What the PHUZZ?! Finding 0-days in PHP Apps with Coverage-guided Fuzzing

No ratings

Presented at Nullcon Goa 2025 by

Sebastian Neef

Coverage-guided fuzz testing has received significant attention from the research community, strongly favoring binary applications over other targets, such as web applications. However, web applications drive large parts of the internet and have become a fundamental part of modern society. Web vulnerabilities continue to be discovered, and data breaches impacting millions of users are frequently reported. In this talk, we will present PHUZZ—our open-source prototype that brings coverage-guided fuzz testing to PHP web applications. PHUZZ outperforms widely-used web vulnerability scanners, such as BurpSuite Pro, ZAP, and WFuzz, in detecting 7 classes of server-side and client-side vulnerabilities (e.g. SQLi, RCE, XXE, XSS) in artificial and real-world PHP web applications. We will cover some of the challenges of applying coverage-guided fuzzing to web applications and how PHUZZ's function hooking and vulnerability detection approach allowed us to discover over 20 potential security issues and 2 CVEs in some of the most popular WordPress plugins.