NEXUS: An Orchestrator-Driven Automated Pentesting Platform for Modern API Architectures and False Positive Reduction

This paper presented NEXUS, an orchestrator-driven automated API security testing platform that addresses the three most pressing operational challenges in contemporary API security assessment: tool fragmentation, authorization-logic vulnerability coverage, and false-positive overload. By unifying 54 security modules under a bounded concurrency orchestrator, deploying a dynamic Payload Selection Agent, and introducing the True Positive Verification Engine, NEXUS achieves 91% OWASP API Top 10 detection coverage alongside an 85% false-positive reduction relative to conventional DAST baselines. The system's CI/CD-native export capabilities and real-time WebSocket dashboard position it as a practical tool for integration into modern DevSecOps workflows, enabling security assurance at the velocity of continuous deployment. Future work will address the remaining coverage gap for semantic business-flow violations through LLM-assisted workflow specification generation, and will extend the TPVE with out-of-band DNS callback infrastructure to improve SSRF confirmation fidelity. Additional evaluation across a broader corpus of real-world API targets in production-representative conditions is also planned.

[1] Fielding, R. T., & Taylor, R. N. (2002). Principled design of the modern Web architecture. ACM Transactions on Internet Technology, 2(2), 115-150. [2] OWASP Foundation. (2023). OWASP API Security Top 10 2023. Retrieved from https://owasp.org/API-Security/ [3] Hossen, M. I., Bhuiyan, M. F. R., & Hossain, M. A. (2022). A survey of false-positive reduction techniques in DAST tools. Journal of Cybersecurity and Privacy, 2(3), 512-531. [4] Doupé, A., Cova, M., & Vigna, G. (2010). Why Johnny can't pentest: An analysis of black-box web vulnerability scanners. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) (pp. 111-131). Springer. [5] Atlidakis, V., Godefroid, P., & Polishchuk, M. (2019). RESTler: Stateful REST API fuzzing. In Proceedings of the 41st International Conference on Software Engineering (ICSE) (pp. 748-758). IEEE. [6] Wittern, E., Cha, A., & Laredo, J. A. (2018). Generating GraphQL-wrappers for REST(-like) APIs. In Web Engineering (ICWE) (pp. 65-83). Springer. [7] Pellegrino, G., & Balzarotti, D. (2014). Toward black-box detection of logic flaws in web applications. In Proceedings of the 21st Annual Network and Distributed System Security Symposium (NDSS). [8] Fonseca, J., Vieira, M., & Madeira, H. (2007). Testing and comparing web vulnerability scanning tools for SQL injection and XSS attacks. In 13th Pacific Rim International Symposium on Dependable Computing (PRDC) (pp. 365-372). IEEE. [9] Faraday Security. (2023). Faraday: Open-source vulnerability management platform. Retrieved from https://github.com/infobyte/faraday [10] Swisskyrepo. (2024). PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security. GitHub Repository. Retrieved from https://github.com/swisskyrepo/PayloadsAllTheThings