{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:2S7KUARNOOJFHGO4DTJ7VA4PKD","short_pith_number":"pith:2S7KUARN","canonical_record":{"source":{"id":"2108.08455","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-08-19T02:59:36Z","cross_cats_sorted":[],"title_canon_sha256":"9a7d94d9d8583128f245cb6378e930cde81c78b1b5754aaf7ba53f26ddec47f6","abstract_canon_sha256":"5e538d7ce4e0793c22649fa75ad6701145f2ccae76937db7e9547032d88693ee"},"schema_version":"1.0"},"canonical_sha256":"d4beaa022d73925399dc1cd3fa838f50c0349ab1af41f18b647facd4e3ef5e9c","source":{"kind":"arxiv","id":"2108.08455","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2108.08455","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"arxiv_version","alias_value":"2108.08455v1","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2108.08455","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_12","alias_value":"2S7KUARNOOJF","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_16","alias_value":"2S7KUARNOOJFHGO4","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_8","alias_value":"2S7KUARN","created_at":"2026-07-05T03:07:10Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:2S7KUARNOOJFHGO4DTJ7VA4PKD","target":"record","payload":{"canonical_record":{"source":{"id":"2108.08455","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-08-19T02:59:36Z","cross_cats_sorted":[],"title_canon_sha256":"9a7d94d9d8583128f245cb6378e930cde81c78b1b5754aaf7ba53f26ddec47f6","abstract_canon_sha256":"5e538d7ce4e0793c22649fa75ad6701145f2ccae76937db7e9547032d88693ee"},"schema_version":"1.0"},"canonical_sha256":"d4beaa022d73925399dc1cd3fa838f50c0349ab1af41f18b647facd4e3ef5e9c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:07:10.009282Z","signature_b64":"zhWh/0ZXbVQoReuvMb++MCkXFfEcc7hXcT49E9l41C88QVb/BSV9OiWP4y5zxOPXb7++CCaRUCGly6tOnJxaDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d4beaa022d73925399dc1cd3fa838f50c0349ab1af41f18b647facd4e3ef5e9c","last_reissued_at":"2026-07-05T03:07:10.008864Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:07:10.008864Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2108.08455","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:07:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wyJaK2do+r5CDQNvPyvf8LKEHNAkdmT7/l38jXJ2TnGfyFk+NGJGtDKXN78r7qYUXwEDjwzg5IblY+ymZ0SUBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T08:11:16.248537Z"},"content_sha256":"282db6009a6ffe3920ae933fab47b197858e627f364f9bdf7c9fb417d876d9e5","schema_version":"1.0","event_id":"sha256:282db6009a6ffe3920ae933fab47b197858e627f364f9bdf7c9fb417d876d9e5"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:2S7KUARNOOJFHGO4DTJ7VA4PKD","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"BackREST: A Model-Based Feedback-Driven Greybox Fuzzer for Web Applications","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"(2) Oracle), Behnaz Hassanshahi (1), Benjamin Selwyn-Smith (1), Fran\\c{c}ois Gauthier (1), Max Schl\\\"uter (1), Micah Williams (2) ((1) Oracle Labs, Trong Nhan Mai (1)","submitted_at":"2021-08-19T02:59:36Z","abstract_excerpt":"Following the advent of the American Fuzzy Lop (AFL), fuzzing had a surge in popularity, and modern day fuzzers range from simple blackbox random input generators to complex whitebox concolic frameworks that are capable of deep program introspection. Web application fuzzers, however, did not benefit from the tremendous advancements in fuzzing for binary programs and remain largely blackbox in nature. This paper introduces BackREST, a fully automated, model-based, coverage- and taint-driven fuzzer that uses its feedback loops to find more critical vulnerabilities, faster (speedups between 7.4x "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2108.08455","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2108.08455/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:07:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vqhLdznsiLsMTIbQFHNQkuf70LlWwxD31mLNFRRCoKNTGFYJib74ubl3XnL//T+rp38vMogzCvuOg0ebR3r/CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T08:11:16.249608Z"},"content_sha256":"1cd42dd99926aa7937b180a8a351050f2005b00be3b5b24164f43bcc9cbc518a","schema_version":"1.0","event_id":"sha256:1cd42dd99926aa7937b180a8a351050f2005b00be3b5b24164f43bcc9cbc518a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/bundle.json","