SPAFuzz: Web Security Fuzz Testing Tool Based on Fuzz Testing and Genetic Algorithm

Fuzzing is one of the most effective methods currently available for detecting web vulnerabilities. However, traditional fuzzing suffers from issues such as low coverage and limited diversity in test cases. To address these issues, we propose a way to generate test cases based on dynamic feature libraries and attack models by analysing the characteristics of SQL and XSS. Additionally, we introduce a genetic algorithm to guide the population's evolution by monitoring the state changes of the web application. Furthermore, we improved the selection phase of the genetic algorithm to optimally deform multiple iterations for use cases with low fitness values in order to preserve the population diversity to expand the attack capability of the test cases and based on this the SPAFuzz fuzzy testing tool was implemented. Experimental results show that SPAFuzz is able to detect more network vulnerabilities than Sqlmap and Powerfuzzer.