CHOMBEZA: A Behaviour Confirming Vulnerability Assessment Toolkit for Web Application Penetration Testing

Abstract

Automated web application vulnerability scanners are widely used in penetration testing and bug bounty work, yet many of them report on the basis of pattern matching, which produces high false positive rates and forces the tester to re verify every finding by hand. This paper presents CHOMBEZA, a vulnerability assessment and penetration testing (VAPT) toolkit that confirms each finding through the target's own observed behaviour before it is reported. CHOMBEZA crawls a target from a single seed URL, discovers parameters and forms automatically, sends validated payloads, and confirms a vulnerability only when the application's response demonstrates it: a rendered database error, the contents of a system file, the output of an executed command, or an out of band callback. Findings are delivered as a self contained HTML report with embedded proof screenshots, alongside JSON and CSV. The tool covers the common web vulnerability classes, including SQL injection, cross site scripting, local file inclusion, OS command injection, server side template injection, XML external entity injection, insecure file upload, cross site request forgery, insecure direct object reference, and weak credentials. We evaluate CHOMBEZA against the Damn Vulnerable Web Application (DVWA) at two security levels and show that a single authenticated scan detects all eight target vulnerability categories at both levels with no false positives, each supported by embedded proof. We also document nine concrete detection defects encountered during development and the engineering fixes that resolved them, which we offer as transferable lessons for anyone building a behaviour confirming scanner. CHOMBEZA is implemented in Python with both a desktop and a command line interface over a shared scanning engine.