# CraftFuzz: Generating Precise Requests for PHP Web Vulnerability Validation
###### Abstract
The 10 unsolved path constraints were primarily due to the use of unmodeled built-in functions in the paths, causing CraftFuzz to fail during the constraint extraction phase and preventing the completion of solving. These issues provide directions for further improving the path-constraint-solving ability of CraftFuzz. ### RQ3: Verification of Known Vulnerabilities

In this subsection, we evaluated CraftFuzz and baseline tools on their ability to verify known vulnerabilities using Dataset 3. For tools requiring manual entry URLs, we clicked on as many accessible entry points as possible to simulate real-world vulnerability testing scenarios. For tools using web crawlers, to obtain entry points, we provided a 4-h crawling window. The fuzzing duration followed the recommended settings in Witcher, with 20 min of fuzzing per URL. The experimental results are presented in Table 5. In the table, CrF, PRE, Wit, Att, PHU, CeF, and Web represent CraftFuzz, Predator, Witcher, Atropos, PHUZZ, Cefuzz, and WebFuzz, respectively. Since Predator is not open-source and as Atropos is challenging to build, we referenced the evaluation results reported in their respective papers. A hyphen (\"-\") indicates that Predator and Atropos did not test a specific target application. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Microtest** & **WebFuzz** & **PHUZZ** & **Witcher** & **CraftFuzz** \\ \hline post-2 & 0 & 0 & 4 & 5 \\ post-5 & 0 & 0 & 3 & 5 \\ post-10 & 0 & 0 & 2 & 5 \\ get-5 & 0 & 0 & 3 & 5 \\ cookie-5 & 0 & 0 & 2 & 5 \\ equal-1 & 0 & 0 & 1 & 5 \\ equal-3 & 0 & 0 & 0 & 5 \\ findvar-1 & 0 & 0 & 0 & 5 \\ loop-10 & 0 & 0 & 1 & 5 \\ select-3 & 0 & 0 & 3 & 5 \\ guess & 0 & 0 & 0 & 5 \\ branching-2 & 0 & 0 & 0 & 5 \\ branching-5 & 0 & 0 & 0 & 5 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Path-constraint-solving performance on microtests. Overall, the target applications contained 189 known vulnerabilities, of which Craft-Fuzz successfully verified 168, including 70 SQL Injection (SQLi) vulnerabilities, 14 Command/Code Execution (CE) vulnerabilities, 63 Cross-Site Scripting (XSS) vulnerabilities, 9 Unrestricted File Upload (UFU) vulnerabilities, and 12 File Inclusion (FI) vulnerabilities. This indicates that out of the 190 paths solved in RQ2, the data constraints for 168 paths were successfully solved. The unverified vulnerabilities were primarily due to two reasons. First, false positives in the static analysis report, such as insufficient modeling of sink functions or inaccurate identification of dangerous parameters, led to CraftFuzz generating requests that reached the sink point but failed to verify the existence of the vulnerability. Second, some data constraints had conditions too stringent to be addressed by the payload list, and effective payloads could not be generated through mutation, resulting in failed vulnerability exploitation. From the perspective of vulnerability types, the complexity of data constraints affected the verification rates differently. CraftFuzz successfully verified 100% of Command/Code Execution and File Inclusion vulnerabilities, 89.7% (70/78) of SQL injection vulnerabilities, 86.3% (63/73) of XSS vulnerabilities, and 75% (9/12) of File Upload vulnerabilities. The lower verification rate for XSS vulnerabilities was due to CraftFuzz's lack of dedicated modeling for stored XSS, reducing the detection rates. For SQL injection vulnerabilities, some sanitization functions increased the complexity of data constraint solving. Similarly, the challenges in verifying File Upload vulnerabilities were mainly due to constraints introduced by sanitization functions. **Comparison with Predator [18]**: The performance improvement of CraftFuzz primarily stemmed from its ability to recognize more opcodes related to path constraints and its more generalized constraint-handling capability. Additionally, CraftFuzz supports the construction of cookie parameters, which are necessary for triggering certain vulnerabilities. For example, Predator failed to test DVWA effectively. According to its paper, this was