The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
Abstract
Web applications underpin modern commerce, education, and public services, yet they remain primary targets of attacks such as Cross-Site Scripting (XSS) and SQL injection (SQLi), while professional-grade scanning tools stay out of reach for students, novice developers, and small organisations because of their cost and the expertise they demand. Objectives: This study designed, developed, and evaluated ZeroProbe, an intelligent web-based vulnerability scanner that integrates automated black-box detection with artificial-intelligence-based security analysis. Methods: Following a Research and Development methodology with a Waterfall development model, the system was built on the Python Flask framework to detect reflected XSS, error-based and time-based blind SQLi, and misconfigured HTTP security headers, and it employs the OpenAI GPT-4o-mini model with a local fallback engine to generate structured, human-readable reports; the system was evaluated through black-box testing against the deliberately vulnerable applications DVWA and bWAPP. Results: The XSS module attained a true-positive rate of approximately 88 percent, the SQLi module reached 90 percent for error-based and 80 percent for time-based detection, and the overall false-positive rate was approximately 12.3 percent. The mean scan duration was 18.4 seconds, the AI-generated reports achieved an expert quality score of 4.27 out of 5.00, and the System Usability Scale score was 78.5. Conclusion: The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.
D. R. Patil, Varad Salgare, Devaj Arya et al.· International Journal for Re...· 0 citations
The increasing deployment of Large Language Models (LLMs) in critical infrastructure has introduced a class of security risks that remain insufficiently characterised and poorly tooled in practice. Attack vectors including prompt injection, jailbreaking, code execution facilitation, covert data exfiltration, and training data poisoning present quantifiable threats to systems that rely on LLM outputs, yet no lightweight, provider-agnostic tool exists to measure these risks systematically. This paper presents VectorSec, an open-source, web-based LLM security scanner built with Python and Dash. The tool executes a structured test suite of 320 adversarial prompts spanning 16 vulnerability categories aligned with the OWASP Top 10 for LLMs. Each response is scored through a four-stage pipeline combining pattern matching, sentiment analysis, semantic similarity, and secondary LLM verification. Evaluation across three open-source models demonstrates that pattern-matching-only filtering misses approximately 15% of High and Critical findings that semantic verification correctly identifies, motivating the multi-layer design. VectorSec provides interactive dashboard reporting, real-time progress tracking, and audit-ready PDF and CSV exports, lowering the barrier to structured LLM security assessment in operational settings.
M. Yamin· International Conference on...· 0 citations
The proposed machine learning-based system for detecting and mitigating SQL injection attacks is designed not just to protect against conventional SQLi attacks but also against JSON-based SQLi attacks, NoSQL injection attacks, hybrid attacks, and conventional WAF evasion techniques.
Nisha P. Shetty, Vinayak Kothari, Eva Hemantkumar Shah et al.· Journal of Mobile Multimedia· 0 citations
Cross-Site Scripting (XSS) attacks remain one of the most impactful attacks and a major threat to web applications, especially when malicious payloads are stuffed via email input. Although advanced learning solutions have achieved significant detection, their computational and time-consuming heuristics often prevent their deployment in resource-limited environments, such as shared hosting or edge sites. This paper presents a lightweight machine learning approach designed to instantly detect XSS attacks originating from web forms. The model is capable of operating independently without relying on external resources or systems (such as cloud services or large detection engines). The proposed solution focuses on a combined feature set consisting of fast-to-calculate syntactic and lexical indicators (such as tag count, suspicious token frequency, coding markup, and entropy). Simple and well-established classifiers—logistic regression, random forest, and LightGBM—were used, focusing on detection effectiveness (precision, recall, F1, and AUC) and operational constraints (inference time per sample and model size). To reflect real-world conditions, the experiments combine generic XSS payloads, benign sample templates, and synthetically modified payloads that mimic the obfuscation and encryption techniques used by attackers. The results are lightweight, low-effort, and highly accurate, and they compete with heavier competitors, with significantly lower semantic and memory footprint costs.
Dhurgham Kareem Gharkan, H. R. Mahmood, Ali Sadiq Salim· ITEGAM- Journal of Engineeri...· 0 citations
The Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats, combining technical rigor with accessibility.
G. Vamsi, V. S. Vinay· International Scientific Jou...· 1 citation
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, M. N. V. Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
