# CraftFuzz: Generating Precise Requests for PHP Web Vulnerability Validation
###### Abstract
First, we tested Dataset 1 with five runs of experiments using WebFuzz, PHUZZ, Witcher, and CraftFuzz, with each run lasting 4 h. The results are shown in Table 4.

Since the microtest code does not contain any frontend form information, WebFuzz and PHUZZ, which rely on crawling to find request data, failed to yield any results. While Witcher also depends on crawling, we found preset request data in its code repository and used this for testing. However, the test results showed slight discrepancies compared to those reported in the Witcher paper. We suspect this might have been due to differences between the request data used in our experiments and the final version in the paper, or the activation of randomization options during testing. CraftFuzz performed exceptionally well in the microtest evaluations, consistently solving constraints within 20 s. It also excelled in handling the newly added test cases, branching2 and branching5. This success is attributed to its data flow analysis [9], which enables interprocedural constraint extraction and effectively addresses the challenge of interprocedural constraint solving. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**\# ID** & **Type** & **Application** & **Report \({}^{*}\)** & **SR Count** & **Avg SR Time** & **PC Count** & **Avg PC Time** \\ \hline
1 & C & bWAPP & 32 & 32 & 1.23 & 32 & 3.01 \\
2 & C & DVWA & 21 & 21 & 1.31 & 21 & 3.66 \\
3 & C & XVWA & 8 & 8 & 1.81 & 8 & 3.68 \\
4 & C & WackoPicko & 9 & 9 & 1.74 & 9 & 3.79 \\
5 & C & WeBid & 4 & 4 & 1.61 & 4 & 3.34 \\
6 & C & WordPress & 0 & 0 & 0 & 0 & 0 \\
7 & C & Doc. App. Sys. & 11 & 11 & 1.06 & 11 & 3.65 \\
8 & C & Hospital Mgmt & 13 & 13 & 1.61 & 13 & 3.91 \\
9 & C & Login Mgmt & 1 & 1 & 0.81 & 1 & 3.87 \\
10 & C & OpenEMR & 9 & 9 & 1.93 & 7 & 6.4 \\
11 & C & phpBB & 0 & 0 & 0 & 0 & 0 \\
12 & C & WebChess & 3 & 3 & 0.98 & 3 & 3.31 \\
13 & C & Shopping Sys. & 28 & 28 & 1.34 & 28 & 3.8 \\
14 & D & SuiteCRM & 14 & 8 & 1.87 & 5 & 6.71 \\
15 & D & leantime & 3 & 3 & 2.18 & 3 & 7.43 \\
16 & D & dzzoffice & 3 & 3 & 1.68 & 2 & 3.72 \\
17 & D & microwave2 & 4 & 4 & 1.72 & 2 & 4.21 \\
18 & D & microwave1 & 16 & 16 & 1.57 & 16 & 3.45 \\
19 & D & shopware & 1 & 1 & 2.21 & 1 & 5.21 \\
20 & D & ummark & 2 & 2 & 1.56 & 1 & 3.6 \\
21 & D & cakephp & 3 & 3 & 1.21 & 2 & 3.37 \\
22 & D & thinkphp6 & 2 & 2 & 1.36 & 2 & 3.44 \\
23 & D & thinkphp5 & 2 & 2 & 1.23 & 2 & 3.81 \\
24 & D & thinkphp3 & 2 & 2 & 1.31 & 2 & 3.45 \\
25 & D & Worker Think. & 5 & 5 & 1.09 & 5 & 3.86 \\
26 & D & Ecom. Code.#19 & 1 & 1 & 1.17 & 1 & 3.19 \\
27 & D & Ecom. Code.#d2 & 4 & 4 & 1.19 & 4 & 3.05 \\
28 & D & Ecom. Code.#d5 & 1 & 1 & 1.17 & 1 & 3.28 \\
29 & D & Mana. Laravel & 4 & 4 & 2.62 & 4 & 7.21 \\ \hline Total & & & 206 & 200 & - & 190 & - \\ \hline \hline \end{tabular}

*: Number of static reports for five types of vulnerabilities.

\end{table} 
Table 3: Evaluation of entry URL generation and path constraint solving effectiveness with CraftFuzz. Additionally, since the source code for Predator is not yet open-source and as the environment setup for Atropos proved difficult, these tools were not included in the microtest comparison experiments. Building on RQ1, we further evaluated CraftFuzz's path-constraint-solving capabilities on Dataset 2, with the results shown in Table 3. PC(Path Constraints) Count represents the number of path constraints successfully solved by CraftFuzz, while Avg PC Time records the average time taken to solve each path constraint. The experimental results indicate that CraftFuzz incurred a low performance overhead in path constraint solving. Out of 200 entry URLs, CraftFuzz successfully solved 190 path constraints, achieving a success rate of 95%. Overall, applications with larger codebases tend to have longer enhanced taint propagation chains, meaning more constraint nodes need to be solved and validated, leading to longer solving times; for instance, applications such as SuiteCRM, Leantime, and Mana. Laravel exhibited relatively higher solving times.