The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
Abstract
Web applications underpin modern commerce, education, and public services, yet they remain primary targets of attacks such as Cross-Site Scripting (XSS) and SQL injection (SQLi), while professional-grade scanning tools stay out of reach for students, novice developers, and small organisations because of their cost and the expertise they demand. Objectives: This study designed, developed, and evaluated ZeroProbe, an intelligent web-based vulnerability scanner that integrates automated black-box detection with artificial-intelligence-based security analysis. Methods: Following a Research and Development methodology with a Waterfall development model, the system was built on the Python Flask framework to detect reflected XSS, error-based and time-based blind SQLi, and misconfigured HTTP security headers, and it employs the OpenAI GPT-4o-mini model with a local fallback engine to generate structured, human-readable reports; the system was evaluated through black-box testing against the deliberately vulnerable applications DVWA and bWAPP. Results: The XSS module attained a true-positive rate of approximately 88 percent, the SQLi module reached 90 percent for error-based and 80 percent for time-based detection, and the overall false-positive rate was approximately 12.3 percent. The mean scan duration was 18.4 seconds, the AI-generated reports achieved an expert quality score of 4.27 out of 5.00, and the System Usability Scale score was 78.5. Conclusion: The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.
D. R. Patil, Varad Salgare, Devaj Arya et al.· International Journal for Re...· 0 citations
The increasing deployment of Large Language Models (LLMs) in critical infrastructure has introduced a class of security risks that remain insufficiently characterised and poorly tooled in practice. Attack vectors including prompt injection, jailbreaking, code execution facilitation, covert data exfiltration, and training data poisoning present quantifiable threats to systems that rely on LLM outputs, yet no lightweight, provider-agnostic tool exists to measure these risks systematically. This paper presents VectorSec, an open-source, web-based LLM security scanner built with Python and Dash. The tool executes a structured test suite of 320 adversarial prompts spanning 16 vulnerability categories aligned with the OWASP Top 10 for LLMs. Each response is scored through a four-stage pipeline combining pattern matching, sentiment analysis, semantic similarity, and secondary LLM verification. Evaluation across three open-source models demonstrates that pattern-matching-only filtering misses approximately 15% of High and Critical findings that semantic verification correctly identifies, motivating the multi-layer design. VectorSec provides interactive dashboard reporting, real-time progress tracking, and audit-ready PDF and CSV exports, lowering the barrier to structured LLM security assessment in operational settings.
M. Yamin· International Conference on...· 0 citations
Crafty tactics like nested request bodies, encoding schemes, and JavaScript Object Notation (JSON) operators are now used by attackers to trick and bypass conventional Web application firewalls. The proposed machine learning-based system for detecting and mitigating SQL injection attacks is designed not just to protect against conventional SQLi attacks but also against JSON-based SQLi attacks, NoSQL injection attacks, hybrid attacks, and conventional WAF evasion techniques. The proposed system utilizes a stacking ensemble of Random Forest, Gradient Boosting, and Logistic Regression classifiers with manually constructed features that represent various properties of queries instead of using conventional static rule-based techniques or deep learning models. The detector is integrated into an application process that facilitates query inspection, batch analysis, decision explanation, and mitigation actions. The application is made available via a Flask-based REST API. To add structural variety, the dataset is constructed from public payload sources and augmented methodically. To support detections and to provide potential WAF rules, feature-level explanations are employed. The proposed work is also extended to incorporate a privacy-preserving federative learning framework to show its efficacy in collaborative environments. The system’s overall goal is to provide a modern, API-driven application as a complementary injection attack detection and monitoring layer suitable for quick, easy deployment.
Nisha P. Shetty, Vinayak Kothari, Eva Hemantkumar Shah et al.· Journal of Mobile Multimedia· 0 citations
Cross-Site Scripting (XSS) attacks remain one of the most impactful attacks and a major threat to web applications, especially when malicious payloads are stuffed via email input. Although advanced learning solutions have achieved significant detection, their computational and time-consuming heuristics often prevent their deployment in resource-limited environments, such as shared hosting or edge sites. This paper presents a lightweight machine learning approach designed to instantly detect XSS attacks originating from web forms. The model is capable of operating independently without relying on external resources or systems (such as cloud services or large detection engines). The proposed solution focuses on a combined feature set consisting of fast-to-calculate syntactic and lexical indicators (such as tag count, suspicious token frequency, coding markup, and entropy). Simple and well-established classifiers—logistic regression, random forest, and LightGBM—were used, focusing on detection effectiveness (precision, recall, F1, and AUC) and operational constraints (inference time per sample and model size). To reflect real-world conditions, the experiments combine generic XSS payloads, benign sample templates, and synthetically modified payloads that mimic the obfuscation and encryption techniques used by attackers. The results are lightweight, low-effort, and highly accurate, and they compete with heavier competitors, with significantly lower semantic and memory footprint costs.
Dhurgham Kareem Gharkan, H. R. Mahmood, Ali Sadiq Salim· ITEGAM- Journal of Engineeri...· 0 citations
ABSTRACT
Python-based web application developed to identify and analyse malicious Android APK files. It integrates static analysis, using Andro guard to extract permissions and metadata, with dynamic analysis, employing Mobs to monitor runtime behaviour in a controlled sandbox environment. This dual-layered approach enables the detection of both overt and hidden threats. At its core, the system leverages a Random Forest classifier trained on labelled datasets of malware and benign applications, providing accurate threat classification along with confidence scoring. The application features a Flask-based web interface that allows secure APK uploads, real-time scanning, and the generation of detailed PDF reports. A history of previous scans is maintained to support long-term tracking and analysis. The technical architecture consists of three main components: a user interface built with HTML, CSS, and Flask templates; a Python backend responsible for feature extraction, safe testing, and machine learning predictions; and an SQLite database for storing results. By automating the identification of dangerous applications, the system addresses critical mobile security challenges. It is designed with scalability in mind, making it easy to expand for future needs such as cloud integration. Built with Python’s security tools and thoroughly tested, the project demonstrates a practical solution to combat evolving Android malware. It ensures usability for both programmers and security experts, combining technical rigor with accessibility. Ultimately, the Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats.
G. Vamsi, Vedula Sai Vinay· International Scientific Jou...· 1 citation
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, Manne Naga VJ Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
