# An MLLM-Assisted Web Crawler Approach for Web Application Fuzzing
Insufficient crawler coverage of this attack surface may result in undetected vulnerabilities, substantially elevating security risks in production environments. Prior research has introduced various crawler methodologies to enhance web application attack surface coverage. However, traditional web crawlers [2; 3; 4] exhibit significant limitations in state mining, primarily due to their reliance on rudimentary navigation strategies and page similarity algorithms. By neglecting page states and dependencies, these crawlers generate inefficient, redundant requests. In large-scale applications, state mining complexity increases substantially, as web application states evolve dynamically through user interactions, background processes, and external events. These dynamic transitions, combined with implicit dependencies, present significant challenges in state tracking and analysis. Furthermore, traditional crawler tools struggle to handle sophisticated interaction elements in modern web applications--including form submissions, modal dialogs, and multi-level navigation. Their limited adaptability to structural changes and insufficient semantic understanding frequently result in incomplete test coverage, potentially overlooking critical security vulnerabilities in complex web applications. We introduce CrawlMLMs, a novel web application fuzzing approach that harnesses Multi-modal Large Language Models (MLLMs) to enhance crawler effectiveness. The framework comprises three core components: page state mining, functionality analysis, and automatic operation generation. CrawlMLM leverages MLLMs to comprehensively extract webpage states and generate robust test code, addressing the inherent coverage limitations of traditional crawlers. The system initiates page navigation through program directory structure analysis and target URL construction. Subsequently, MLLMs process page screenshots and HTML content to identify inter-page dependencies and optimize URL access sequences. CrawlMLM's sophisticated user interaction simulation capabilities enable precise operation prediction and behavior pattern analysis; through comprehensive multi-modal analysis (encompassing images, text, and code), it thoroughly understands component functionality and interactions, facilitating accurate prediction of rule-compliant user inputs. We developed specialized prompt templates for generating test code for user interaction simulation, implementing state evaluation mechanisms to verify code effectiveness. The system employs context few-shot learning to enhance task-specific performance, utilizing carefully curated examples and contextual information to improve output accuracy and maintain format consistency. To evaluate CrawlMLM's effectiveness compared to existing web application security scanning technologies, we conducted a rigorous empirical assessment of code coverage and vulnerability detection capabilities. Our experimental evaluation encompassed nine distinct web applications, demonstrating code coverage improvements ranging from 7% to 363% (averaging 163%) compared to current scanning solutions (black widow, burb, and Rnd BFS and URL path algorithms). In the experiment on vulnerability detection capability improvement, we examined nine target programs comprising two distinct application sets: six applications widely referenced in academic literature, and three vulnerable web applications specifically selected to assess the impact of crawler improvements on scanner vulnerability detection capabilities. CrawlMLM identified 44 unique security vulnerabilities across three vulnerable web application environments, demonstrating superior performance and significantly outperforming other crawler-audit module combinations, which detected a maximum of 34 vulnerabilities. Furthermore, in real-world software evaluation, CrawlMLM discovered 20 vulnerabilities across six widely deployed applications, while alternative crawler-audit module combinations identified at most six vulnerabilities.