Dawid Czarnecki: Build a Fuzzing Framework with IAST | CONFidence 2023

## Overview Dawid Czarnecki presents a year-long research project on building an Interactive Application Security Testing (IAST) framework called cake-fuzzer, which combines dynamic scanning and static analysis to detect vulnerabilities. The framework was inspired by papers from Miguel Philip Batric and Christof Zion's WP Garlic technique, and was commissioned by Luxembourg Armed Forces.

## Vulnerability Detection Approaches The presentation contrasts three approaches: dynamic scanning (firing attacks externally and observing behavior), static scanning (analyzing source code), and IAST (combining both with real-time application knowledge). IAST monitors multiple components simultaneously—application responses, log files, file systems, OS processes, and network connections—to detect anomalies that indicate vulnerabilities.

## Technical Architecture The cake-fuzzer solution has six core components: (1) monitors that observe OS and application behavior; (2) attack queue that executes scheduled attacks; (3) registry storing results in SQLite; (4) configuration strategies (JSON files defining attack scenarios and detection scanners); (5) instrumentation that modifies application and framework code to enable monitoring; and (6) a fuzzer that extracts application information and schedules attacks.

The framework takes a bottom-up approach by targeting specific frameworks (initially CakePHP) rather than broad language coverage, providing detailed knowledge of application internals without pre-configuration. This enables dynamic extraction of routes, endpoints, and parameters during execution.

## Key Technique: Magic Arrays Following WP Garlic methodology, the solution overrides PHP superglobals (like $_GET) with custom "magic array" objects. These objects detect when user input is accessed by the application and automatically inject attack payloads into the execution flow. This discovers parameters dynamically during actual code execution rather than static analysis, adapting to different execution paths and parameter conditions.

## Instrumentation Process Instrumentation involves three parts: (1) overwriting function calls to monitor specific operations (e.g., header requests); (2) patching by including application files to extract variables and framework methods; (3) copying files as needed. The approach allows extraction of application routes dynamically—cake-fuzzer discovered 141 paths in its example, scheduling 141 SSRF attacks, 282 LFI attacks, etc.

## Testing Results on MISP Tested on MISP, a large open-source CakePHP project used by military and governmental organizations, the solution: discovered over 700 vulnerabilities (including duplicates), achieved a 2% false positive rate (15 false positives among findings), scanned 2,000+ paths, scheduled 880,000 attacks, and required approximately 3 hours on AWS EC2. Notably, it detected both known CVEs from previous MISP versions and previously unknown zero-days in the latest version.

## Benefits and Extensibility The approach can extend to other PHP frameworks and eventually other languages by focusing on framework-level patterns rather than broad language support. It discovers obscure parameters missed by typical scanners, supports manual testing integration (components can run separately), and uses simple JSON-based attack strategy definitions. The tool is open-source on GitHub.

## Challenges Three major challenges remain: (1) duplicate vulnerability reports (same vulnerability across multiple endpoints, which adds value by showing broader impact but complicates result presentation); (2) complex multi-condition vulnerabilities requiring specific configurations or user states to exploit; (3) increased application errors when scanning deeper due to magic array objects not being understood by some application code, making deeper coverage harder.