An Automated Vulnerability Assessment Engine for Web Applications Using Fuzz Testing Techniques

International Journal of Computer Science and Technology | Vol. 11, No. 1, January 2009 | pp. 1–8

DOI: 10.46882/2009/IJCST/111022

Research Article

Title: An Automated Vulnerability Assessment Engine for Web Applications Using Fuzz Testing Techniques

Names of Authors: Oliver T. Vance¹, Jessica L. Harper¹

Authors’ Affiliations: ¹School of Computing and Information Systems, University of Melbourne, Melbourne, Australia

Abstract: Web application security is a primary concern for modern e-commerce and banking infrastructures, as injection vulnerabilities consistently expose sensitive backend databases to exploitation. This paper presents an automated, black-box vulnerability assessment engine, named SecureFuzz, designed to detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) anomalies. SecureFuzz operates by dynamically parsing target web page forms, generating malformed input payloads via mutated regular expressions, and analyzing HTTP response statuses and DOM modifications. The engine introduces an intelligent seed selection heuristic that mutates payloads based on the input field text attributes. SecureFuzz was benchmarked across 35 deliberate production web application testbeds. The engine achieved a vulnerability detection recall rate of 94.2% while maintaining a low false-positive declaration rate of 4.3% ± 0.8%. Computational runtimes averaged 1.2 seconds per entry form, presenting security engineering teams with an efficient pipeline asset to audit application security postures prior to release.

Keywords: Web security, fuzz testing, SQL injection, cross-site scripting, vulnerability assessment, automated testing

Manuscript Timeline: Received October 12, 2008; Revised November 25, 2008; Accepted December 15, 2008; Published January 7, 2009

Citation: Vance, O. T., & Harper, J. L. (2009). An Automated Vulnerability Assessment Engine for Web Applications Using Fuzz Testing Techniques. International Journal of Computer Science and Technology, 11(1), 1–8.

Subscribe to read the full article: https://www.internationalscholarsjournals.org/subscribe-to-read