Jul 2026· Terra security· Vol 2, pp. 78-85· 0 citations· 9 references
TL;DR
An extensible platform capable of orchestrating reconnaissance, dynamic application security testing (DAST), static configuration analysis, and information leak detection through unified command-line interface and consolidated HTML reporting is developed.
Abstract
Topicality. The rapid proliferation of web applications across enterprise ecosystems has intensified the demand for comprehensive, automated vulnerability detection mechanisms. Existing standalone scanning tools exhibit inherent limitations in coverage scope, reporting standardization, and CI/CD pipeline integration, necessitating the development of unified orchestration platforms. The subject of study in this article is the architectural design and implementation of a modular, Python-based integrated vulnerability scanner that consolidates multiple open-source security testing utilities into a cohesive automation framework. The purpose of the article is to develop and validate an extensible platform capable of orchestrating reconnaissance, dynamic application security testing (DAST), static configuration analysis, and information leak detection through unified command-line interface and consolidated HTML reporting. The following results were obtained. A modular scanner architecture was designed, integrating industry-standard tools including Nuclei (template-based vulnerability detection), Burp Suite (proxy-based traffic analysis), Feroxbuster (directory fuzzing), Subfinder/DNSX (subdomain enumeration), Katana (URL crawling), and auxiliary modules for WAF detection (CDNCheck), 403 bypass (byp4xx), Postman collection leak analysis (Postleaks), and exposed configuration discovery (LeakIX). Conclusion. The developed platform achieves enhanced scanning coverage through multi-tool orchestration and generates structured HTML reports with categorized findings. The modular architecture enables rapid integration of emerging security tools, making the framework adaptable to evolving threat landscapes in modern web application security testing.
HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.
D. R. Patil, Varad Salgare, Devaj Arya et al.· International Journal for Re...· 0 citations
The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
Automated Web Application Testing plays a vital role in identifying vulnerabilities, analyzing attacks, and generating cybersecurity documentation for modern web environments. Artificial Intelligence (AI) significantly enhances web application testing performance by enabling adaptive threat detection, intelligent payload verification, anomaly-based response evaluation, and automated threat documentation. These AI-driven capabilities reduce manual effort while improving the accuracy, scalability, and reliability of vulnerability assessment and security reporting. However, existing automated web testing frameworks suffer from fragmented workflows, lack of contextual awareness, inefficient vulnerability prioritization, excessive false positive generation, and limited adaptive scanning capabilities. The framework integrates adaptive reconnaissance, vulnerability analysis, and automated documentation within a unified security assessment workflow. The framework introduces the Adaptive Reconnaissance Intelligence Engine (ARIE) to intelligently discover attack surfaces and perform dynamic reconnaissance analysis. A Secure Threat Enumeration Mechanism (STEM) is designed to conduct automated multilayer vulnerability scanning and threat correlation across web components. Furthermore, the Deep Response Payload Analyzer (DRPA) utilizes behavioral response correlation intelligence to detect SQL Injection and Cross-Site Scripting (XSS) attacks through contextual payload-response analysis. In addition, the Cognitive Risk Documentation Framework (CRDF) automates vulnerability severity assessment, exploit validation, and structured cybersecurity report generation for efficient threat documentation. The proposed modular workflow enables a systematic transition from reconnaissance to vulnerability validation and automated risk documentation. Experimental evaluation demonstrates that the proposed framework achieves accurate vulnerability detection, reliable adaptive scanning, automated attack validation, and reduced false positive rates. The system provides an intelligent and efficient cybersecurity evaluation and documentation support framework for modern web application environments.
Arun K S, Abhiram S, Ageesh Lal N G et al.· 2026 6th International Confe...· 0 citations
The rapid expansion of the life cycle for software deployment has required a move from traditional, manual security analysis to automated and integrated assurance frameworks. This study examines the effectiveness of integrating assurance, real-time threat detection, and automated certification gates right into the Continuous Integration and Continuous Deployment pipeline. The analysis is based on a synthetic dataset comprising values from 429 different builds, which is used to study the agreement between automated gating mechanisms and lower vulnerability escape rates. We used a standard tool chain consisting of Jenkins for orchestration, SonarQube for static analysis, and Splunk for log aggregation to emulate a high-velocity enterprise environment. The system seeks to reduce technical debt and potential security risks without impeding deployment velocity by enforcing stringent quality gates that prevent non-compliant artifacts from being promoted. The study highlights the quantitative effects of these controls on success build rates and on the exposure of hidden threats during staging. The results reveal that, despite an initial slowdown in delivery velocity, the incorporation of automated certification gates considerably reduces critical severity incident rates. Implications: The results indicate how to make system changes in response to data for those attempting to put DevSecOps into practice while maintaining the speed and integrity of their systems.
Sauhard Bhatt, Satyanarayana Gadiraju· 2026 6th International Confe...· 0 citations
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, Manne Naga VJ Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
- The rapid explosion of web application capabilities over the past ten years has fundamentally redesigned how applications are delivered, simultaneously introducing an intricate, multifaceted attack surface that continues to evolve. Standard vectors, long thought to be understood — such as SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) — still exist as potent hazards, yet they are increasingly overshadowed. Emerging cloud-native architectures, serverless delivery mechanisms, microservices, and AI-driven automation introduce entirely new categories of subtle, deeply embedded vulnerabilities. This research evaluates how these threats have metastasized and traces the origins of modern security vectors to determine if established defensive protocols remain effective against increasingly complex modern exploitation tactics. We conducted a strict Systematic Literature Review (SLR) structured by PRISMA 2020 guidelines, filtering an extensive initial pool of 885 records down to 62 core sources published between 2015 and 2026. This foundational dataset synthesizes observations from 44 peer-reviewed empirical studies alongside analysis from 18 key cybersecurity frameworks and official threat intelligence reports, incorporating guidance from standards bodies including OWASP, NIST, and ISO/IEC. The synthesized evidence reveals a definitive and strategic maturation in adversarial approach: threat actors are abandoning isolated, single-vulnerability exploits. They are instead executing prolonged, multi-stage campaigns that specifically leverage the trust relationships found in interconnected software ecosystems. While SQLi, XSS, and authentication weaknesses remain critical and frequent (identified within our 12 primary attack categories), a steep rise in complex, multi-stage exploit chains, AI-assisted reconnaissance, API breaches, and software supply chain compromises represents the new operational normal for adversaries. Furthermore, our analysis indicates that traditional defensive frameworks like secure development lifecycles, Zero Trust Architecture, DevSecOps, and Web Application Firewalls (WAFs) are no longer sufficient in isolation. Their mitigation capacity works only when supported by continuous, real-time context-aware monitoring and truly dynamic risk management, establishing an empirical baseline for architecting resilient security posturing that can keep pace with accelerating innovation.
Irene I. Eda, Jose Marcelito D. Brigoli, Teodoro B. Comayas Jr. et al.· Iconic research and engineer...· 0 citations