Aug 2026· International Journal for Research in Applied Science and Engineering Technology· 0 citations
TL;DR
HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.
Abstract
The widespread adoption of web applications has significantly increased exposure to security risks, making automated
vulnerability assessment an essential component of modern software development. Although several open-source scanners
provide strong detection capabilities, they typically operate independently, require technical expertise, and produce unstructured
reports, limiting their accessibility and effectiveness. This paper introduces HawkEye, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard.
HawkEye uses Docker-isolated environments to orchestrate scanners and employs a Django–SQLite3 backend to manage scan
workflows and result storage. The current implementation provides full integration for OWASP ZAP and Nikto, while modular
support is included for incorporating Nmap, SQLMap, and Wapiti. The platform consolidates heterogeneous outputs into a
standardized schema, applies CVSS-based severity classification, and generates exportable PDF/JSON reports with
remediation guidance. Experimental testing on intentionally vulnerable applications demonstrates HawkEye’s ability to detect
prominent security weaknesses and illustrates how consolidated reporting improves vulnerability prioritization for development
teams
Topicality. The rapid proliferation of web applications across enterprise ecosystems has intensified the demand for comprehensive, automated vulnerability detection mechanisms. Existing standalone scanning tools exhibit inherent limitations in coverage scope, reporting standardization, and CI/CD pipeline integration, necessitating the development of unified orchestration platforms. The subject of study in this article is the architectural design and implementation of a modular, Python-based integrated vulnerability scanner that consolidates multiple open-source security testing utilities into a cohesive automation framework. The purpose of the article is to develop and validate an extensible platform capable of orchestrating reconnaissance, dynamic application security testing (DAST), static configuration analysis, and information leak detection through unified command-line interface and consolidated HTML reporting. The following results were obtained. A modular scanner architecture was designed, integrating industry-standard tools including Nuclei (template-based vulnerability detection), Burp Suite (proxy-based traffic analysis), Feroxbuster (directory fuzzing), Subfinder/DNSX (subdomain enumeration), Katana (URL crawling), and auxiliary modules for WAF detection (CDNCheck), 403 bypass (byp4xx), Postman collection leak analysis (Postleaks), and exposed configuration discovery (LeakIX). Conclusion. The developed platform achieves enhanced scanning coverage through multi-tool orchestration and generates structured HTML reports with categorized findings. The modular architecture enables rapid integration of emerging security tools, making the framework adaptable to evolving threat landscapes in modern web application security testing.
O.I. Fediushyn, Hlib Khivrenko, Nataliia Popova et al.· Terra security· 0 citations
Web applications underpin modern commerce, education, and public services, yet they remain primary targets of attacks such as Cross-Site Scripting (XSS) and SQL injection (SQLi), while professional-grade scanning tools stay out of reach for students, novice developers, and small organisations because of their cost and the expertise they demand. Objectives: This study designed, developed, and evaluated ZeroProbe, an intelligent web-based vulnerability scanner that integrates automated black-box detection with artificial-intelligence-based security analysis. Methods: Following a Research and Development methodology with a Waterfall development model, the system was built on the Python Flask framework to detect reflected XSS, error-based and time-based blind SQLi, and misconfigured HTTP security headers, and it employs the OpenAI GPT-4o-mini model with a local fallback engine to generate structured, human-readable reports; the system was evaluated through black-box testing against the deliberately vulnerable applications DVWA and bWAPP. Results: The XSS module attained a true-positive rate of approximately 88 percent, the SQLi module reached 90 percent for error-based and 80 percent for time-based detection, and the overall false-positive rate was approximately 12.3 percent. The mean scan duration was 18.4 seconds, the AI-generated reports achieved an expert quality score of 4.27 out of 5.00, and the System Usability Scale score was 78.5. Conclusion: The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.
Automated Web Application Testing plays a vital role in identifying vulnerabilities, analyzing attacks, and generating cybersecurity documentation for modern web environments. Artificial Intelligence (AI) significantly enhances web application testing performance by enabling adaptive threat detection, intelligent payload verification, anomaly-based response evaluation, and automated threat documentation. These AI-driven capabilities reduce manual effort while improving the accuracy, scalability, and reliability of vulnerability assessment and security reporting. However, existing automated web testing frameworks suffer from fragmented workflows, lack of contextual awareness, inefficient vulnerability prioritization, excessive false positive generation, and limited adaptive scanning capabilities. The framework integrates adaptive reconnaissance, vulnerability analysis, and automated documentation within a unified security assessment workflow. The framework introduces the Adaptive Reconnaissance Intelligence Engine (ARIE) to intelligently discover attack surfaces and perform dynamic reconnaissance analysis. A Secure Threat Enumeration Mechanism (STEM) is designed to conduct automated multilayer vulnerability scanning and threat correlation across web components. Furthermore, the Deep Response Payload Analyzer (DRPA) utilizes behavioral response correlation intelligence to detect SQL Injection and Cross-Site Scripting (XSS) attacks through contextual payload-response analysis. In addition, the Cognitive Risk Documentation Framework (CRDF) automates vulnerability severity assessment, exploit validation, and structured cybersecurity report generation for efficient threat documentation. The proposed modular workflow enables a systematic transition from reconnaissance to vulnerability validation and automated risk documentation. Experimental evaluation demonstrates that the proposed framework achieves accurate vulnerability detection, reliable adaptive scanning, automated attack validation, and reduced false positive rates. The system provides an intelligent and efficient cybersecurity evaluation and documentation support framework for modern web application environments.
