Home / Series / Chaos Communication Congress / Aired Order / Season 38 / Episode 27

What the PHUZZ?! Finding 0-days in Web Applications with Coverage-guided Fuzzing

PHUZZ is a framework for Coverage-Guided Fuzzing of PHP Web Applications Fuzz testing is an automated approach to vulnerability discovery. Coverage-guided fuzz testing has been extensively researched in binary applications and the domain of memory corruption vulnerabilities. However, many web vulnerability scanners still rely on black-box fuzzing (e.g., predefined sets of payloads or basic heuristics), which severely limits their vulnerability detection capabilities. In this talk, we present our academic fuzzing framework, "PHUZZ," and the challenges we faced in bringing coverage-guided fuzzing to PHP web applications. Our experiments show that PHUZZ outperforms related works and state-of-the-art vulnerability scanners in discovering seven different vulnerability classes. Additionally, we demonstrate how PHUZZ uncovered over 20 potential security issues and two 0-day vulnerabilities in a large-scale fuzzing campaign of the most popular WordPress plugins.

English
  • Originally Aired December 27, 2024
  • Runtime 60 minutes
  • Production Code 503
  • Created January 1, 2025 by
    r4m3u5
  • Modified January 1, 2025 by
    r4m3u5