ZeroProbe: An Intelligent Web-Based Vulnerability Scanner Integrating Automated Detection and AI-Based Analysis

Abstract

Web applications underpin modern commerce, education, and public services, yet they remain primary targets of attacks such as Cross-Site Scripting (XSS) and SQL injection (SQLi), while professional-grade scanning tools stay out of reach for students, novice developers, and small organisations because of their cost and the expertise they demand. Objectives: This study designed, developed, and evaluated ZeroProbe, an intelligent web-based vulnerability scanner that integrates automated black-box detection with artificial-intelligence-based security analysis. Methods: Following a Research and Development methodology with a Waterfall development model, the system was built on the Python Flask framework to detect reflected XSS, error-based and time-based blind SQLi, and misconfigured HTTP security headers, and it employs the OpenAI GPT-4o-mini model with a local fallback engine to generate structured, human-readable reports; the system was evaluated through black-box testing against the deliberately vulnerable applications DVWA and bWAPP. Results: The XSS module attained a true-positive rate of approximately 88 percent, the SQLi module reached 90 percent for error-based and 80 percent for time-based detection, and the overall false-positive rate was approximately 12.3 percent. The mean scan duration was 18.4 seconds, the AI-generated reports achieved an expert quality score of 4.27 out of 5.00, and the System Usability Scale score was 78.5. Conclusion: The findings confirm that an accessible, accurate, and AI-augmented vulnerability scanner can be constructed for educational and entry-level use within a deliberately bounded scope, lowering the expertise barrier for web application security assessment.