A Systematic Literature Review on Automated Exploit and Security Test Generation
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916603192410112 |
|---|---|
| author | Bui, Quang-Cuong Iannone, Emanuele Camporese, Maria Hinrichs, Torge Tony, Catherine Tóth, László Palomba, Fabio Hegedűs, Péter Massacci, Fabio Scandariato, Riccardo |
| author_facet | Bui, Quang-Cuong Iannone, Emanuele Camporese, Maria Hinrichs, Torge Tony, Catherine Tóth, László Palomba, Fabio Hegedűs, Péter Massacci, Fabio Scandariato, Riccardo |
| contents | The exploit or the Proof of Concept of the vulnerability plays an important role in developing superior vulnerability repair techniques, as it can be used as an oracle to verify the correctness of the patches generated by the tools. However, the vulnerability exploits are often unavailable and require time and expert knowledge to craft. Obtaining them from the exploit generation techniques is another potential solution. The goal of this survey is to aid the researchers and practitioners in understanding the existing techniques for exploit generation through the analysis of their characteristics and their usability in practice. We identify a list of exploit generation techniques from literature and group them into four categories: automated exploit generation, security testing, fuzzing, and other techniques. Most of the techniques focus on the memory-based vulnerabilities in C/C++ programs and web-based injection vulnerabilities in PHP and Java applications. We found only a few studies that publicly provided usable tools associated with their techniques. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_04953 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | A Systematic Literature Review on Automated Exploit and Security Test Generation Bui, Quang-Cuong Iannone, Emanuele Camporese, Maria Hinrichs, Torge Tony, Catherine Tóth, László Palomba, Fabio Hegedűs, Péter Massacci, Fabio Scandariato, Riccardo Cryptography and Security Software Engineering A.2 The exploit or the Proof of Concept of the vulnerability plays an important role in developing superior vulnerability repair techniques, as it can be used as an oracle to verify the correctness of the patches generated by the tools. However, the vulnerability exploits are often unavailable and require time and expert knowledge to craft. Obtaining them from the exploit generation techniques is another potential solution. The goal of this survey is to aid the researchers and practitioners in understanding the existing techniques for exploit generation through the analysis of their characteristics and their usability in practice. We identify a list of exploit generation techniques from literature and group them into four categories: automated exploit generation, security testing, fuzzing, and other techniques. Most of the techniques focus on the memory-based vulnerabilities in C/C++ programs and web-based injection vulnerabilities in PHP and Java applications. We found only a few studies that publicly provided usable tools associated with their techniques. |
| title | A Systematic Literature Review on Automated Exploit and Security Test Generation |
| topic | Cryptography and Security Software Engineering A.2 |
| url | https://arxiv.org/abs/2502.04953 |