Problem
Research questions and friction points this paper is trying to address.
web fuzzing
coverage feedback
language-agnostic
system-call instrumentation
TraceLib: System-Call Bitmap Feedback Mechanism for Language-Agnostic Web Fuzzing
🤖 AI Summary
This study addresses the high instrumentation cost and maintenance burden of cross-language applications in web fuzzing by proposing TraceLib. Rather than requiring application-level instrumentation, this system captures system call traces and parameter hashes to generate AFL-style compact bitmaps, serving as a language-agnostic proxy for coverage feedback. The approach is further integrated into the WebFuzz framework. Experimental evaluations on sixteen multilingual web applications demonstrate that TraceLib outperforms both black-box testing and certain natively instrumented configurations. Moreover, it introduces only approximately one millisecond of additional latency per request. Ultimately, this work achieves low-overhead, highly compatible coverage-guided fuzzing for heterogeneous web environments.
📝 Abstract
Coverage feedback is an important source of guidance for fuzzing. However, obtaining such feedback normally requires application-level instrumentation that is specific to the language and runtime of the application. Given that modern web applications span multiple languages and runtimes, this application-level instrumentation is costly to implement and maintain. Therefore, we present TraceLib, a system-call feedback mechanism for enabling language-agnostic web fuzzing. Our proposed approach observes the transitions of system calls, enriches selected transitions with bounded argument hashes, and converts them into a 65,536-position AFL-like bitmap. By using the generated bitmap, any web fuzzer can decide whether to retain requests that add previously unseen bitmap positions without consulting application code coverage. We integrate TraceLib into WebFuzz and evaluate it under five WebFuzz feedback modes: the two proposed TraceLib variants (one over every traced system call and one projected onto monitored file paths and recognized SQL buffers), the N-gram comparator adapted from Xiao et al. representing the most recent work to our knowledge, WebFuzz's Native grey-box feedback, and black-box fuzzing without feedback. We evaluate TraceLib on sixteen web applications under test (WUTs): eight PHP applications and eight further applications spanning Node.js, Ruby, Java, Go, and Python to demonstrate platform portability. The results show that our proposed TraceLib projected exceeds black-box on all eight PHP WUTs while exceeding Native on four: Joomla, Drupal, PrestaShop, and Bagisto. In addition, measured on an identical replayed request workload, the tracer costs approximately one millisecond of server-side latency per request. These results indicate that compact system-call feedback is a useful runtime-independent proxy for coverage guidance.
Innovation
Methods, ideas, or system contributions that make the work stand out.
system-call feedback
language-agnostic fuzzing
bitmap coverage
web fuzzing
runtime-independent
🔎 Similar Papers
No similar papers found.
