Hackuracy: Boosting AST accuracy through hacking
summary
Claim: scanners alone miss most real exposure while combining scans with manual hacking finds far more. Experiment uses an insecure-by-design web app Moderna (vulnerable-by-default SPA on Node.js) as the Target of Evaluation and measures both vulnerability counts and aggregated risk with a CBSF metric. Results show combined scanning + hacking yields 78.9–93.7% accuracy for vuln counts and 94.3–98.5% for risk exposure, versus the best automated tool at 26.4–58.4% and 8.5–27.0% respectively.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:07Hacking accuracy problems
- 3:22Vulnerability risk inequality
- 9:05CVSS limitations
- 12:18CBSF for risk measurement
- 17:40Manual vs automated hacking
- 22:21Accuracy metrics
- 25:53Hacking accuracy results
- 34:57Manual vs automated trade-offs
- 35:21Key conclusions
- 36:25Q&A
related talks
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
23mSecurity Outgunned: Measuring Software Defined Attack Surface
25mThe Voight-Kampff Test for Discovering Vulnerabilities
57mEnterprise Ethical Hacking Cloud Applications
30mHow to hack a web app?
49mMan vs Machine: manual and automated security testing
28mAccuracy Is Not Enough: Detecting Hidden Risk in CVE Impact Prediction
29mBuilding a Hackbot: How Ethiack's Hackian Finds Real Vulnerabilities