Advanced methodology for detecting XSS vulnerabilities in web applications

Tóm tắt

Cross-Site Scripting (XSS) remains a critical threat to web security, enabling malicious script injection through improper input validation. This paper introduces an automated framework integrating dynamic payload injection, Selenium-driven browser automation, and machine learning-enhanced log analysis. The methodology combines three components: (1) web scraping with BeautifulSoup for attack surface mapping, (2) GitHub-curated payload databases with adaptive encoding for real-world threat simulation, and (3) behavioral anomaly detection via DBSCAN clustering on server logs to identify suspicious IPs. Experimental validation across 20 web applications demonstrated superior detection, identifying55 successful payloads (SP) compared to XSStrike’s 9 SP, while flagging 210 high-risk IPs via risk-scoring thresholds. Despite generating 455 false positives due to comprehensive dynamic analysis, log correlation reduced false alerts by 37%. The framework’s multi-phase approach effectively detects DOM-based and persistent XSS vulnerabilities, outperforming Burp Suite in dynamic environments, though at a higher computational cost.