What The PHUZZ?! Finding 0-Days In PHP Apps wt Coverage-guided Fuzzing
summary
Open-source PHUZZ brings coverage-guided fuzzing to PHP apps by running a Python fuzzer, collecting endpoints from a browser HAR, and instrumenting targets via uops hooks plus Xdebug/PECL coverage through PHP auto_prepend_file. It fuzzes parameter values (keeping names), mutates inputs, disables auth/CSR checks to reach deeper code paths, and detects seven vulnerability classes. Evaluation pulls 183 popular WordPress plugins (115 actually fuzzed), yields 20+ potential issues and two CVEs, and outperforms BurpSuite/ZAP/WFuzz on these benchmarks.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 3:33Fuzzing design challenges
- 11:30Implementation of PHUZZ
- 24:09Experiments and findings
- 27:40Analysis, conclusion, and Q&A
related talks
01h 15mMake your programs more reliable with Fuzzing
39mFuzzing: Finding Your Own Bugs and 0days!
15mFuzzing the PHP Interpreter via Dataflow Fusion
31m“Fuzz or lose..."
53mFuzz Testing for Fun and Profit
47mFuzzing Your Code
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing