A hybrid framework for web applications security vulnerabilities detection

The threat landscape for modern web applications is constantly changing, and traditional security approaches struggle with comprehensive vulnerability detection. Black-box testing, although widely adopted, suffers from limited path coverage and static payload limitations. Model-Based Testing (MBT) provides systematic exploration but requires substantial effort and may miss implementation-specific vulnerabilities. This research introduces and validates a hybrid methodology that integrates black-box testing and MBT through a six-level enhancement framework incorporating authentication mechanisms, client-side crawling, custom payload optimisation, and scope refinement. To demonstrate practical implementation and validate theoretical foundations, the methodology was applied as a case study using OWASP Zed Attack Proxy (ZAP) against OWASP Juice Shop, with manual verification of 3 discovered vulnerabilities and detailed statistical analysis across multiple test iterations. The results demonstrate substantial improvements in vulnerability detection effectiveness, with strong statistical evidence. The case study implementation revealed critical tool reliability issues requiring organisational attention, including systematic documentation of interface reporting discrepancies within automated scanners affecting vulnerability count accuracy, necessitating multi-verification approaches for organisational security assessment. The research contributes (1) a systematic integration framework, designed around tool-agnostic principles and validated through a single-tool case study, enabling incremental adoption across diverse security testing platforms, (2) a comprehensive empirical validation methodology with statistical rigour, and (3) practical implementation guidance including reproducible automation scripts adaptable to various organisational contexts. The framework’s design principles and progressive enhancement approach provide a foundation for broader adoption beyond the specific ZAP implementation demonstrated in this validation study. The sixth level achieved a detection rate of 23.7 critical vulnerabilities compared to 2 critical vulnerabilities in baseline testing, representing a 1085% increase (note: based on $$n=3$$ n = 3 iterations per configuration; reported as exploratory rather than confirmatory). Total vulnerability detection increased from 583 to 4427, a 659% improvement. This demonstrates the cumulative effectiveness of systematic enhancement approaches in automated security testing within the single-application case study evaluated here.