Collected research

A Symbolic Execution Framework for JavaScript

Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant and Dawn Song · webblaze.cs.berkeley.edu

Kudzu applies dynamic symbolic execution to client-side JavaScript, covering the event space by automatic GUI exploration and the value space by solving constraints on inputs. Its core is Kaluza, a solver for boolean, bit-vector and string constraints including regular expressions over variable-length strings. On 18 live applications it found 2 unknown code injection bugs.

Record

Researcher

Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant and Dawn Song

Published by

webblaze.cs.berkeley.edu

Format

Whitepaper

Topic

Server

In the archive

• Collected in the 2010 research round

Tags

• javascript
• dynamic-analysis
• formal-analysis
• tooling
• xss
• dom
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant and Dawn Song, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.