Multi-Vulnerability Detection in Web Applications Using a Hybrid Static–Dynamic Approach with Adaptive Payload Validation

Abstract

The increasing complexity of modern web applications has led to a significant rise in security vulnerabilities, posing serious risks such as data breaches, unauthorized access, and system compromise. Traditional vulnerability detection techniques, including static analysis and dynamic analysis, suffer from inherent limitations such as high false positive rates and incomplete coverage, respectively. To address these challenges, this study proposes a hybrid vulnerability detection framework that integrates static code analysis, dynamic payload-based testing, and a correlation engine within a unified architecture. The proposed system is capable of detecting multiple vulnerability types, including SQL Injection, Cross-Site Scripting, authentication bypass, sensitive data exposure, and broken access control. The framework supports both white-box and black-box testing modes, enabling flexibility across different application environments. Experimental evaluation conducted on a local vulnerable application and the OWASP Juice Shop demonstrates that the hybrid approach significantly improves detection accuracy while reducing false positives. The results indicate notable performance gains compared to standalone methods, with improved validation of exploitable vulnerabilities through runtime analysis. The integration of correlation-driven validation enhances the reliability of the detection process and reduces manual verification effort. Overall, the proposed framework provides an effective and scalable solution for multi-vulnerability detection in web applications and offers strong potential for integration into modern secure development practices.