Abstract
Web applications are increasingly important tools in our modern daily lives, such as in education, business transactions, and social media. Because of their prevalence, they are becoming more susceptible to different types of attacks that exploit security vulnerabilities. Exploiting these vulnerabilities may cause damage to the web applications as well as the end-users. Thus, web apps' developers should identify vulnerabilities and fix them before an attacker exploits them. Using blackbox fuzzing techniques for vulnerability identification is very popular during the web apps' development life cycle. These techniques pledge to find vulnerabilities in web applications by constructing attacks without accessing their source codes. This survey explores the research that has been done in the black-box vulnerability finding and exploits construction in web applications and proposes future directions.