  Coverage-guided fuzz testing has received significant attention from the
research community, with a strong focus on binary applications, greatly
disregarding other targets, such as web applications. The importance of the
World Wide Web in everyone's life cannot be overstated, and to this day, many
web applications are developed in PHP. In this work, we address the challenges
of applying coverage-guided fuzzing to PHP web applications and introduce
PHUZZ, a modular fuzzing framework for PHP web applications. PHUZZ uses novel
approaches to detect more client-side and server-side vulnerability classes
than state-of-the-art related work, including SQL injections, remote command
injections, insecure deserialization, path traversal, external entity
injection, cross-site scripting, and open redirection. We evaluate PHUZZ on a
diverse set of artificial and real-world web applications with known and
unknown vulnerabilities, and compare it against a variety of state-of-the-art
fuzzers. In order to show PHUZZ' effectiveness, we fuzz over 1,000 API
endpoints of the 115 most popular WordPress plugins, resulting in over 20
security issues and 2 new CVE-IDs. Finally, we make the framework publicly
available to motivate and encourage further research on web application fuzz
testing.
