Greybox fuzzing for web applications

A system comprising:

• a computer processor;
• a web server configured to instrument a web application to generate taint analysis results;
• a repository configured to store:
• a first request comprising a first value of a first parameter, wherein the first value corresponds to a first vulnerability category of a plurality of vulnerability categories, and
• a second request comprising a second value of the first parameter, wherein the second value corresponds to a second vulnerability category of the plurality of vulnerability categories;
• and
• a fuzzer, executing on the computer processor and configured to:
• send, to the web server and at a first entry point of the instrumented web application, the first request,
• receive, from the instrumented web application and in response to sending the first request, first taint analysis results,
• determine that the first taint analysis results comprise a sink function corresponding to the second vulnerability category,
• in response to determining that the first taint analysis results comprise the sink function corresponding to the second vulnerability category, send, to the first entry point, the second request,
• receive, from the instrumented web application and in response to sending the second request, second taint analysis results comprising the sink function, and
• detect, in the instrumented web application and using the second taint analysis results, a vulnerability corresponding to the sink function and the second vulnerability category.

A method comprising:

• sending, to a first entry point of an instrumented web application executing on a web server, a first plurality of requests comprising a first plurality of values of a first parameter, wherein the first plurality of values correspond to a first vulnerability category of a plurality of vulnerability categories;
• receiving, from the instrumented web application and in response to sending the first plurality of requests, a plurality of coverage metrics;
• determining that the total number of requests in the first plurality of requests has reached a request threshold without increasing the coverage of the instrumented web application;
• in response to determining that the total number of requests has reached the request threshold without increasing the coverage, determining a second vulnerability category of the plurality of vulnerability categories;
• sending, to the first entry point, a first new request comprising a first new value of the first parameter, wherein the first new value corresponds to the second vulnerability category;
• receiving, from the instrumented web application and in response to sending the first new request, taint analysis results comprising a sink function corresponding to the second vulnerability category;
• and
• detecting, in the instrumented web application and using the taint analysis results, a vulnerability corresponding to the sink function and the second vulnerability category.