一句话：提出并演示 JCOMIX，一个基于搜索的渗透测试工具，自动生成 XML 注入攻击以检测前端 Web 应用漏洞。
用户输入净化与验证是微服务架构防御 XML 注入（XMLi）攻击的重要机制，但其有效性依赖于净化与验证规则集（如正则表达式）的质量，安全分析师需要对其进行充分测试。JCOMIX 是一个渗透测试工具，面向前端 Web 应用自动生成 XMLi 攻击（测试用例），以暴露 XML 漏洞。该工具实现了多种搜索算法，包括随机搜索（传统 fuzzing）、遗传算法，以及为 XMLi 测试专门设计的协作式协同进化算法 COMIX。作者通过实证研究展示了 JCOMIX 在测试一个开源前端 Web 应用时的有效性。
Input sanitization and validation of user inputs are well-established protection mechanisms for microservice architectures against XML injection attacks (XMLi). The effectiveness of the protection mechanisms strongly depends on the quality of the sanitization and validation rule sets (e.g., regular expressions) and, therefore, security analysts have to test them thoroughly. In this demo, we introduce JCOMIX, a penetration testing tool that generates XMLi attacks (test cases) exposing XML vulnerabilities in front-end web applications. JCOMIX implements various search algorithms, including random search (traditional fuzzing), genetic algorithms (GAs), and the more recent co-operative, co-evolutionary algorithm designed explicitly for the XMLi testing (COMIX). We also show the results of an empirical study showing the effectiveness of JCOMIX in testing an open-source front-end web application.