{"id":"https://openalex.org/W7220921908","doi":"https://doi.org/10.21203/rs.3.rs-11114403/v1","title":"A Multi-Agent Large Language Model Framework for Autonomous Web Application Penetration Testing","display_name":"A Multi-Agent Large Language Model Framework for Autonomous Web Application Penetration Testing","publication_year":2026,"publication_date":"2026-10-08","ids":{"openalex":"https://openalex.org/W7220921908","doi":"https://doi.org/10.21203/rs.3.rs-11114403/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-11114403/v1","doi":"https://doi.org/10.21203/rs.3.rs-11114403/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11114403/v1","pdf_url":"https://www.researchsquare.com/article/rs-11114403/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-11114403/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5157934211","display_name":"Tapasvi Madhak","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Tapasvi Madhak","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5157951378","display_name":"Vidhi Desai","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Vidhi Desai","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5157895677","display_name":"Shubham Bholwankar","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Shubham Bholwankar","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5157911388","display_name":"Jeet Moradiya","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Jeet Moradiya","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081280878","display_name":"Anand Singh Rajput","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Anand Singh Rajput","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5116797271","display_name":"Mehulkumar Dalwadi","orcid":"https://orcid.org/0009-0009-7878-0995","observed_orcids":["https://orcid.org/0009-0009-7878-0995"]},"institutions":[{"id":"https://openalex.org/I9694494","display_name":"Parul University","ror":"https://ror.org/024v3fg07","country_code":"IN","type":"education","lineage":["https://openalex.org/I9694494"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Mehulkumar Dalwadi","raw_affiliation_strings":["Parul University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Parul University","institution_ids":["https://openalex.org/I9694494"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5157934211"],"corresponding_institution_ids":["https://openalex.org/I9694494"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0006000000284984708,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/web-application-penetration-testing","display_name":"web application penetration testing","score":0.8199999928474426},{"id":"https://openalex.org/keywords/multi-agent-systems","display_name":"multi-agent systems","score":0.7580000162124634},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9900000095367432},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"reinforcement learning","score":0.6060000061988831},{"id":"https://openalex.org/keywords/red-teaming","display_name":"red teaming","score":0.8100000023841858},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"vulnerability assessment","score":0.6959999799728394},{"id":"https://openalex.org/keywords/proximal-policy-optimization","display_name":"proximal policy optimization","score":0.7889999747276306},{"id":"https://openalex.org/keywords/attack-planning","display_name":"attack planning","score":0.44999998807907104},{"id":"https://openalex.org/keywords/owasp","display_name":"OWASP","score":0.6880000233650208},{"id":"https://openalex.org/keywords/automated-vulnerability-scanning","display_name":"automated vulnerability scanning","score":0.5019999742507935},{"id":"https://openalex.org/keywords/web-application-security","display_name":"web application security","score":0.6629999876022339}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8686000108718872},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6909999847412109},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.45680001378059387},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.4489000141620636},{"id":"https://openalex.org/C2777526511","wikidata":"https://www.wikidata.org/wiki/Q691543","display_name":"Pace","level":2,"score":0.427700012922287},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.42010000348091125},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.37369999289512634},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.3709999918937683},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3612000048160553},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.3555000126361847},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.3508000075817108},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.33320000767707825},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3091999888420105},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.2897000014781952},{"id":"https://openalex.org/C32833848","wikidata":"https://www.wikidata.org/wiki/Q4115054","display_name":"Extensibility","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.25589999556541443},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.25369998812675476}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-11114403/v1","doi":"https://doi.org/10.21203/rs.3.rs-11114403/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11114403/v1","pdf_url":"https://www.researchsquare.com/article/rs-11114403/