Improving Web Vulnerability: Detecting JavaScript Obfuscation and Dynamic Content Evasion

Hasan, Akib (2025) Improving Web Vulnerability: Detecting JavaScript Obfuscation and Dynamic Content Evasion. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (926kB) | Preview
Preview	PDF (Configuration Manual) Download (396kB) | Preview

Abstract

Looking back, the rise of dynamic, client-side web technologies has unintentionally opened a new front in web security. Modern apps that rely heavily on JavaScript and AJAX expose a blind spot for many traditional Dynamic Application Security Testing (DAST) tools, which often can’t fully render the page or interact with its moving parts. In this paper we explore that blind spot by testing a popular automated scanner against two common evasion tricks: Java-script obfuscation and hiding a flaw inside content that’s loaded on-the-fly via AJAX. We set up a two-pronged experiment running the scanner on the well-known Damn Vulnerable Web Application (DVWA) as a baseline, then on a custom-built AJAX-driven app (VulnApp). The scanner performed nicely on classic issues like plain-vanilla SQL injection and stored XSS that isn’t scrambled. However, the results quickly turned sobering. When the XSS payload was lightly obfuscated with basic JavaScript tricks, the scanner missed it almost entirely. Even worse, it failed to spot the vulnerability tucked inside the AJAX-based component of our custom app and couldn’t mimic the user actions needed to fire the asynchronous request. These findings show that relying on conventional DAST tools can give a false sense of safety; they simply aren’t keeping up with the modern, highly interactive attack surface of today’s web applications. What’s needed now are scanners that can truly emulate a browser, understand dynamic content, and interact with pages the way a real user would.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Salahuddin, Jawad UNSPECIFIED
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	17 Aug 2026 14:45
Last Modified:	17 Aug 2026 14:45
URI:	https://norma.ncirl.ie/id/eprint/9532

Actions (login required)

View Item