# CraftFuzz: Generating Precise Requests for PHP Web Vulnerability Validation
###### Abstract
Additionally, we included web applications that use dynamic routing to assess CraftFuzz's effectiveness in detecting vulnerabilities in such applications. Table 2 presents the specific applications selected: applications marked as C indicate they have been used in multiple baseline studies, while those marked as D represent applications that use dynamic routing. All experiments were conducted on a machine with an Intel Core i7-10875h processor, four 2.30 GHz logical cores, and 16 GB of RAM, running 64-bit Windows 10 22H2 or Linux Ubuntu 18.04 or 22.04. PHP versions were 8.2.9, 8.0.25, or 7.2.25, and JDK versions were 1.8_221 or 11.0.22. Apache 2.4 was chosen as the HTTP server. Due to the varying development times of the baselines, we configured both older and newer environments, to ensure compatibility. ### RQ1: Evaluation of Entry URL Generation Effectiveness

In this subsection, we evaluate the effectiveness of CraftFuzz in generating entry URLs using Dataset 2, with the experimental results presented in Table 3. Report indicates the number of vulnerabilities detected in the static analysis report. Since CraftFuzz currently supports the verification of only five types of vulnerabilities--SQL Injection (SQLi), Command/Code Execution (CE), Cross-Site Scripting (XSS), Unrestricted File Upload (UFU) [35], and File Inclusion (FI) [36]--the reported vulnerability count includes only these five types. SR(Static Reports) Count represents the number of entry URLs successfully generated by CraftFuzz, while Avg SR Time records the average time taken to generate each entry URL. It is worth noting that the routing strategy determination algorithm, which distinguishes between static and dynamic routing for applications, is not included in the entry URL generation time. On average, this algorithm took 5.012 s per application. In our experiments, we used two threshold parameters: MIN_TEST_FILES was set to 10, and ERROR_THRESHOLD was set to 50%. These thresholds were found to provide reasonably accurate results in practice. The experimental results demonstrate that CraftFuzz incurred minimal overhead in generating entry URLs. Out of 206 static analysis reports, CraftFuzz successfully generated 200 entry URLs, achieving a success rate of 97.1%. For SuiteCRM, however, entry URLs for six static reports could not be generated correctly. The reason was that the static analysis failed to accurately resolve the file inclusion chains, preventing the identification of entry files and thus the generation of correct entry URLs. \begin{table}
\begin{tabular}{c c c c|c c c|c c c c} \hline \# & **Type** & **Application** & **Version** & **\#** & **Type** & **Application** & **Version** & **\#** & **Type** & **Application** & **Version** \\ \hline
1 & C & bWAPP & latest & 11 & C & phpBB & 3.3.3 & 21 & D & cakephp & 4.4.9 \\
2 & C & DVWA & 1.9 & 12 & C & WebChess & 0.9 & 22 & D & thinkphp & 6.0.13 \\
3 & C & XVWA & latest & 13 & C & Shopping Sys. & #5f3b & 23 & D & thinkphp & 5.0.9 \\
4 & C & WackOPicko & latest & 14 & D & SuiteCRM & 7.12.6 & 24 & D & thinkphp & 3.2.3 \\
5 & C & WeBid & 1.2.1 & 15 & D & leantime & 2.1.5 & 25 & D & Worker Think. & latest \\
6 & C & WordPress & 6.0 & 16 & D & dzdroffice & 2.02.1 & 26 & D & Ecom. Codelginter & \#1998 \\
7 & C & Doctor App. Sys. & 1.0 & 17 & D & microweber & 1.2.3 & 27 & D & Ecom. Codelginter & \#422b \\
8 & C & Hospital Mgmt & 4.0 & 18 & D & microwave & 2.0.16 & 28 & D & Ecom. Codelginter & \#4590 \\
9 & C & Login Mgmt & 2.1 & 19 & D & shopware & 6.4.4.0 & 29 & D & Mana. Laravel & latest \\
10 & C & OpenEMR & 5.0.17 & 20 & D & umbmark & 1.9.2 & & & & \\ \hline \end{tabular}
\end{table} 
Table 2: Overview of Dataset 2. ### RQ2: Evaluation of Path Constraint Solving Capability

In this subsection, we evaluate CraftFuzz's path-constraint-solving capabilities using both Dataset 1 and Dataset 2.