Reverse Engineering Web Vulnerability Scanners for Automated Vulnerability Discovery and Scan Detection

This paper examines the continued vulnerability of modern web applications to automated reconnaissance and vulnerability scanning, and it points out the inadequacy of conventional security analysis in comprehensively grasping both offensive and defensive dynamics. The paper proposes GUARDSCANNER V2, a black-box reverse-engineering and logic discovery tool for comprehensive web application analysis. It enables the identification of the technology stack, analysis of both client-side and server-side artifacts, and extensive web crawling for comprehensive vulnerability scanning. The tool also includes specific attack modules for SQL Injection, Cross-Site Scripting (XSS), Command Injection, Open Redirect, Path Traversal, and Sensitive File Disclosure attacks. In addition to automated vulnerability scanning, the strategy also involves a lightweight application- layer scan detection and defense mechanism that can be integrated into any web application backend. The module identifies any unauthorized automated scanning activity through behavioral and payload analysis, records malicious activities, notifies administrators, and has the capability to temporarily block IP addresses if set, thus protecting against aggressive web application reconnaissance. Experimental results obtained from vulnerable web applications verify the practicability of integrating reverse-engineered web application reconnaissance, automated vulnerability scanning, and real-time scan detection into a single security framework.