{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:35:44Z","timestamp":1791459344261,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,2,6]],"date-time":"2024-02-06T00:00:00Z","timestamp":1707177600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,2,6]]},"DOI":"10.1145\/3597503.3608133","type":"proceedings-article","created":{"date-parts":[[2024,2,6]],"date-time":"2024-02-06T20:53:16Z","timestamp":1707252796000},"page":"1-12","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["EDEFuzz: A Web API Fuzzer for Excessive Data Exposures"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-8803-1008","authenticated-orcid":false,"given":"Lianglu","family":"Pan","sequence":"first","affiliation":[{"name":"University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0890-6590","authenticated-orcid":false,"given":"Shaanan","family":"Cohney","sequence":"additional","affiliation":[{"name":"University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8271-0289","authenticated-orcid":false,"given":"Toby","family":"Murray","sequence":"additional","affiliation":[{"name":"University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9871-3695","authenticated-orcid":false,"given":"Van-Thuan","family":"Pham","sequence":"additional","affiliation":[{"name":"University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,2,6]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"2019","author":"OWASP API","year":"2019","unstructured":"OWASP API Top 10: 2019, 2019. [Online]. Available: https:\/\/owasp.org\/www-project-api-security\/ (cit. on p. 1)."},{"key":"e_1_3_2_1_2_1","volume-title":"Available: https:\/\/www.microsoft.com\/security\/blog\/2020\/09\/15\/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs\/ (cit. on","author":"Project Microsoft","unstructured":"Microsoft announces new Project OneFuzz framework, 2020. [Online]. Available: https:\/\/www.microsoft.com\/security\/blog\/2020\/09\/15\/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs\/ (cit. on p. 1)."},{"key":"e_1_3_2_1_3_1","volume-title":"The oracle problem in software testing: A survey","author":"Barr E. T.","unstructured":"E. T. Barr, M. Harman, P. McMinn, M. Shahbaz, and S. Yoo, The oracle problem in software testing: A survey, IEEE transactions on software engineering, vol. 41, no. 5, 507--525, 2014 (cit. on p. 1)."},{"key":"e_1_3_2_1_5_1","first-page":"2","volume-title":"Available: https:\/\/portswigger.net\/support\/using-burp-to-test-for-sensitive-data-exposure-issues (cit. on","author":"Using","unstructured":"Using burp to test for sensitive data exposure issues, 2022. [Online]. Available: https:\/\/portswigger.net\/support\/using-burp-to-test-for-sensitive-data-exposure-issues (cit. on pp. 2, 4)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00083"},{"key":"e_1_3_2_1_7_1","first-page":"2","volume-title":"2015 USENIX Annual Technical Conference (USENIX ATC 15)","author":"Netravali R.","year":"2015","unstructured":"R. Netravali, A. Sivaraman, S. Das, ET AL. Mahimahi: Accurate {record-and-replay} for {http}, in 2015 USENIX Annual Technical Conference (USENIX ATC 15), 2015, 417--429 (cit. on pp. 2, 11)."},{"key":"e_1_3_2_1_8_1","volume-title":"CPO Magazine","author":"Ikeda S.","year":"2022","unstructured":"S. Ikeda, Massive optus data leak prompts new privacy rules in australia, CPO Magazine, 2022 (cit. on p. 2)."},{"key":"e_1_3_2_1_9_1","volume-title":"Available: https:\/\/github.com\/OWASP\/API-Security\/blob\/master\/2019\/en\/src\/0xa3-excessive-data-exposure.md (cit. on","unstructured":"Api3:2019 excessive data exposure, 2019. [Online]. Available: https:\/\/github.com\/OWASP\/API-Security\/blob\/master\/2019\/en\/src\/0xa3-excessive-data-exposure.md (cit. on p. 3)."},{"key":"e_1_3_2_1_10_1","first-page":"3","volume-title":"Pythia: Grammar-based fuzzing of rest apis with coverage-guided feedback and learning-based mutations, arXiv preprint arXiv.2005.11498","author":"Atlidakis V.","year":"2020","unstructured":"V. Atlidakis, R. Geambasu, P. Godefroid, M. Polishchuk, and B. Ray, Pythia: Grammar-based fuzzing of rest apis with coverage-guided feedback and learning-based mutations, arXiv preprint arXiv.2005.11498, 2020 (cit. on pp. 3, 11)."},{"key":"e_1_3_2_1_11_1","first-page":"3","volume-title":"2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), IEEE","author":"Atlidakis V.","year":"2020","unstructured":"V. Atlidakis, P. Godefroid, and M. Polishchuk Checking security properties of cloud service rest apis, in 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), IEEE, 2020, 387--397 (cit. on pp. 3, 11)."},{"key":"e_1_3_2_1_12_1","volume-title":"Available online: https:\/\/swagger.io\/resources\/open-api\/","author":"Initiative API","year":"2020","unstructured":"OpenAPI Initiative Openapi specification, Available online: https:\/\/swagger.io\/resources\/open-api\/, 2020 (cit. on p. 3)."},{"key":"e_1_3_2_1_13_1","first-page":"3","volume-title":"TSE","author":"Man\u00e8s V. J. M.","year":"2019","unstructured":"V. J. M. Man\u00e8s, H. Han, C. Han, ET AL., The art, science, and engineering of fuzzing: A survey, TSE, 2019 (cit. on pp. 3, 10)."},{"key":"e_1_3_2_1_14_1","volume-title":"Available: https:\/\/google.github.io\/clusterfuzz\/ (cit. on","author":"Google","unstructured":"Google clusterfuzz, 2022. [Online]. Available: https:\/\/google.github.io\/clusterfuzz\/ (cit. on p. 3)."