From 5fa89e7a33c5af10eeac701bc0208d40f127d41b Mon Sep 17 00:00:00 2001 From: kewmine Date: Tue, 22 Sep 2026 03:48:43 +0530 Subject: [PATCH] truth: the 2026-09-11 and 2026-09-12 crossfyre scorecards Two more runs against the lab, recorded the same way as the six already here. Read them with the miss buckets, not the headline: the fleet is saturated, so 48 of 48 says every trap that fires was caught, not that the lab has nothing left to catch. --- truth/scorecards/2026-09-11-crossfyre.json | 1495 +++++++++++++++++ truth/scorecards/2026-09-12-crossfyre.json | 1696 ++++++++++++++++++++ 2 files changed, 3191 insertions(+) create mode 100644 truth/scorecards/2026-09-11-crossfyre.json create mode 100644 truth/scorecards/2026-09-12-crossfyre.json diff --git a/truth/scorecards/2026-09-11-crossfyre.json b/truth/scorecards/2026-09-11-crossfyre.json new file mode 100644 index 0000000..29e74a6 --- /dev/null +++ b/truth/scorecards/2026-09-11-crossfyre.json @@ -0,0 +1,1495 @@ +{ + "tool": "crossfyre", + "generated": "2026-09-11T19:20:51Z", + "totals": { + "expected": 48, + "detected": 42, + "missed": 6, + "false_positive": 0, + "unmatched": 161, + "out_of_scope": 24, + "precision": 1.0, + "recall": 0.875, + "f1": 0.9333, + "seconds": 7392.9, + "requests": 65489, + "slowest_target": "mutillidae", + "slowest_seconds": 6112.1 + }, + "by_class": { + "bfla": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "bola": { + "expected": 4, + "detected": 4, + "recall": 1.0 + }, + "cmdi": { + "expected": 4, + "detected": 2, + "recall": 0.5 + }, + "cors": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "cve": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "default-creds": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "deserialization": { + "expected": 1, + "detected": 0, + "recall": 0.0 + }, + "dos": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "excessive-exposure": { + "expected": 5, + "detected": 5, + "recall": 1.0 + }, + "exposure": { + "expected": 5, + "detected": 4, + "recall": 0.8 + }, + "info-disclosure": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "lfi": { + "expected": 3, + "detected": 3, + "recall": 1.0 + }, + "misconfig": { + "expected": 6, + "detected": 6, + "recall": 1.0 + }, + "sqli": { + "expected": 7, + "detected": 6, + "recall": 0.8571 + }, + "tech": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "xss-reflected": { + "expected": 3, + "detected": 2, + "recall": 0.6667 + } + }, + "by_target": { + "androgoat": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [], + "out_of_scope": [ + "AG1", + "AG2", + "AG3", + "AG4" + ], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null + }, + "bwapp": { + "expected_in_scope": 5, + "detected": [ + "BW1", + "BW2", + "BW3", + "BW4", + "BW5" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/web.config", + "param": null, + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/login.php", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/htmli_get.php", + "param": "firstname", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xss_get.php", + "param": "lastname", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/password_change.php", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/reset.php", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [ + "BW6" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 126.9, + "requests": 8569 + }, + "crapi": { + "expected_in_scope": 3, + "detected": [ + "CR1", + "CR2", + "CR3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "bola", + "path": "/workshop/api/mechanic/mechanic_report", + "param": null, + "severity": "critical" + } + ], + "out_of_scope": [ + "CR4", + "CR5" + ], + "location_flags": [ + { + "id": "CR1", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 8.0, + "requests": 1291 + }, + "crawlground": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/reset", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/api/reveal", + "param": "url", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/api/page", + "param": "url", + "severity": "high" + }, + { + "class": "open-redirect", + "path": "/api/redirect", + "param": "url", + "severity": "medium" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.5, + "requests": 1576 + }, + "crawlmaze": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 9.2, + "requests": 1035 + }, + "dvga": { + "expected_in_scope": 7, + "detected": [ + "DG1", + "DG2", + "DG3", + "DG4", + "DG5", + "DG6" + ], + "missed": [ + "DG7" + ], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/graphql", + "param": "query", + "severity": "medium" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": null + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": 1.0, + "recall": 0.8571, + "f1": 0.9231 + }, + "dvwa": { + "expected_in_scope": 4, + "detected": [ + "DV1", + "DV2", + "DV3", + "DV4" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/vulnerabilities/brute", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/login.php", + "param": null, + "severity": "medium" + }, + { + "class": "sqli", + "path": "/vulnerabilities/brute", + "param": "username", + "severity": "high" + }, + { + "class": "sqli", + "path": "/vulnerabilities/sqli_blind", + "param": "id", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/vulnerabilities/csrf", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/csp", + "param": "include", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/xss_s", + "param": "txtName", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/xss_s", + "param": "mtxMessage", + "severity": "high" + }, + { + "class": "open-redirect", + "path": "/vulnerabilities/open_redirect/source/low.php", + "param": "redirect", + "severity": "medium" + }, + { + "class": "ssrf", + "path": "/vulnerabilities/fi", + "param": "page", + "severity": "high" + } + ], + "out_of_scope": [ + "DV5", + "DV6", + "DV7" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 424.7, + "requests": 14915 + }, + "faultline": { + "expected_in_scope": 3, + "detected": [ + "FL1", + "FL2", + "FL3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "cors", + "path": "/api/v1/users/1", + "param": null, + "severity": "high" + }, + { + "class": "cors", + "path": "/api/v2/user/dashboard", + "param": null, + "severity": "high" + }, + { + "class": "cors", + "path": "/graphql", + "param": null, + "severity": "high" + }, + { + "class": "exposure", + "path": "/.well-known/security.txt", + "param": null, + "severity": "info" + }, + { + "class": "excessive-exposure", + "path": "/api/v1/users/1", + "param": null, + "severity": "high" + } + ], + "out_of_scope": [ + "FL4", + "FL5" + ], + "location_flags": [ + { + "id": "FL2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 18.9, + "requests": 1971 + }, + "juice-shop": { + "expected_in_scope": 3, + "detected": [ + "JS1", + "JS2", + "JS3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "exposure", + "path": "/security.txt", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/.well-known/security.txt", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "JS4", + "JS5" + ], + "location_flags": [ + { + "id": "JS2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 15.8, + "requests": 1073 + }, + "log4shell": { + "expected_in_scope": 2, + "detected": [ + "LS1", + "LS2" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [ + { + "id": "LS1", + "flags": [ + "matched on class and path; the finding named no parameter (the answer key names 'X-Api-Version')" + ] + }, + { + "id": "LS2", + "flags": [ + "matched on class alone; the finding carried no location" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "mirage": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null + }, + "modsec": { + "expected_in_scope": 1, + "detected": [ + "WAF2" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "WAF1" + ], + "location_flags": [ + { + "id": "WAF2", + "flags": [ + "matched on class alone; the finding carried no location" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "mutillidae": { + "expected_in_scope": 6, + "detected": [ + "MU3", + "MU5" + ], + "missed": [ + "MU1", + "MU2", + "MU4", + "MU6" + ], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/phpinfo.php", + "param": null, + "severity": "low" + }, + { + "class": "no-rate-limit", + "path": "/documentation/mutillidae-test-scripts.txt", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/index.php", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/index.php", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "page", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "redirectPage", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "cmd", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "hosted_button_id", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "submit", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "string_to_repeat", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "times_to_repeat_string", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "username", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "UPLOAD_DIRECTORY", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "User-Agent", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "password", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "repeater-php-submit-button", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "Referer", + "severity": "high" + }, + { + "class": "cmdi", + "path": "/index.php", + "param": "message", + "severity": "critical" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "message", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "author", + "severity": "high" + }, + { + "class": "cve", + "path": "/", + "param": null, + "severity": "critical" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "info-disclosure", + "path": "/phpinfo.php", + "param": null, + "severity": "low" + } + ], + "out_of_scope": [ + "MU7", + "MU8" + ], + "location_flags": [ + { + "id": "MU5", + "flags": [ + "matched on class and path; the finding named no parameter (the answer key names 'username')", + "location mismatch: expected body, reported header" + ] + } + ], + "precision": 1.0, + "recall": 0.3333, + "f1": 0.5, + "seconds": 6112.1, + "requests": 16250 + }, + "openservices": { + "expected_in_scope": 7, + "detected": [ + "SV1", + "SV2", + "SV3", + "SV4", + "SV5", + "SV6", + "SV8" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "high" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "SV7" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "railsgoat": { + "expected_in_scope": 3, + "detected": [ + "RG2", + "RG3" + ], + "missed": [ + "RG1" + ], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/forgot_password", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/signup", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [ + "RG4", + "RG5" + ], + "location_flags": [ + { + "id": "RG2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 0.6667, + "f1": 0.8, + "seconds": 627.7, + "requests": 138 + }, + "vampi": { + "expected_in_scope": 4, + "detected": [ + "VP1", + "VP2", + "VP3", + "VP4" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/1/password", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/login", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/register", + "param": null, + "severity": "medium" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle60", + "param": null, + "severity": "high" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle60", + "param": null, + "severity": "critical" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle84", + "param": null, + "severity": "critical" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle84", + "param": null, + "severity": "high" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle94", + "param": null, + "severity": "critical" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle94", + "param": null, + "severity": "high" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 12.2, + "requests": 3071 + }, + "vulnerableapp": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_2", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_6", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_3", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_10", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_4", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_7", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_1", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_5", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_9", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_8", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.8, + "requests": 4407 + }, + "webgoat": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/WebGoat/login", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/WebGoat/register.mvc", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [ + "WG1", + "WG2", + "WG3", + "WG4" + ], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 11.9, + "requests": 297 + }, + "xssmaze": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "xss-reflected", + "path": "/nestedctx/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/ariaattr/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/shadow-dom/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/template/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xmlctx/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/numericcontext/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/misc-context/level5", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/jquery/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/email-template/level1", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/dialog/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/globalattr/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/ecommerce/level5", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/cspbypass/level3", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/markdown/level6", + "param": "title", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/bugbounty/level9", + "param": "email", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xmlctx/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/mixed-method/level4", + "param": "q", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/condreflect/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/specialtag/level3", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/cmspattern/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/racecon/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/attr-event/level6", + "param": "query", + "severity": "high" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.2, + "requests": 10896 + } + } +} diff --git a/truth/scorecards/2026-09-12-crossfyre.json b/truth/scorecards/2026-09-12-crossfyre.json new file mode 100644 index 0000000..de33da0 --- /dev/null +++ b/truth/scorecards/2026-09-12-crossfyre.json @@ -0,0 +1,1696 @@ +{ + "tool": "crossfyre", + "generated": "2026-09-12T10:14:06Z", + "totals": { + "expected": 48, + "detected": 48, + "missed": 0, + "false_positive": 0, + "unmatched": 194, + "out_of_scope": 24, + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 10721.5, + "requests": 89885, + "slowest_target": "railsgoat", + "slowest_seconds": 5577.9 + }, + "by_class": { + "bfla": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "bola": { + "expected": 4, + "detected": 4, + "recall": 1.0 + }, + "cmdi": { + "expected": 4, + "detected": 4, + "recall": 1.0 + }, + "cors": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "cve": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "default-creds": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "deserialization": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "dos": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "excessive-exposure": { + "expected": 5, + "detected": 5, + "recall": 1.0 + }, + "exposure": { + "expected": 5, + "detected": 5, + "recall": 1.0 + }, + "info-disclosure": { + "expected": 1, + "detected": 1, + "recall": 1.0 + }, + "lfi": { + "expected": 3, + "detected": 3, + "recall": 1.0 + }, + "misconfig": { + "expected": 6, + "detected": 6, + "recall": 1.0 + }, + "sqli": { + "expected": 7, + "detected": 7, + "recall": 1.0 + }, + "tech": { + "expected": 2, + "detected": 