NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications
summary
NAVEX combines static source analysis and dynamic crawling to build an enhanced code property graph (with sanitization and DB-constraint tags), a navigation graph from a crawler plus concolic client analysis via NoTamper, and an SMT-backed constraint solver to synthesize HTTP exploits. Implemented for PHP, it evaluates 26 apps (3.2M SLoC), constructs exploit chains up to six requests, generates 204 exploits (105 SQLi, 90 XSS, 9 execution-after-redirect), cuts static false positives ~84–87%, raises precision 54%, and runs in tens of minutes per app.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:27Dynamic Web Applications
- 3:34Challenges
- 4:44Goal
- 6:31Approach
- 7:18Input
- 8:21Model
- 11:37Exploit Generation
- 14:24Automatic Import Generation
- 16:24Navigation Graph
- 18:39Data
- 19:59Summary
- 20:27Results
- 22:07Interprocedural Analysis
- 23:46Wrapup
related talks
20mAutomated Exploit Generation for Node.js Packages
16mFIXX: FInding eXploits from eXamples
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
01h 02meXential XSS (Cross Site Scripting)
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
40mHow to hack a node app?
32mWriting Secure JavaScript Code
52mDevSecOps