# CraftFuzz: Generating Precise Requests for PHP Web Vulnerability Validation
###### Abstract
(2017) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Efficient and flexible discovery of php application vulnerabilities. In Proceedings of the 2017 IEEE European Symposium on Security and Privacy (EuroS&P), Paris, France, 26-28 April 2017; pp. 334-349. * [PERSON] et al. (2006) [PERSON]; [PERSON]; [PERSON] [PERSON] Pixy: A static analysis tool for detecting Web application vulnerabilities. In Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), Berkeley/Oakland, CA, USA, 21-24 May 2006; pp. 6-263. ISSN 2375-1207. [CrossRef]
* [PERSON] and [PERSON] (2014) [PERSON]; [PERSON] Simulation of Built-in PHP Features for Precise Static Code Analysis. In Proceedings of the NDSS, Citeseer, San Diego, CA, USA, 3-26 February 2014; Volume 14, pp. 23-26. * [PERSON] et al. (2023) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Splendor: Static detection of stored xss in modern web applications. In Proceedings of the 32 nd ACM SIGSOFT International Symposium on Software Testing and Analysis, Seattle, WA, USA, 17-21 July 2023; pp. 1043-1054. * [PERSON] et al. (2023) [PERSON]; [PERSON]; [PERSON] [PERSON] WHIP: Improving Static Vulnerability Detection in Web Application by Forcing tools to Collaborate. In Proceedings of the 32 nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA, 9-11 August 2023; pp. 6079-6096. * [PERSON] et al. (2022) [PERSON]; [PERSON]; [PERSON]: Precise static inter-procedural analysis for detecting taint-style vulnerabilities in php applications. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Los Angeles, CA, USA, 7-11 November 2022; pp. 2175-2188. * [PERSON] et al. (2019) [PERSON]; [PERSON]; [PERSON]; [PERSON]: Automatically detecting php-based unrestricted file upload vulnerabilities. In Proceedings of the 2019 49 th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Portland, OR, USA, 24-27 June 2019; pp. 581-592. * PortSwigger (2025) PortSwigger. Burp Suite. Application Security Testing. Available online: [[https://portswigger.net/burp](https://portswigger.net/burp)]([https://portswigger.net/burp](https://portswigger.net/burp)) (accessed on 17 February 2025). * Acunetix (2025) Acunetix. Acunetix Web Vulnerability Scanner. Available online: [[https://www.acunetix.com/](https://www.acunetix.com/)]([https://www.acunetix.com/](https://www.acunetix.com/)) (accessed on 17 February 2025). * HCL (2025) HCL. HCL AppScan. Available online: [[https://www.hcl-software.com/appscan](https://www.hcl-software.com/appscan)]([https://www.hcl-software.com/appscan](https://www.hcl-software.com/appscan)) (accessed on 17 February 2025). * OWASP (2025) OWASP. OWASP Zap. Available online: [[https://www.zaproxy.org/](https://www.zaproxy.org/)]([https://www.zaproxy.org/](https://www.zaproxy.org/)) (accessed on 17 February 2025). * [PERSON] (2022) [PERSON] A survey of modern crawler methods. In Proceedings of the 6 th International Conference on Control Engineering and Artificial Intelligence, Virtual Event, Japan, 11-13 March 2022; pp. 21-28. * [PERSON] and [PERSON] (2024) [PERSON]; [PERSON] [PERSON] SoK: State of the Krawlers-Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements. In Proceedings of the 33 rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA, 14-16 August 2024; pp. 719-737. * [PERSON] (2022) [PERSON]; [PERSON] [PERSON] HAXSS: Hierarchical reinforcement learning for XSS payload generation. In Proceedings of the 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Wuhan, China, 9-11 December 2022; pp. 147-158. * _[PERSON] et al. (2021)_ [PERSON]; [PERSON]; [PERSON] A Word Embedding Based Approach for Focused Web Crawling Using the Recurrent Neural Network. _Int. J. Interact. Multimed. Artif. Intell._**2021**, \(6\), 122-132. [CrossRef]
* _[PERSON] et al. (2025)_ [PERSON]; [PERSON]; [PERSON] Fuzzing frameworks for server-side web applications: A survey. _Int. J. Inf.