Automated Fuzzing Based on Analysis of Application Execution Flow

A method of identifying a vulnerability of an application, comprising:

• receiving a message comprising a request and associated execution flow of the application in response to the request;
• analyzing the message to determine whether the execution flow includes a function pre-defined as interesting;
• in response to determining that the execution flow includes the function pre-defined as interesting, determining that the function pre-defined as interesting comprises a vulnerability of the application;
• and
• in response to determining that the function pre-defined as interesting comprises the vulnerability of the application, taking an action with respect to the vulnerability.

A computer storage media storing computer-readable instructions that when executed cause a computing device to:

• receive a message comprising a request and associated execution flow of the application in response to the request;
• analyze the message to determine whether the execution flow includes a function pre-defined as interesting;
• in response to determining that the execution flow includes the function pre-defined as interesting, determine that the function pre-defined as interesting comprises a vulnerability of the application;
• and
• in response to determining that the function pre-defined as interesting comprises the vulnerability of the application, providing an instruction to a reporting engine component associated with the application to block execution of particular code for a request from a particular entity.