Využití nástrojů umělé inteligence při penetračním testování webových aplikací

The thesis deals with the use of generative artificial intelligence tools in penetration testing of web applications at the application layer. The aim is to analyze the possibilities and limits of these tools in individual steps of the OWASP Web Security Testing Guide (WSTG) methodology and to evaluate in which areas they can realistically supplement or accelerate the work of a penetration tester. The theoretical part summarizes the principles of web technologies and their security, relevant OWASP standards, threat modeling and basic concepts of generative models in the context of penetration testing. On this basis, a reduced WSTG checklist is derived, limited to tests that can be performed at the application layer. In the practical part, an AI-assisted penetration test of the vulnerable OWASP Juice Shop application is performed. Artificial intelligence tools are used as an assistant in individual testing steps according to the simplified WSTG checklist. The testing results show that generative artificial intelligence tools can significantly accelerate some aspects of penetration testing, especially in the area of application mapping, identification of common vulnerabilities and report generation, all within defined limitations. On the contrary, in areas requiring deeper analysis, a comprehensive understanding of the application context and assessment of possible impacts, it turns out that AI tools still have significant limitations. In conclusion, the achieved knowledge is mapped to individual areas of WSTG. Furthermore, this knowledge is interpreted from the point of view of practical use and recommendations are formulated on how to meaningfully combine the work of a penetration tester with generative artificial intelligence tools.