Search papers, labs, and topics across Lattice.
This paper introduces ZIMPAF, a multi-granular runtime interpreter instrumentation, and RedPhuzz, a targeted fuzzer designed to overcome limitations in existing fuzzing techniques by enhancing instrumentation efficiency and leveraging execution environment knowledge. ZIMPAF enables the identification of high-value fuzzing targets without traditional taint analysis and employs a backward constant probe to optimize the fuzzing process by skipping invulnerable functions. The evaluation shows that RedPhuzz outperforms its predecessor, Phuzz, by detecting all vulnerabilities in 86 test cases across six web applications while being 73% faster, demonstrating significant advancements in web application fuzzing techniques.
RedPhuzz detects all vulnerabilities in web applications while being 73% faster than its predecessor, Phuzz, which missed 16 critical vulnerabilities.
We present ZIMPAF, runtime interpreter instrumentation, and RedPhuzz, a fuzzer, to address key limitations of state-of-the-art fuzzers: inefficient instrumentation, the lack of knowledge of the execution environment, and limited web domain knowledge. ZIMPAF implements a novel multi-granular runtime interpreter instrumentation that provides branch coverage, robust error and exception logging, function and language construct monitoring, and identification of user-supplied inputs used in branch instructions. The instrumentation is capable of identifying potentially vulnerable functions whose parameters are tainted, marking them as high-valued fuzzing targets, without performing taint analysis. It also employs a novel backward constant probe to infer potentially vulnerable functions whose parameters originate from constants, indicating their invulnerability and allowing them to be skipped. This information is utilized by RedPhuzz to perform highly-targeted function-and input-level fuzzing that goes beyond simple error-based fuzzing, but also detects silent vulnerabilities via multi-stage vulnerability detection. We also introduce three novel mutation strategies to achieve highly targeted and effective fuzzing: sanitization-aware, input-in-branch-aware, and data type-aware mutation. We evaluate RedPhuzz's performance with its predecessor (Phuzz) with 86 test cases across six benchmark web applications. RedPhuzz detects all vulnerabilities, while Phuzz fails to detect 16. RedPhuzz is 73% faster than Phuzz despite performing more tasks. ZIMPAF is faster than Phuzz's instrumentation (PCOV and UOPZ), while writing significantly more data. ZIMPAF achieves 2.1 to 41.22 times higher throughput than PCOV and UOPZ across five sampled benchmarks, and 0.87 times for one.
