# Grey-Box Fuzzing Based on Reinforcement Learning for XSS Vulnerabilities
## 4 Methodology
### Static Analysis
#### 4.2.2 Mutation  
Most web applications validate user input data to avoid injection attacks. To bypass the validation mechanism, raw payloads require further mutations. In this paper, mutation refers to the behavior of modifying the raw payload as a string. The semantics of the payload before and after the mutation are the same. As shown in Table 2, we propose 19 mutations. Mutations 1-4 modify the tags in the raw payload, which is to bypass the blacklist used by web applications to filter certain tags. Many web applications use this mechanism. Mutations 5-18 modify the JS snippet in the payload, which can hide the malicious intent of the payload. Generally speaking, the detection of complex JS scripts is provided by a web application firewall (WAF). Therefore, the proposed method also detects XSS vulnerabilities in real-world web applications protected by WAFs. Mutation 19 does not take any action. The raw payload is directly used for fuzzing, but we still call it a mutation for the consistency of the description.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No** & **Part** & **Dictionary** \\ \hline \multirow{4}{*}{\(1\)} & & \"a”, “area”, “audio”, “b”, “bgsound”, “body”, “br”, “button”, “form”, “frame”, “canvas”, “div”, “embed”, “frameset”, “h1”, “h2”, “h3”, “h4”, “h5”, “h6”, “iframe”, “imp”, “input”, “link”, “menu”, “meta”, “object”, “pl”, “pr”, “script”, “select”, “span”, “strong”, “style”, “table”, “tbody”, “td”, “text”, “text”, “tile”, “tru”, “ul”, “video” \\ \hline
2 & HTML Attribute & “src=x”, “href=x”, “href=“javascript:”, “src=javascript:” \\ \hline \multirow{4}{*}{3} & & “onClick”, “onError”, “onLoad”, “onKeyDown”, “onKeyPress”, “onKeyUp”, “onContextMenu”, “onDoubleClick”, “onDrag”, “onDragEnd”, “onDragEnter”, “onDragEit”, “onDragEuse”, “onDragOver”, “onDragStart”, “onDrog, “onMouseDevon”, “onMouseEnter”, “onMouseDev\", “onMouseOut”, “onMouseDev\", “onMouseOut”, “onMouseOver”, “onMouseUp” \\ \hline \multirow{4}{*}{4} & & “alert(“webfuzzyer-token’)”, “prompt(’webfuzzyer-token’)”, “confirm(”webfuzzyer-token’)”, “conside.log(’webfuzzyer-token’)” \\  & JS Snippet & “alert(\(\backslash\)”webfuzzyer-token’)”, “prompt(\(\backslash\)’webfuzzyer-token’)”, “confirm(\(\backslash\)’webfuzzyer-token’)”, “conside.log(\(\backslash\)”webfuzzyer-token’)” \\ \hline \hline \end{tabular}
\end{table}
Table 1: The dictionaries of HTML tags, HTML attributes, HTML events, and JS snippets.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**No** & **Type** & **Description** & **Mutated Payload** \\ \hline \multirow{2}{*}{1} & Angle Bracket & Use \%3c and \%3e instead & \%3C/_font omunosemove_ = \\  & Recoding & of \textless{} and \textgreater{}. & _alert(”webfuzzer-token”)\%3E\%3C/_font\%3E_ \\ \hline \multirow{2}{*}{2} & Random Case & Invert the case of the \\  & Random Case & characters in the payload (no \\  & Conversion & more than half the number \\  & & of characters). & \\ \hline \multirow{2}{*}{3} & Space Insertion & Randomly insert spaces \\  & & in the payload. & _\_  
To show the effects of these mutations intuitively, we take raw payload <_font omouse-move=alert('webfuzzer-token')></font>_ as an example. The last row of Table 2 shows the payload after different mutations. It should be noted that when the next fuzzing cycle starts, the new payload is generated based on the raw payload of the previous round, not the mutated payload.