# An MLLM-Assisted Web Crawler Approach for Web Application Fuzzing
## 4 Design
### Automated Operation Generation  
Given MLLM's inherent instability in code generation, we opted against direct test code generation and instead decomposed the process into two distinct phases, as described in Section 4.2 and the current section. In this section, we first transform MLLM's natural language task descriptions into automated test scripts, followed by defining and validating the success of web page state transitions. We provide a detailed discussion of both the transformation process and the state verification mechanism.  
As illustrated in the bottom section of Figure 1, the automated operation generation phase begins with the decomposition of tasks generated in Section 4.2. This decomposition is motivated by two key considerations: MLLM's relatively low accuracy in directly generating multi-task test code, and the challenge of accurately evaluating individual task code generation through state transitions. For each decomposed task, we provide MLLM with multiple inputs: the natural language task description, HTML content processed through context extraction, the desired code format, and historical operation records. These inputs enable MLLM to generate the specific code required for task execution.  
We leverage MLLM to validate state transitions through the analysis of page screenshots and content following code execution. A state represents the visual and functional characteristics of a web page during user interaction, encompassing specific content, layout, and interactive elements. State transitions comprise both full-page navigations and dynamic intra-page updates triggered by user actions (inputs, clicks, scrolls). For validation, MLLM analyzes pre- and post-execution page data (URLs, HTML content, screenshots), tasks, and executed code. State transitions are considered successful in two scenarios: (1) intra-page state changes, such as appointment confirmation appearing without page navigation, and (2) inter-page transitions, such as redirecting to an order confirmation page after purchase. When MLLM validates a successful state transition, the operation is logged in the history collection for future reference; otherwise, feedback is provided to MLLM for code regeneration.  
Figure 5 presents our prompt template designed for multi-round dialogues with MLLMs. The template incorporates context-extracted page content, decomposed individual tasks with their operational procedures, and exemplar Puppeteer interaction code snippets (encompassing both click and form completion operations). This context-based few-shot learning approach enhances both MLLM task comprehension capabilities and ensures standardized code generation, facilitating the automated execution of the entire process.  
In web application fuzzing, adhering solely to conventional user operation patterns may inadequately identify potential vulnerabilities. To enhance test coverage, the system must execute non-conventional exploratory operations to detect security vulnerabilities that might remain unidentified under normal usage scenarios. Consequently, following the completion of our primary testing workflow, we introduce a limited set of randomized operations to augment crawler results, thereby expanding test scenarios and improving vulnerability detection efficacy.