An AI-Powered Tool for Automated Web Application Penetration Testing using PPO

Abstract

This paper proposes an autonomous platform for web penetration testing designed to overcome the limitations of manual testing. The core of this system is a Reinforcement Learning (RL) Automation Core (L2), which acts as the high-level "Strategist." This PPO-based agent learns the optimal sequential workflow of a penetration test. A primary innovation is the Localized Intelligence Layer (L1), which utilizes a Large Language Model (LLM) run locally via Ollama. This privacy-first "Expert" is called by the agent's tools to perform strategic analysis, such as identifying vulnerability sinks from code. This architecture is supported by a Hybrid AI Detection Engine (L3) that synergizes Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) performed by custom scripts using a headless browser to validate exploits. The platform focuses on identifying and validating the OWASP Top 10 vulnerabilities. All findings, Proof-of-Concept (PoC) steps, and remediation guidance are generated in a final command-line report. The system is designed to target high detection accuracy (>=90%) and significantly reduce the false positives that plague traditional scanners.