FIXX: FInding eXploits from eXamples
summary
FIXX is a tool that takes a disclosed PHP exploit, replays it to extract the taint-style dataflow path, builds a code graph, and finds instruction similarity and path similarity matches across the app. It scores instructions by reusability and sensitivity to pick seeds, stitches S-paths and D-paths, and verifies candidates with symbolic execution using Z3. Evaluated on 19 PHP apps from 32 CVE reports, FIXX finds 1,097 similar exploitable paths and yields 10 new CVE submissions, outperforming Navix, RIPS, and clone-based approaches.
AI-written summary · about
chapters (15)
- 0:00FIXX introduction
- 1:35Vulnerability detection limits
- 3:21Problem and motivation
- 4:45FIXX approach overview
- 5:26Exploit execution and paths
- 6:30Instruction and path similarity
- 8:16Reusability and sensitivity scores
- 9:38Finding similar instructions
- 10:42Detecting exploitable paths
- 11:46Evaluation setup
- 12:28Performance analysis
- 13:53Threshold and module impact
- 14:14Discovered exploitable paths
- 14:54Tool comparison
- 15:15Conclusion
related talks
27mNAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications
22mExtract: A PHP Foot-Gun Case Study
50mD2T2 - Exposing Hidden Exploitable Behaviors Using EDF
38mWhat The PHUZZ?! Finding 0-Days In PHP Apps wt Coverage-guided Fuzzing
29mFinding real bugs in big programs with incorrectness logic
45mFinding Vulnerabilities through Static Analysis and Scripting
01h 01mHow hacking works - Web edition
31m360° View of XSS