{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:17Z","timestamp":1785512597311,"version":"3.56.0"},"reference-count":72,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100009224","name":"Advanced Research Projects Agency","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100009224","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179317","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"2658-2675","source":"Crossref","is-referenced-by-count":56,"title":["Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities"],"prefix":"10.1109","author":[{"given":"Erik","family":"Trickel","sequence":"first","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fabio","family":"Pagani","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chang","family":"Zhu","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lukas","family":"Dresel","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2133601.2133605"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2009-0385"},{"key":"ref3","first-page":"143","article-title":"Toward Automated Detection of Logic Vulnerabilities in Web Applications","volume-title":"Proceedings of the 19th USENIX Security Symposium","author":"Felmetsger"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988679"},{"key":"ref5","article-title":"Burp Suite. Application Security Testing","year":"2020"},{"key":"ref6","article-title":"Acunetix Web Vulnerability Scanner","year":"2020"},{"key":"ref7","article-title":"IBM\/HCL AppScan","year":"2020"},{"key":"ref8","article-title":"OWASP Zed Attack Proxy","year":"2020"},{"key":"ref9","article-title":"Backrest: A model-based feedback-driven greybox fuzzer for web applications","author":"Gauthier","year":"2021"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88418-5_8"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-33630-5_17"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0002-y"},{"key":"ref13","article-title":"Fuzzing: Art, science, and engineering","author":"Man\u00e8s","year":"2018"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00022"},{"key":"ref15","article-title":"HTTP\/1.1 Message Syntax and Routing","year":"2020"},{"key":"ref16","article-title":"HTTP State Management Mechanism","year":"2020"},{"key":"ref17","article-title":"Common Gateway Interface","year":"2020"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516708"},{"key":"ref20","article-title":"Enemy of the State: A State-Aware Black-Box Vulnerability Scanner","volume-title":"Proceedings of the 21st Symposium on USENIX Security","author":"Doup\u00e9"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14215-4_7"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-015-2017-6"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2012.182"},{"key":"ref25","article-title":"American Fuzzy Lop","year":"2020"},{"key":"ref26","article-title":"Pin - A Dynamic Binary Instrumentation Tool","year":"2020"},{"key":"ref27","article-title":"High-performance binary-only instrumentation for afl-fuzz","year":"2020"},{"key":"ref28","article-title":"What is Dash (\/bin\/dash) Shell?","author":"Gite","year":"2020"},{"key":"ref29","article-title":"Puppeteer - Node.js library that provides high-level API access to Chrome and Chromium","year":"2021"},{"key":"ref30","article-title":"Gremlins - Monkey Testing Library for Web Apps and Node.js","year":"2020"},{"key":"ref31","article-title":"QEMU","year":"2020"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329828"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00056"},{"key":"ref34","article-title":"AFL++: Combining incremental steps of fuzzing research","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"ref36","article-title":"Xdebug: A Debugger and Profiling Tool for PHP","author":"Rethans","year":"2020"},{"key":"ref37","article-title":"OWASP, SQL Injection","year":"2022"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.5120\/ijca2016907794"},{"key":"ref39","article-title":"Arachni - Web Application Security Scanner Framework","year":"2021"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.2307\/j.ctvpj7fxz.9"},{"key":"ref41","article-title":"Skipfish: Web Application Security Scanner","year":"2020"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_14"},{"key":"ref43","article-title":"w3af - Open Source Web Application Security Scanner","year":"2021"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.29"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11050758"},{"key":"ref46","article-title":"Black box evaluation of web application scanners: Standards mapping approach","volume":"22","author":"Qasaimeh","year":"2018","journal-title":"Journal of Theoretical and Applied Information Technology"},{"key":"ref47","article-title":"Rest-ler: automatic intelligent rest api fuzzing","author":"Atlidakis","year":"2018"},{"key":"ref48","article-title":"AFL CGI Wrapper","author":"Fuh","year":"2020"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2610384.2610403"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2557547.2557550"},{"key":"ref51","article-title":"Pythia: Grammar-based fuzzing of rest apis with coverage-guided feedback and learning-based mutations","author":"Atlidakis","year":"2020"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2021.106703"},{"key":"ref53","first-page":"393","article-title":"Rampart: Protecting web applications from cpu-exhaustion denial-of-service attacks","volume-title":"27th {USENIX} Security Symposium ({USENIX} Security 18)","author":"Meng"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICST46399.2020.00062"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23412"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3330576"},{"key":"ref57","article-title":"One engine to fuzz\u2019em all: Generic language processor testing with semantic validation","volume-title":"Proceedings of the 42nd IEEE Symposium on Security and Privacy (Oakland)","author":"Chen"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2941681"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/BIBM47256.2019.8983178"},{"issue":"3","key":"ref60","first-page":"26","article-title":"Testing the security vulnerabilities of openemr 4.1. 1: a case study","volume":"30","author":"Akowuah","year":"2015","journal-title":"Journal of Computing Sciences in Colleges"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.01.008"},{"key":"ref62","first-page":"22","article-title":"Exploiting the potential of web application vulnerability scanning","volume-title":"ICIMP 2018 the Thirteenth International Conference on Internet Monitoring and Protection","author":"Esposito"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/2107581.2107584"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076767"},{"key":"ref65","article-title":"Google Search for Uses of Login System","year":"2021"},{"key":"ref66","article-title":"Google Search for Uses of Login System","year":"2021"},{"key":"ref67","article-title":"Google Search for Uses of Hospital Management System","year":"2021"},{"key":"ref68","article-title":"A static analysis tool for detecting security vulnerabilities in python web applications","author":"Micheelsen","year":"2016"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3412841.3442036"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23021"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/2742854.2745719"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.27"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179317.pdf?arnumber=10179317","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:14:26Z","timestamp":1721452466000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179317\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":72,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179317","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}