ZIMPAF & RedPhuzz: High-fidelity Web Application Fuzzing via Branch, Language Construct, and Function Call Monitoring

2026-07-27

AI Summary

Existing fuzzing tools struggle to efficiently uncover silent vulnerabilities due to low instrumentation overhead, lack of execution environment awareness, and insufficient Web-domain semantics. To address this, this work proposes ZIMPAF and RedPhuzz, a synergistic framework that employs multi-granularity runtime interpreter instrumentation—spanning branches, language constructs, and function calls—to identify high-value targets influenced by user input without relying on taint analysis. It further incorporates reverse constant probes to bypass non-exploitable functions. The approach introduces three novel mutation strategies that are aware of sanitization logic, input position, and data type. Evaluation across 86 test cases from six Web applications demonstrates that the method detects all known vulnerabilities, discovers 16 additional ones compared to Phuzz, achieves a 73% speedup, and attains instrumentation throughput 0.87–41.22× higher than PCOV/UOPZ.

Abstract

We present ZIMPAF, runtime interpreter instrumentation, and RedPhuzz, a fuzzer, to address key limitations of state-of-the-art fuzzers: inefficient instrumentation, the lack of knowledge of the execution environment, and limited web domain knowledge. ZIMPAF implements a novel multi-granular runtime interpreter instrumentation that provides branch coverage, robust error and exception logging, function and language construct monitoring, and identification of user-supplied inputs used in branch instructions. The instrumentation is capable of identifying potentially vulnerable functions whose parameters are tainted, marking them as high-valued fuzzing targets, without performing taint analysis. It also employs a novel backward constant probe to infer potentially vulnerable functions whose parameters originate from constants, indicating their invulnerability and allowing them to be skipped. This information is utilized by RedPhuzz to perform highly-targeted function-and input-level fuzzing that goes beyond simple error-based fuzzing, but also detects silent vulnerabilities via multi-stage vulnerability detection. We also introduce three novel mutation strategies to achieve highly targeted and effective fuzzing: sanitization-aware, input-in-branch-aware, and data type-aware mutation. We evaluate RedPhuzz's performance with its predecessor (Phuzz) with 86 test cases across six benchmark web applications. RedPhuzz detects all vulnerabilities, while Phuzz fails to detect 16. RedPhuzz is 73% faster than Phuzz despite performing more tasks. ZIMPAF is faster than Phuzz's instrumentation (PCOV and UOPZ), while writing significantly more data. ZIMPAF achieves 2.1 to 41.22 times higher throughput than PCOV and UOPZ across five sampled benchmarks, and 0.87 times for one.

Problem

• web application fuzzing
• instrumentation efficiency
• execution environment awareness
• web domain knowledge
• silent vulnerability detection

Innovation

• multi-granular instrumentation
• targeted fuzzing
• silent vulnerability detection
• sanitization-aware mutation
• backward constant probe