Method of detecting vulnerability in WebApps using Machine Learning
summary
Prototype called SAIVS prototype crawls dynamic flows by creating accounts and logging in, labels pages and error states with Naive Bayes, chooses form values by combining MLP + Q-learning and fills unseen fields using Word2Vec similarity, and learns HTML/JS payload structure with LSTM and Word2Vec to craft payloads that bypass sanitizers. Demo scans 129 pages, targets reflected XSS, and finds seven exploitable reflections in about two minutes; training uses thousands of pages and per-form hundreds of trials.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:14Japan's security talent shortage
- 3:26Automating web app testing
- 6:40Web app crawling requirements
- 10:29Page type recognition with Bayesian filters
- 14:10Form input optimization with MLP and Q-learning
- 24:42Detecting web app vulnerabilities
- 27:13Cross-site scripting detection requirements
- 29:27Understanding HTML and JavaScript with LSTM
- 35:49Optimizing inspection patterns with MLP
- 39:57Vulnerability detection workflow and retries
- 40:22Demo overview
- 46:12Demo results and time comparison
- 47:21Future improvements and outlook
related talks
01h 14mBreaking the Bot: GenAI Web App Attack Surface & Exploitation
20mUnderstanding and Mitigating Risks in LLM-Powered Web Apps
41mNew Methods in Automated XSS Detection
55mApisecure, 14 & 15 March 2023 - Sagar Bhure, Security Engineer at F5.
37mAutomatic Extraction of Indicators of Compromise for Web App.
26mSimple Method of Automatic Risks Assessment for Web Systems Considering Assets Sensitivity
43m Web Application Vulnerability Scanners: An Intro & Discussion
25mThe Voight-Kampff Test for Discovering Vulnerabilities