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00047"},{"key":"e_1_3_2_1_16_1","volume-title":"14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)","author":"Rigger M.","year":"2020","unstructured":"M. Rigger, and Z. Su Testing database engines via pivoted query synthesis, in 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), 2020, 667--682 (cit. on p. 3)."},{"key":"e_1_3_2_1_17_1","volume-title":"Available: https:\/\/www.kaspersky.com.au\/resource-center\/definitions\/what-is-social-engineering (cit. on","author":"What","unstructured":"What is social engineering? 2022. [Online]. Available: https:\/\/www.kaspersky.com.au\/resource-center\/definitions\/what-is-social-engineering (cit. on p. 4)."},{"key":"e_1_3_2_1_18_1","volume-title":"Available: https:\/\/www.selenium.dev\/documentation\/webdriver\/ (cit. on","unstructured":"Webdriver, 2022. [Online]. Available: https:\/\/www.selenium.dev\/documentation\/webdriver\/ (cit. on p. 5)."},{"key":"e_1_3_2_1_19_1","volume-title":"Available: https:\/\/lcamtuf.coredump.cx\/afl\/ (cit. on","author":"American","unstructured":"American fuzzy lop. [Online]. Available: https:\/\/lcamtuf.coredump.cx\/afl\/ (cit. on p. 6)."},{"key":"e_1_3_2_1_20_1","volume-title":"my program worked. today, it does not. why? ACM SIGSOFT Software engineering notes","author":"Zeller A.","unstructured":"A. Zeller, Yesterday, my program worked. today, it does not. why? ACM SIGSOFT Software engineering notes, vol. 24, no. 6, 253--267, 1999 (cit. on p. 6)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2017.07.006"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/2557547.2557550"},{"key":"e_1_3_2_1_23_1","volume-title":"European Symposium on Research in Computer Security","author":"Rooij O. v.","year":"2021","unstructured":"O. v. Rooij, M. A. Charalambous, D. Kaizer, M. Papaevripides, and E. Athanasopoulos Webfuzz: Grey-box fuzzing for web applications, in European Symposium on Research in Computer Security, Springer, 2021, 152--172 (cit. on p. 10)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.06.004"},{"key":"e_1_3_2_1_25_1","volume-title":"21st USENIX Security Symposium (USENIX Security 12)","author":"Doup\u00e9 A.","year":"2012","unstructured":"A. Doup\u00e9, L. Cavedon, C. Kruegel, and G. Vigna Enemy of the state: A {state-aware}{black-box} web vulnerability scanner, in 21st USENIX Security Symposium (USENIX Security 12), 2012, 523--538 (cit. on p. 10)."},{"key":"e_1_3_2_1_26_1","volume-title":"USENIX Security symposium","author":"Martin M. C.","year":"2008","unstructured":"M. C. Martin, and M. S. Lam Automatic generation of xss and sql injection attacks with goal-directed model checking. In USENIX Security symposium, 2008, 31--44 (cit. on p. 10)."},{"key":"e_1_3_2_1_27_1","volume-title":"2023 IEEE Symposium on Security and Privacy (SP), IEEE Computer Society","author":"Trickel E.","year":"2022","unstructured":"E. Trickel, F. Pagani, C. Zhu, ET AL. TOSS a fault to your witcher: Applying grey-box coverage-guided mutational fuzzing to detect sql and command injection vulnerabilities, in 2023 IEEE Symposium on Security and Privacy (SP), IEEE Computer Society, 2022, 116--133 (cit. on p. 10)."},{"key":"e_1_3_2_1_28_1","volume-title":"2021","author":"Owasp","year":"2021","unstructured":"Owasp top 10: 2021, 2021. [Online]. Available: https:\/\/owasp.org\/Top10\/ (cit. on p. 10)."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3092703.3092708"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2017.2764464"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409719"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2011.5958253"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2501988.2502050"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ITCC.2001.918833"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2003.1260818"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2007.1014"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950294"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464800"},{"key":"e_1_3_2_1_39_1","volume-title":"Nyx-net: Network fuzzing with incremental snapshots, arXiv preprint arXiv:2111.03013","author":"Schumilo S.","year":"2021","unstructured":"S. Schumilo, C. Aschermann, A. Jemmett, A. Abbasi, and T. Holz, Nyx-net: Network fuzzing with incremental snapshots, arXiv preprint arXiv:2111.03013, 2021 (cit. on p. 11)."}],"event":{"name":"ICSE '24: IEEE\/ACM 46th International Conference on Software Engineering","location":"Lisbon Portugal","acronym":"ICSE '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS","Faculty of Engineering of University of Porto"]},"container-title":["Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3608133","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3597503.3608133","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:48:45Z","timestamp":1750182525000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3608133"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,6]]},"references-count":38,"alternative-id":["10.1145\/3597503.3608133","10.1145\/3597503"],"URL":"https:\/\/doi.org\/10.1145\/3597503.3608133","relation":{},"subject":[],"published":{"date-parts":[[2024,2,6]]},"assertion":[{"value":"2024-02-06","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}