# CraftFuzz: Generating Precise Requests for PHP Web Vulnerability Validation
###### Abstract
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Application**} & \multicolumn{3}{c}{**SQLi**} & \multicolumn{3}{c}{**CE**} & \multicolumn{3}{c}{**XSS**} & \multicolumn{3}{c}{**UFU**} & \multicolumn{1}{c}{**FI**} \\ \cline{2-13}
**\#ID** & **Nama** & **Vulnerability** & **CrF** & **PRE** & **Wit** & **Atr** & **PHU** & **CrF** & **PRE** & **Wit** & **Atr** & **CoF** & **PHU** & **CrF** & **PRE** & **Web** & **PHU** & **CrF** \\ \hline



& 0 & - & 0 & 0 & - & 0 & 0 & 1 & - & 0 & 0 & 0 & 0 \\ \hline Total & & 78+14+73+12+12 & **70** & 45 & 28 & 21 & 53 & **14** & 3 & 2 & 6 & 8 & 7 & **63** & 16 & 21 & 47 & **9** & **12** \\ \hline \hline \end{tabular}

* The hyphen (-) indicates that this tool could not test a specific target application due to its not being open-source or inability to build; the **Vulnerability** column represents the number of known vulnerabilities of each type in the application.

\end{table} 
Table 5: The evaluation results for real-world applications. due to an inability to handle hidden random CSRF tokens. However, the low, medium, and high security levels of DVWA do not carry such tokens. We suspect the failure to test properly was due to incorrect cookie parameter settings, causing DVWA to remain in an \"impossible\" state. **Comparison with Witcher [13]**: CraftFuzz's performance improvement largely came from its superior entry URL recognition capability. We observed that Witcher struggled to collect valid entry URLs for certain applications, preventing effective testing during the fuzzing phase. Even when extending Witcher's crawling time beyond the allotted period, it was still unable to observe valid entry URLs being successfully crawled. This limitation was more pronounced when Witcher crawled applications with dynamic routing, where it failed to collect any usable URLs, resulting in no meaningful results for such applications. **Comparison with Atropos [15]**: Since we could not successfully reproduce Atropos's work, its test results were limited to three applications, making comprehensive performance comparisons infeasible. We speculate that Atropos's parameter inference mechanism would perform well, yielding results consistent with CraftFuzz. Atropos uses a snapshot-based approach to maintain a consistent program state during testing, but this significantly reduces its ease of use. **Comparison with Cefuzz [24]**: Cefuzz, our previous work, mainly focuses on solving data constraints but has weaker capabilities for handling path constraints. Moreover, Cefuzz only supports applications with static routing. Compared to CraftFuzz, it cannot detect command/code execution vulnerabilities in applications with dynamic routing. **Comparison with WebFuzz [16] and PHUZZ [17]**: WebFuzz and PHUZZ rely on manual interaction to collect URLs and form information for target applications. In contrast, CraftFuzz demonstrated more efficient and precise entry URL recognition. For applications with dynamic routing, many entry URLs cannot be obtained through frontend interaction. Instead, they require static analysis combined with routing rules to generate the necessary parameters for correct access. This limitation hampers manual interaction and crawling methods in obtaining entry URLs for dynamic routing applications. PHUZZ's innovative design for instrumenting dangerous functions enables it to detect parameters passed to these functions, enhancing its vulnerability-verification capabilities. This feature made PHUZZ's performance second only to CraftFuzz. ## 6 Discussion

This section describes the current limitations of CraftFuzz and our plans to resolve them as part of our future work. **File Inclusion Chain Identification**: As discussed in the evaluation section, incomplete file inclusion chain identification during static analysis may lead to URL generation failures. The primary reason for this lies in the fact that large-scale applications often undergo a unified initialization phase that executes numerous file inclusion operations.