# Grey-Box Fuzzing Based on Reinforcement Learning for XSS Vulnerabilities
## 5 Evaluation
### Result and Analysis
#### 5.2.2 Answering RQ2: Comparison with Other Tools
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Web Application**} & \multirow{2}{*}{**Scanner**} & \multicolumn{2}{c}{**Vulnerability Count**} & \multicolumn{1}{c}{**Detection Rate**} \\ \hline \multirow{4}{*}{WebGoat} & Burp Suite & 13 & 76.5\% \\ \cline{2-4}  & AWVS & 7 & 41.2\% \\ \cline{2-4}  & XSStrike & 5 & 29.4\% \\ \cline{2-4}  & Yakit & 6 & 35.3\% \\ \hline \multirow{4}{*}{Jeesns} & Burp Suite & 3 & 37.5\% \\ \cline{2-4}  & AWVS & 8 & 100.0\% \\ \cline{1-1} \cline{2-4}  & XSStrike & 3 & 37.5\% \\ \cline{1-1} \cline{2-4}  & Yakit & 4 & 80.0\% \\ \hline \hline \end{tabular}
\end{table} 
Table 8: The performance of scanners on WebGoat and Jensns. To further analyze the reasons for the experimental results, we analyze the vulnerability detection principles of these four web scanners. Burp Suite uses a proxy to intercept the data package in the test, observes whether there are controllable parameters in the data package, and then performs XSS vulnerability detection. Burp Suite cannot crawl web pages and find input points, which need to be provided manually. When Burp Suite uses the XSS Validate plugin for XSS vulnerability detection, Phantom (a headless browser) is used to detect the token in the payload to determine whether the event is triggered successfully. This plugin uses four JavaScript functions and three JavaScript events to form statements and then embeds them in 32 templates to generate multiple payloads. Compared with the method proposed in this paper, Burp Suite does not mutate the payload and cannot bypass the filtering rules of the target web application. AWVS is a black-box scanner. It first tried to traverse all the links on the web page to collect entry points, but the scan did not collect all the links in the subdirectories. In the experiment, we scanned the target application with AWVS many times and found that the number of input points scanned each time was different and incomplete. This means that the performance of AWVS in entry point recognition is worse than the method proposed in this paper. AWVS can preset login information in advance, so it can automate fuzz testing. The payload dictionary of AWVS is not public. By crawling and analyzing the data package, we found that its dictionary size is larger than that of Burp Suite. The XSS payload generated by AWVS uses multiple methods to bypass the web application filtering mechanism. AWVS scanning is fast, but the number of vulnerabilities found is much lower than that by our method due to incomplete input points. XSStrike also uses a fuzz-based vulnerability detection method, but it does not have the function of simulating login authentication, so it cannot automatically discover the input points of the target web application. XSStrike tests all parameters of the input point one by one. However, the size of its built-in dictionary is too small, it is only suitable for a very small number of scenarios, and it cannot bypass common XSS vulnerabilities. Therefore XSStrike performed the worst in the experiment. Yakit requires people to interact with the tool during the testing process constantly. Like Burp Suite, Yakit uses a proxy to intercept data packages and requires manual screening and formulation of detection paths and parameters, so it cannot collect input points. The number of Yakit XSS vulnerability payload templates is small, but various XSS vulnerability scenarios are considered comprehensively. These payloads come as in-tag text and attributes, JavaScript tags, and comments. Yakit's vulnerability detection speed is fast, and it is a potential vulnerability detection method. However, it requires human assistance, which limits its usage scenarios.