# An MLLM-Assisted Web Crawler Approach for Web Application Fuzzing
## 5 Evaluation
### Code Coverage Evaluation  
In evaluating code coverage, three representative tools were selected as baselines for comparison: First, Burp, the most advanced commercial black-box vulnerability scanner for Web applications. Its crawler module supports dynamic pages, form submissions, and authentication, with flexible configuration options. Second, Black Widow, an open-source black-box Web crawler tool that builds on traditional crawling capabilities by incorporating navigation modeling, traversal, and state-dependent tracking features. The third baseline, Rnd BFS and URL path was chosen based on the research by [PERSON] and [PERSON] [12]. This study showed that combining random breadth-first search with a page similarity algorithm based on URL paths (including domain names, paths, and query strings) achieves optimal performance across various scenarios. To assess the performance of CrawlMLM, we first set up a Docker container environment for each Web application, providing CrawlMLM with the complete directory structure and login credentials. Coverage data were collected using the Xdebug extension for PHP. For nine PHP applications, we compared CrawlMLM against Burp, Black Widow, and Rnd BFS and URL path, with a consistent test time limit of 6 h. Table 2 presents the detailed code coverage comparison results: \(A\backslash B\) represents the number of code lines covered exclusively by CrawlMLM, \(A\cap B\) represents the number of code lines covered by both CrawlMLM and the comparison tools, and \(B\backslash A\) represents the number of code lines covered exclusively by the comparison tools. \begin{table}
\begin{tabular}{l c c c c} \hline
**Application** & **Ver.** & \begin{tabular}{c} **GitHub** \\ **Stars** \\ \end{tabular} & \
\begin{tabular}{c} **Lines of** \\ **Code** \\ \end{tabular} &
\begin{tabular}{c} **Prior** \\ **Research** \\ \end{tabular} \\ \hline OpenEMR & 5.0.17 & 1.6 k & 9443 & [4,15,16] \\ \hline Wordpress & 5.7.1 & 15 k & 253,183 & [1,3,4,17,18,19] \\ \hline osCommerce & 2.3.4.1 & 272 & 44,355 & [1,4,20,21,22,23] \\ \hline phpBB & 3.3.3 & 1.4 k & 318,104 & [1,3,4,17,18] \\ \hline DVWA & 2.3 & 10 k & 5826 & [24] \\ \hline XVWA & - & 1.7 k & 14,717 & [24] \\ \hline bWAPP & - & n/a & 31,794 & [24] \\ \hline User Login Management System & 2.1 & n/a & 1490 & [4] \\ \hline Doctor Appointment Booking System & 1.0 & n/a & 3981 & [4] \\ \hline \end{tabular}
\end{table} 
Table 1: Web Applications Used in Evaluation. \begin{table}
\begin{tabular}{l c c c c c c c c c} \hline
**Application** & \multicolumn{3}{c}{**Burp**} & \multicolumn{3}{c}{**Black Widow**} & \multicolumn{3}{c}{**Rnd BFS and URL Path**} \\ \cline{2-10}  & \(A\backslash B\) & \(A\cap B\) & \(B\backslash A\) & \(A\backslash B\) & \(A\cap B\) & \(B\backslash A\) & \(A\backslash B\) & \(B\backslash A\) \\ \hline OpenEMR & 31,416 & 12,261 & 411 & 28,254 & 15,423 & 1622 & 23,638 & 20,039 & 9959 \\ Wordpress & 50,337 & 14,926 & 136 & 50,231 & 15,032 & 768 & 20,737 & 44,526 & 7051 \\ Login Mgmt. & 55 & 121 & 5 & 46 & 130 & 65 & 5 & 171 & 12 \\ phpBB & 16,589 & 14,159 & 777 & 12,818 & 179,930 & 1829 & 12,172 & 18,576 & 2115 \\ osCommerce & 7637 & 3958 & 139 & 5468 & 6127 & 417 & 4323 & 7272 & 401 \\ Doctor Appt. Sys. & 811 & 362 & 0 & 841 & 332 & 47 & 317 & 856 & 124 \\ DVWA & 1261 & 765 & 2 & 1333 & 693 & 8 & 447 & 1579 & 57 \\ XVWA & 732 & 1425 & 0 & 622 & 1536 & 27 & 279 & 1878 & 121 \\ bWAPP & 2924 & 801 & 3 & 2428 & 1297 & 14 & 1672 & 2053 & 274 \\ \hline \end{tabular}
\end{table} 
Table 2: PHP Code Line Coverage Results. This figure presents the PHP code line coverage comparison results between CrawlMLM and three baseline approaches: Burp, Black Widow, and Rnd BFS and URL path. Each scanner is compared against CrawlMLM. The \(A\backslash B\) column shows the unique lines discovered by CrawlMLM. The \(A\cap B\) shows the lines found by CrawlMLM and the other scanner. The \(B\backslash A\) column shows the unique lines found by the other tool. If CrawlMLM has the most unique lines, the value is green.