# Grey-Box Fuzzing Based on Reinforcement Learning for XSS Vulnerabilities
## 5 Evaluation
### Result and Analysis
#### 5.2.2 Answering RQ2: Comparison with Other Tools  
We select four state-of-the-art web scanners to compare with the proposed method, namely Burp Suite [43], Acunetix Web Vulnerability Scanner (AWVS) [44], XSStirake [45], and Yakit [46]. Burp Suite is an integrated platform for attacking web applications. It contains many tools and designs many interfaces to enhance the penetration testing process. We use the XSS validate plugin in our experiments. AWVS can scan any website that follows HTTP/HTITPS rules and supports scanning of various web vulnerabilities. XSStirake is a black-box XSS vulnerability scanner that includes a powerful fuzzing engine and an extremely fast crawler. Yakit is an interactive application security testing platform that detects XSS vulnerabilities through fuzzing. These four scanners have different vulnerability detection concepts. Since only AWVS automatically detects XSS vulnerabilities among them, other tools require manual assistance, so we did not record the detection time of these tools. Table 8 shows the experimental results. In the WebGoat inspection, Burp Suite found the most, 13 vulnerabilities, with a detection rate of 76.5%, far exceeding other web scanners. However, the method proposed in this paper found 23.5% more vulnerabilities than Burp Suite. In the Jeesns inspection, AWVS found all potential vulnerabilities. Compared with other scanners, Jeesns has more stored XSS vulnerabilities, and AWVS provides better support for such vulnerabilities. However, as a black-box scanner, AWVS can only rely on crawlers to identify input points, and the identification of input point parameters is inaccurate, which leads to false posi \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Web Application**} & \multirow{2}{*}{**RL Model**} & \multicolumn{2}{c}{**Vulnerability**} & \multirow{2}{*}{**Time**} & \multirow{2}{*}{**Detection Rate**} \\  & & **Count** & & \\ \hline \multirow{4}{*}{WebGoat} & random & 5 & - & 29.4\% \\ \cline{2-5}  & DQN & 15 & 2 h46 m20 s & 88.2\% \\ \cline{2-5}  & DDQN & 17 & 3 h 4 m 3 s & 100.0\% \\ \cline{2-5}  & Policy Gradient & 14 & 4 h 21 m 8 s & 82.4\% \\ \hline \multirow{4}{*}{Jeesns} & random & 3 & - & 37.5\% \\ \cline{2-5}  & DQN & 5 & 4 h 31 m14 s & 62.5\% \\ \cline{2-5}  & DDQN & 8 & 5 h 59 m 35 s & 100.0\% \\ \cline{2-5}  & Policy Gradient & 8 & 7 h 21 m 3 s & 100.0\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Test results of the proposed method on the target web application. tives. However, our tool uses static analysis to identify input points and their parameters, and there are no false positives. Overall, the proposed method outperforms these four web scanners. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**No**} & \multirow{2}{*}{**Input Point**} & \multicolumn{3}{c}{**Time (s)**} \\ \cline{3-5}  & & **DQN** & **DDQN** & **Policy Gradient** \\ \hline  
\hline \end{tabular}
\end{table} 
Table 6: Test results for each vulnerable input point of WebGoat. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**No**} & \multirow{2}{*}{**Input Point**} & \multicolumn{3}{c}{**Time (s)**} \\ \cline{3-5}  & & **DQN** & **DDQN** & **Policy Gradient** \\ \hline
1 & /article/add & 252.6 & 165.2 & 108.5 \\ \hline
2 & /weibo/list & 16.1 & 145.7 & 34.7 \\ \hline
3 & /question/ask & 8.0 & 57.3 & 2.3 \\ \hline
4 & /article/detail/ & 22.2 & 146.4 & 32.2 \\ \hline
5 & /group/post/ & 8.5 & 63.774 & 97.7 \\ \hline
6 & /question/detail/ & 28.1 & 238.3 & 33.2 \\ \hline
7 & /group/topic/ & 22.6 & 145.6 & 33.28 \\ \hline
8 & /weibo/detail/ & 18.8 & 164.8 & 24.1 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Test results for each vulnerable input point of Jeesns.