Dynamic symbolic execution for automated test generation consists of instrumenting and
running a program while collecting path constraint on inputs from predicates encountered in …

We present a new symbolic execution tool, KLEE, capable of automatically generating tests
that achieve high coverage on a diverse set of complex and environmentally-intensive …

Dynamic taint analysis and forward symbolic execution are quickly becoming staple
techniques in security analyses. Example applications of dynamic taint analysis and forward …

String constraint solving refers to solving combinatorial problems involving constraints over
string variables. String solving approaches have become popular over the past few years …

Whitebox fuzzing is a form of automatic dynamic test generation, based on symbolic
execution and constraint solving, designed for security testing of large applications …

We present a technique for finding security vulnerabilities in Web applications. SQL Injection
(SQLI) and cross-site scripting (XSS) attacks are widespread forms of attack in which the …

(57) ABSTRACT A method and apparatus is disclosed hereinforautomated test input
generation for web applications. In one embodiment, the method comprises performing a …

Many automatic testing, analysis, and verification techniques for programs can be effectively
reduced to a constraint generation phase followed by a constraint-solving phase. This …

Symbolic execution is a well-known program analysis technique which represents program
inputs with symbolic values instead of concrete, initialized, data and executes the program …

One of the distinguishing characteristics of software systems is that they evolve: new patches
are committed to software repositories and new versions are released to users on a …