state_url":"https://pith.science/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T08:11:16Z","links":{"resolver":"https://pith.science/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD","bundle":"https://pith.science/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/bundle.json","state":"https://pith.science/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2S7KUARNOOJFHGO4DTJ7VA4PKD/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:2S7KUARNOOJFHGO4DTJ7VA4PKD","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"5e538d7ce4e0793c22649fa75ad6701145f2ccae76937db7e9547032d88693ee","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-08-19T02:59:36Z","title_canon_sha256":"9a7d94d9d8583128f245cb6378e930cde81c78b1b5754aaf7ba53f26ddec47f6"},"schema_version":"1.0","source":{"id":"2108.08455","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2108.08455","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"arxiv_version","alias_value":"2108.08455v1","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2108.08455","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_12","alias_value":"2S7KUARNOOJF","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_16","alias_value":"2S7KUARNOOJFHGO4","created_at":"2026-07-05T03:07:10Z"},{"alias_kind":"pith_short_8","alias_value":"2S7KUARN","created_at":"2026-07-05T03:07:10Z"}],"graph_snapshots":[{"event_id":"sha256:1cd42dd99926aa7937b180a8a351050f2005b00be3b5b24164f43bcc9cbc518a","target":"graph","created_at":"2026-07-05T03:07:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2108.08455/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Following the advent of the American Fuzzy Lop (AFL), fuzzing had a surge in popularity, and modern day fuzzers range from simple blackbox random input generators to complex whitebox concolic frameworks that are capable of deep program introspection. Web application fuzzers, however, did not benefit from the tremendous advancements in fuzzing for binary programs and remain largely blackbox in nature. This paper introduces BackREST, a fully automated, model-based, coverage- and taint-driven fuzzer that uses its feedback loops to find more critical vulnerabilities, faster (speedups between 7.4x ","authors_text":"(2) Oracle), Behnaz Hassanshahi (1), Benjamin Selwyn-Smith (1), Fran\\c{c}ois Gauthier (1), Max Schl\\\"uter (1), Micah Williams (2) ((1) Oracle Labs, Trong Nhan Mai (1)","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-08-19T02:59:36Z","title":"BackREST: A Model-Based Feedback-Driven Greybox Fuzzer for Web Applications"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2108.08455","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:282db6009a6ffe3920ae933fab47b197858e627f364f9bdf7c9fb417d876d9e5","target":"record","created_at":"2026-07-05T03:07:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"5e538d7ce4e0793c22649fa75ad6701145f2ccae76937db7e9547032d88693ee","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2021-08-19T02:59:36Z","title_canon_sha256":"9a7d94d9d8583128f245cb6378e930cde81c78b1b5754aaf7ba53f26ddec47f6"},"schema_version":"1.0","source":{"id":"2108.08455","kind":"arxiv","version":1}},"canonical_sha256":"d4beaa022d73925399dc1cd3fa838f50c0349ab1af41f18b647facd4e3ef5e9c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d4beaa022d73925399dc1cd3fa838f50c0349ab1af41f18b647facd4e3ef5e9c","first_computed_at":"2026-07-05T03:07:10.008864Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:07:10.008864Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zhWh/0ZXbVQoReuvMb++MCkXFfEcc7hXcT49E9l41C88QVb/BSV9OiWP4y5zxOPXb7++CCaRUCGly6tOnJxaDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T03:07:10.009282Z","signed_message":"canonical_sha256_bytes"},"source_id":"2108.08455","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:282db6009a6ffe3920ae933fab47b197858e627f364f9bdf7c9fb417d876d9e5","sha256:1cd42dd99926aa7937b180a8a351050f2005b00be3b5b24164f43bcc9cbc518a"],"state_sha256":"aa1169f4136257a43a09a0c5696cc9557c2b4e5591f0c7eb4dfb463e30a1cdd7"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nWjWsyyaSR896QtGpfi8+BBmJx2NREBWY1DR/oHReAubeSk96mHLK7s6VdJb97sfwevdvHQRy1TwvsL1+VV3Dw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T08:11:16.257002Z","bundle_sha256":"4b66128b8395115ea3457884d964c881d8fefb44fd9106a4eba25e5c33a4ab2f"}}