WebMaze: Defending Against LLM-Powered Web Scanners with Functionality-Coupled Deception

Summary

WebMaze is a defense against LLM-based web vulnerability scanners that embeds functionality-coupled traps in genuine pages and generates view-tailored interactive decoy worlds. Tested on 12 web applications with three LLM-based scanners under the default no-disclosure setting, decoy pages accounted for an average of 93.0% of distinct pages requested per run. Scanners still explored mostly decoy pages even when told about the decoy mechanism and instructed to avoid it.