzer fuzz --help         # Fuzzing options
dicom-fuzzer report --help       # Report generation
dicom-fuzzer corpus --help       # Corpus management
dicom-fuzzer tls --help          # TLS/auth testing
dicom-fuzzer differential --help # Cross-parser testing

See docs/CLI_REFERENCE.md for full command documentation.

Python API

from dicom_fuzzer.core.mutator import DicomMutator
from dicom_fuzzer.core.fuzzing_session import FuzzingSession
import pydicom

session = FuzzingSession(output_dir="./artifacts/output")
mutator = DicomMutator()
dataset = pydicom.dcmread("input.dcm")

for i in range(100):
    fuzzed = mutator.mutate(dataset)
    fuzzed.save_as(f"artifacts/output/fuzz_{i:04d}.dcm")

session.save_report()

Project Structure

dicom-fuzzer/
├── dicom_fuzzer/    # Main package
├── tests/           # Test suite (2000+ tests)
├── tools/           # Scripts, examples, generators
├── configs/         # Docker, targets, seeds
├── docs/            # Documentation
└── artifacts/       # Runtime output (gitignored)

Documentation

• Quick Start Guide
• CLI Reference
• Architecture
• FDA Compliance
• Contributing
• Changelog

Security

This tool is for authorized security testing only. See SECURITY.md.

License

MIT - see LICENSE