Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces SpiderSapien, a client-centric web crawler and security scanner designed to address the limitations of existing tools in exploring the dynamic and interactive nature of modern web applications. By leveraging immersive interaction through high-level feedback channels and integrating a language model for form handling, SpiderSapien significantly enhances the ability to discover and test deep application states. The evaluation reveals a 46% increase in average code coverage and a marked improvement in vulnerability detection, identifying XSS vulnerabilities in seven applications compared to a maximum of two by other scanners.
SpiderSapien uncovers 46% more code coverage and detects seven times the XSS vulnerabilities of existing scanners, revolutionizing web application security testing.
Black-box web application crawling and scanning play an important role for security testing of web applications. Yet state-of-the-art scanners fall short of addressing key characteristics of a modern web application: its extreme dynamism and interactivity on the client side. This paper identifies immersive interaction as a key ingredient for scanners to deeply explore modern web applications. We propose SpiderSapien, a client-centric crawler and security scanner. SpiderSapien incorporates a unique combination of high-level, user-facing feedback channels from the web application to achieve immersive interaction in a black-box crawling loop. These feedback channels include both novel methods to detect interactable elements and sensibly order UI interactions, and orthogonally using an LLM to solve forms. In doing so, we demonstrate how to reliably discover and test deep states of modern web applications. Furthermore, our modular approach and useful abstraction layer can serve as a building block for future scanners. The evaluation of our approach shows substantial improvements in both code coverage and vulnerability detection over previous work. Our approach increased average code coverage across applications by at least 46% over any other scanner, or 16% when compared to the union of all other scanners. We find XSS vulnerabilities in 7 web applications, while any other scanner finds XSS in up to 2 applications.