Demo: Dynamic Defense Deployment with LLM-assissted Client-side Fuzzing in Web Applications

Traditional black-box fuzzing techniques for web applications suffer from limited code coverage and fail to detect vulnerabilities that depend on specific client-side logic, multi-step workflows, or user interactions. In this paper, we present ExpFuzz, a hybrid black-box fuzzing framework to identify vulnerabilities and dynamically deploy defenses against identified vulnerabilities in modern web applications. ExpFuzz instruments the browser environment to collect dynamic UI, network, and code execution context, and augments it with static code analysis to identify hidden or untriggered application paths. A smart crawler simulates user interactions to explore the application’s state space, while a coordinated set of vulnerability-specific agents actively test for a wide range of issues, including SQL injection, XSS, and CSRF. A centralized dispatcher integrates the findings from static and dynamic analysis to guide targeted fuzzing. Our evaluation demonstrates that ExpFuzz achieves great detection rates, especially for stateful, and context-dependent vulnerabilities.