2, + "recall": 1.0 + }, + "xss-reflected": { + "expected": 3, + "detected": 3, + "recall": 1.0 + } + }, + "by_target": { + "androgoat": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [], + "out_of_scope": [ + "AG1", + "AG2", + "AG3", + "AG4" + ], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null + }, + "bwapp": { + "expected_in_scope": 5, + "detected": [ + "BW1", + "BW2", + "BW3", + "BW4", + "BW5" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/web.config", + "param": null, + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/login.php", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/htmli_get.php", + "param": "firstname", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xss_get.php", + "param": "lastname", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/password_change.php", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/reset.php", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [ + "BW6" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 126.9, + "requests": 8569 + }, + "crapi": { + "expected_in_scope": 3, + "detected": [ + "CR1", + "CR2", + "CR3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "bola", + "path": "/workshop/api/mechanic/mechanic_report", + "param": null, + "severity": "critical" + } + ], + "out_of_scope": [ + "CR4", + "CR5" + ], + "location_flags": [ + { + "id": "CR1", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 8.0, + "requests": 1291 + }, + "crawlground": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/reset", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/api/reveal", + "param": "url", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/api/page", + "param": "url", + "severity": "high" + }, + { + "class": "open-redirect", + "path": "/api/redirect", + "param": "url", + "severity": "medium" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.5, + "requests": 1576 + }, + "crawlmaze": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 9.2, + "requests": 1035 + }, + "dvga": { + "expected_in_scope": 7, + "detected": [ + "DG1", + "DG2", + "DG3", + "DG4", + "DG5", + "DG6", + "DG7" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/graphql", + "param": "query", + "severity": "medium" + }, + { + "class": "misconfig", + "path": "/graphql", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "dvwa": { + "expected_in_scope": 4, + "detected": [ + "DV1", + "DV2", + "DV3", + "DV4" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/vulnerabilities/brute", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/login.php", + "param": null, + "severity": "medium" + }, + { + "class": "sqli", + "path": "/vulnerabilities/brute", + "param": "username", + "severity": "high" + }, + { + "class": "sqli", + "path": "/vulnerabilities/sqli_blind", + "param": "id", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/vulnerabilities/csrf", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/csp", + "param": "include", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/xss_s", + "param": "txtName", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/vulnerabilities/xss_s", + "param": "mtxMessage", + "severity": "high" + }, + { + "class": "open-redirect", + "path": "/vulnerabilities/open_redirect/source/low.php", + "param": "redirect", + "severity": "medium" + }, + { + "class": "ssrf", + "path": "/vulnerabilities/fi", + "param": "page", + "severity": "high" + } + ], + "out_of_scope": [ + "DV5", + "DV6", + "DV7" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 424.7, + "requests": 14915 + }, + "faultline": { + "expected_in_scope": 3, + "detected": [ + "FL1", + "FL2", + "FL3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "cors", + "path": "/api/v1/users/1", + "param": null, + "severity": "high" + }, + { + "class": "cors", + "path": "/api/v2/user/dashboard", + "param": null, + "severity": "high" + }, + { + "class": "cors", + "path": "/graphql", + "param": null, + "severity": "high" + }, + { + "class": "exposure", + "path": "/.well-known/security.txt", + "param": null, + "severity": "info" + }, + { + "class": "excessive-exposure", + "path": "/api/v1/users/1", + "param": null, + "severity": "high" + } + ], + "out_of_scope": [ + "FL4", + "FL5" + ], + "location_flags": [ + { + "id": "FL2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 18.9, + "requests": 1971 + }, + "juice-shop": { + "expected_in_scope": 3, + "detected": [ + "JS1", + "JS2", + "JS3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "exposure", + "path": "/security.txt", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/.well-known/security.txt", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "JS4", + "JS5" + ], + "location_flags": [ + { + "id": "JS2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 15.8, + "requests": 1073 + }, + "log4shell": { + "expected_in_scope": 2, + "detected": [ + "LS1", + "LS2" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [ + { + "id": "LS1", + "flags": [ + "matched on class and path; the finding named no parameter (the answer key names 'X-Api-Version')" + ] + }, + { + "id": "LS2", + "flags": [ + "matched on class alone; the finding carried no location" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "mirage": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null + }, + "modsec": { + "expected_in_scope": 1, + "detected": [ + "WAF2" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "WAF1" + ], + "location_flags": [ + { + "id": "WAF2", + "flags": [ + "matched on class alone; the finding carried no location" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "mutillidae": { + "expected_in_scope": 6, + "detected": [ + "MU1", + "MU2", + "MU3", + "MU4", + "MU5", + "MU6" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "exposure", + "path": "/phpinfo.php", + "param": null, + "severity": "low" + }, + { + "class": "no-rate-limit", + "path": "/index.php", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/index.php", + "param": null, + "severity": "medium" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "page", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "password", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "redirectPage", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "UPLOAD_DIRECTORY", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "string_to_repeat", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/", + "param": "page", + "severity": "high" + }, + { + "class": "lfi", + "path": "/", + "param": "page", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "times_to_repeat_string", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "repeater-php-submit-button", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "User-Agent", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "Referer", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "username", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "password", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/", + "param": "User-Agent", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/", + "param": "Referer", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "csrf-token", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "blog_entry", + "severity": "high" + }, + { + "class": "cmdi", + "path": "/index.php", + "param": "message", + "severity": "critical" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "message", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "blog_entry", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "textbox", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "target_host", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "textfile", + "severity": "high" + }, + { + "class": "lfi", + "path": "/index.php", + "param": "textfile", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "background_color", + "severity": "high" + }, + { + "class": "exposure", + "path": "/webservices/soap/ws-dns-lookup.php", + "param": null, + "severity": "low" + }, + { + "class": "no-rate-limit", + "path": "/webservices/soap/ws-login.php", + "param": null, + "severity": "medium" + }, + { + "class": "exposure", + "path": "/webservices/soap/ws-login.php", + "param": null, + "severity": "low" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "search", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "password", + "severity": "high" + }, + { + "class": "sqli", + "path": "/index.php", + "param": "author", + "severity": "high" + }, + { + "class": "exposure", + "path": "/webservices/soap/ws-test-connectivity.php", + "param": null, + "severity": "low" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "select", + "severity": "high" + }, + { + "class": "exposure", + "path": "/webservices/soap/ws-echo.php", + "param": null, + "severity": "low" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "checkbox", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/index.php", + "param": "PathToDocument", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/webservices/rest/ws-login.php", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/webservices/soap/ws-login.php", + "param": null, + "severity": "medium" + }, + { + "class": "sqli", + "path": "/hints-page-wrapper.php", + "param": "level1HintIncludeFile", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/hints-page-wrapper.php", + "param": "level1HintIncludeFile", + "severity": "high" + }, + { + "class": "sqli", + "path": "/includes/pop-up-help-context-generator.php", + "param": "pagename", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/includes/pop-up-help-context-generator.php", + "param": "pagename", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/styling.php", + "param": "page-title", + "severity": "high" + }, + { + "class": "cve", + "path": "/", + "param": null, + "severity": "critical" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "info-disclosure", + "path": "/phpinfo.php", + "param": null, + "severity": "low" + } + ], + "out_of_scope": [ + "MU7", + "MU8" + ], + "location_flags": [ + { + "id": "MU4", + "flags": [ + "location mismatch: expected body, reported query" + ] + }, + { + "id": "MU5", + "flags": [ + "matched on class and path; the finding named no parameter (the answer key names 'username')", + "location mismatch: expected body, reported header" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 4490.5, + "requests": 19878 + }, + "openservices": { + "expected_in_scope": 7, + "detected": [ + "SV1", + "SV2", + "SV3", + "SV4", + "SV5", + "SV6", + "SV8" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "high" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + } + ], + "out_of_scope": [ + "SV7" + ], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0 + }, + "railsgoat": { + "expected_in_scope": 3, + "detected": [ + "RG1", + "RG2", + "RG3" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/forgot_password", + "param": null, + "severity": "medium" + }, + { + "class": "sqli", + "path": "/users/1", + "param": "user[email]", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/users/1", + "param": "user[first_name]", + "severity": "high" + }, + { + "class": "sqli", + "path": "/users/:user_id/messages", + "param": "utf8", + "severity": "high" + }, + { + "class": "no-rate-limit", + "path": "/password_resets", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/signup", + "param": null, + "severity": "medium" + }, + { + "class": "sqli", + "path": "/users/:user_id/messages", + "param": "message[creator_id]", + "severity": "high" + }, + { + "class": "sqli", + "path": "/users/1/messages", + "param": "utf8", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/dashboard/home", + "param": "font", + "severity": "high" + } + ], + "out_of_scope": [ + "RG4", + "RG5" + ], + "location_flags": [ + { + "id": "RG2", + "flags": [ + "location mismatch: expected path, reported endpoint" + ] + } + ], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 5577.9, + "requests": 20906 + }, + "vampi": { + "expected_in_scope": 4, + "detected": [ + "VP1", + "VP2", + "VP3", + "VP4" + ], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "tech", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/1/password", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/login", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/users/v1/register", + "param": null, + "severity": "medium" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle60", + "param": null, + "severity": "high" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle60", + "param": null, + "severity": "critical" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle84", + "param": null, + "severity": "critical" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle84", + "param": null, + "severity": "high" + }, + { + "class": "bola", + "path": "/books/v1/bookTitle94", + "param": null, + "severity": "critical" + }, + { + "class": "excessive-exposure", + "path": "/books/v1/bookTitle94", + "param": null, + "severity": "high" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": 1.0, + "recall": 1.0, + "f1": 1.0, + "seconds": 12.2, + "requests": 3071 + }, + "vulnerableapp": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_2", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_6", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_3", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_10", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_4", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_7", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_1", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_5", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_9", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/VulnerableApp/AuthenticationVulnerability/LEVEL_8", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.8, + "requests": 4407 + }, + "webgoat": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "no-rate-limit", + "path": "/WebGoat/login", + "param": null, + "severity": "medium" + }, + { + "class": "no-rate-limit", + "path": "/WebGoat/register.mvc", + "param": null, + "severity": "medium" + } + ], + "out_of_scope": [ + "WG1", + "WG2", + "WG3", + "WG4" + ], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 11.9, + "requests": 297 + }, + "xssmaze": { + "expected_in_scope": 0, + "detected": [], + "missed": [], + "false_positives": [], + "unmatched": [ + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "low" + }, + { + "class": "misconfig", + "path": "/", + "param": null, + "severity": "info" + }, + { + "class": "xss-reflected", + "path": "/nestedctx/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/ariaattr/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/shadow-dom/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/template/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xmlctx/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/numericcontext/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/misc-context/level5", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/jquery/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/email-template/level1", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/dialog/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/globalattr/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/ecommerce/level5", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/cspbypass/level3", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/markdown/level6", + "param": "title", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/bugbounty/level9", + "param": "email", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/xmlctx/level6", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/mixed-method/level4", + "param": "q", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/condreflect/level4", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/specialtag/level3", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/cmspattern/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/racecon/level2", + "param": "query", + "severity": "high" + }, + { + "class": "xss-reflected", + "path": "/attr-event/level6", + "param": "query", + "severity": "high" + } + ], + "out_of_scope": [], + "location_flags": [], + "precision": null, + "recall": null, + "f1": null, + "seconds": 8.2, + "requests": 10896 + } + } +}