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-11114403/v1","doi":"https://doi.org/10.21203/rs.3.rs-11114403/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11114403/v1","pdf_url":"https://www.researchsquare.com/article/rs-11114403/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7220921908.pdf","grobid_xml":"https://content.openalex.org/works/W7220921908.grobid-xml"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W2892195839","https://openalex.org/W3094485976","https://openalex.org/W3113922819","https://openalex.org/W3180874179","https://openalex.org/W4284988761","https://openalex.org/W4293235803","https://openalex.org/W4316658458","https://openalex.org/W4367623515","https://openalex.org/W4388516994","https://openalex.org/W4389779306","https://openalex.org/W4390519336","https://openalex.org/W4392848643","https://openalex.org/W4393077032","https://openalex.org/W4399259896","https://openalex.org/W4399694331","https://openalex.org/W4401946900","https://openalex.org/W4403884675","https://openalex.org/W4403885302","https://openalex.org/W4404518338","https://openalex.org/W4405390681","https://openalex.org/W4407590381","https://openalex.org/W4408980996","https://openalex.org/W4409102791","https://openalex.org/W4409990339","https://openalex.org/W4410039529","https://openalex.org/W4410802184","https://openalex.org/W4411243131","https://openalex.org/W4411620389","https://openalex.org/W4411936769","https://openalex.org/W4412656037","https://openalex.org/W4414028217","https://openalex.org/W4414092634","https://openalex.org/W4414450063","https://openalex.org/W4415166407","https://openalex.org/W4415285366","https://openalex.org/W4415343511","https://openalex.org/W4416060406","https://openalex.org/W4416888628","https://openalex.org/W4417167347","https://openalex.org/W6967287692","https://openalex.org/W6968408176","https://openalex.org/W6979280633","https://openalex.org/W7115599674"],"related_works":["https://openalex.org/W7202340081","https://openalex.org/W7146984980","https://openalex.org/W7133339164","https://openalex.org/W7162453199","https://openalex.org/W7165901741","https://openalex.org/W7220830928","https://openalex.org/W7019861525","https://openalex.org/W7148922398","https://openalex.org/W7167886751","https://openalex.org/W7154437433"],"abstract_inverted_index":{"Abstract":[0],"As":[1],"cyberattacks":[2],"targeting":[3],"web":[4,179,232],"applications":[5,96],"are":[6,32],"becoming":[7],"progressively":[8],"more":[9],"sophisticated,":[10],"traditional":[11,200],"penetration":[12,111],"testing":[13,78,112],"finds":[14],"it":[15,192],"difficult":[16],"to":[17,49],"keep":[18],"pace":[19],"with":[20,75,141,152],"the":[21,124,225],"evolving":[22],"and":[23,58,118,131,154,163,173,187,197,221],"adaptive":[24,119],"tactics":[25],"of":[26,70,126,160,216],"modern":[27],"attackers.":[28],"Some":[29],"manual":[30],"tools":[31],"effective":[33],"for":[34,65,86,115,157,231],"detecting":[35],"standard":[36],"vulnerabilities,":[37],"but":[38,90],"they":[39],"lack":[40,73],"semantic":[41],"reasoning":[42],"or":[43],"logical":[44],"flaws,":[45],"limiting":[46],"their":[47],"ability":[48],"discover":[50],"complex":[51],"exploit":[52,161,206],"chains.":[53],"While":[54],"recent":[55],"AI-based":[56],"approaches":[57],"Large":[59,127],"Language":[60,128],"Models":[61,129],"(LLMs)":[62,130],"show":[63],"potential":[64],"automating":[66],"vulnerability":[67,120,195],"analysis,":[68],"most":[69],"them":[71],"still":[72,98],"integration":[74,92],"practical,":[76],"real-world":[77],"environments.":[79],"Furthermore,":[80],"reinforcement":[81,132,219],"learning":[82],"has":[83],"been":[84],"examined":[85],"attack":[87,174],"simulation":[88],"planning,":[89],"its":[91,204],"within":[93],"operational":[94],"red-teaming":[95],"is":[97,135],"immature.This":[99],"study":[100],"presents":[101],"ARES":[102,134,145,189,211],"(Automated":[103],"Red-Teaming":[104],"Evaluation":[105],"System)":[106],"---":[107],"an":[108],"AI-driven,":[109],"multi-agent":[110],"framework":[113],"built":[114,136],"autonomous,":[116],"ethical":[117],"assessment":[121],"by":[122],"integrating":[123],"use":[125],"learning.":[133],"uponthe":[137],"open-source":[138],"Hexstrike-AI,":[139],"along":[140],"two":[142],"key":[143],"modules:":[144],"v1,":[146],"a":[147,165,213],"domain-specific":[148],"fine-tuned":[149],"LLM":[150],"trained":[151],"OWASP":[153,184],"ExploitDB":[155],"datasets":[156],"thorough":[158],"understanding":[159],"reasoning;":[162],"ARES-RL,":[164],"Proximal":[166],"Policy":[167],"Optimization":[168],"(PPO)":[169],"based":[170],"module":[171],"selection":[172],"sequencing.":[175],"Tested":[176],"on":[177],"controlled":[178],"environments":[180],"such":[181],"as":[182],"DVWA,":[183],"Juice":[185],"Shop,":[186],"bWAPP,":[188],"demonstrated":[190],"that":[191],"could":[193],"achievehigher":[194],"findings":[196],"efficiency":[198],"than":[199],"scanners,":[201],"while":[202],"enhancing":[203],"reasoningand":[205],"accuracy":[207],"over":[208],"practice":[209],"iterations.":[210],"represents":[212],"novel":[214],"convergence":[215],"LLM-based":[217],"reasoning,":[218],"learning,":[220],"modular":[222],"automation,":[223],"advancing":[224],"field":[226],"toward":[227],"safe,":[228],"ethicalred-teaming":[229],"frameworks":[230],"application":[233],"security.":[234]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-10-09T00:00:00"}