Arun K S, Abhiram S, Ageesh Lal N G et al.· 2026 6th International Confe...· 0 citations
Manual penetration testing needs specialist skills that most student developers and small teams simply don't have time
to build, and the commercial DAST products that automate this work — Burp Suite Professional, Acunetix, Nessus — are priced
for enterprise budgets rather than a college project or a solo developer's side application. Mature open-source alternatives such
as OWASP ZAP close the cost gap but not the usability one: getting useful output still means learning how to configure a scan
policy, spider a target, and read through a long list of raw findings. This paper describes VulnScanner Pro, a self-hosted
assessment tool that tries to sit in the gap between those two extremes. It runs eight checks against a target URL — SQL
injection, cross-site scripting, HTTP security-header analysis, SSL/TLS configuration, CSRF protection, WHOIS, IP
geolocation, and Nmap-based port scanning — behind a FastAPI backend and a Next.js dashboard, storing every scan in
SQLite so past results can be revisited later. A rule-based scoring function turns the combined module output into one 0–100 risk
number and a CRITICAL/HIGH/MEDIUM/LOW label, and a matching recommendation engine looks up remediation text and
reference links for whatever was found Active scanning of a system that you don’t own can be a legal problem as much as a
technical one. So the API by default won’t start a scan of a system unless you explicitly pass in a consent flag and some text
justification for why you are scanning the system. In a case study on a web application owned by the second author, the authors
ran the full eight-module automated security assessment. It took about a minute to run the assessment and it reported a risk
score of 20 out of 100 or LOW. The six checks for missing HTTP security headers were the only issues found. The checks for
SSL/TLS, SQL injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) all reported that they found no
issues. Only the two expected web ports (80 and 443) were open on the web application. The risk breakdown for the web
application is shown below along with four recommendations for fixing the six missing HTTP security headers. Each of the
recommendations are linked to authoritative external references for additional information on how to fix each of the issues
found
Athili Laxmi Lavanya, Mycharla Madhavkumar, D. Gangadhar· International Journal for Re...· 0 citations
Large Language Models (LLMs) are now deployed at an unprecedented scale across many critical sectors, rapidly transitioning from experimental AI tools to embedded components of production software systems. This accelerated adoption, often enabled by low-code integrations, has lowered technical barriers while simultaneously expanding the attack surface of modern applications, particularly when deployments occur without sufficient domain-specific security expertise. In many cases, security maturity has not progressed at the same pace as capability expansion, creating systemic exposure across confidentiality, integrity, and availability dimensions. To provide structured clarity amid this rapid growth, this paper presents a comparative and standards-aligned analysis of LLM security risks and defense mechanisms grounded in the OWASP GenAI Top-10 (2025). We systematically examine each vulnerability class, map representative attack patterns to primary mitigation strategies, evaluate their security property impact, and analyze practical limitations and implementation trade-offs. In addition, we introduce a severity-based assessment to prioritize risks according to operational and systemic impact, offering a quantitative perspective on defensive readiness. Our findings indicate that current mitigation strategies are predominantly reactive, concentrated at inference time, and unevenly distributed across the LLM lifecycle. Controls addressing training pipelines, supplychain dependencies, and autonomous system behaviors remain comparatively less mature and less standardized. By integrating vulnerability classification, defense mapping, severity prioritization, and trade-off analysis within a unified framework, this study provides actionable guidance for strengthening secure, resilient, and standards-driven LLM deployment in high-stakes environments.
Md Abdul Barek, Md Bajlur Rashid, A. K. I. Riad et al.· Annual International Compute...· 0 citations
The security of open-source cloud platforms is paramount, given their widespread adoption in modern business operations. This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms. Using a black-box penetration testing methodology that combines automated scanning with Burp Suite and its security extensions with systematic manual analysis, we identified a total of 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover. Our findings, which culminated in the assignment of six new Common Vulnerabilities and Exposures (CVE) IDs, provide concrete, empirically validated examples of how server misconfigurations and flawed authentication logic manifest in the exposed management interfaces of mainstream open-source IaaS platforms, including mis-issued API tokens, time-based user enumeration, and host-header–driven misrouting. Specifically, the identified vulnerabilities stem from improper authentication, insufficient input validation, and server misconfigurations. In addition to a responsible vulnerability disclosure process, this work provides practical hardening recommendations to mitigate the identified weaknesses.
Alexandros Perrakis, Efstratios Chatzoglou, Vyron Kampourakis et al.· International Journal of Inf...· 0 citations
Related blog posts
MIT News · Artificial Intelligence· news.mit.eduAug 17, 2026
A USAF cadet and a Lincoln Laboratory researcher found AI chatbots can help nontechnical service members produce viable software applications for their unique problems.
