Benchmarks
Public benchmark results.
Raw results are linked at the foot of the page.
Results
| Benchmark | Result |
|---|---|
| WAVSEP — positive cases | 1 210 / 1 210 |
| WAVSEP — negative cases | 38 / 44 silent |
| Google Security Crawl Maze | 85 / 85 scored · 6 excluded |
| SekuScan crawler traps ours | 10 / 10 |
| OWASP VulnerableApp | 102 / 154 · 66.2% |
WAVSEP
zaproxy/wavsep, the ZAP team’s fork of sectooladdict/wavsep
Positive cases
| Category | Detected |
|---|---|
| LFI | 816 / 816 |
| SQLi | 135 / 135 |
| RFI | 108 / 108 |
| Reflected XSS | 91 / 91 |
| Open redirect | 60 / 60 |
| Total | 1 210 / 1 210 |
Negative cases
| Result | Cases |
|---|---|
| Stayed quiet | 38 |
| Outside supported scope | 4 |
| Answer key disputed | 1 |
| False positive | 1 |
| Total | 44 |
- 11 further cases are marked OBSOLETE in the corpus and were not run.
- The false positive was an LFI look-alike, reported as
traversal. - The disputed case: the target fetched a URL we supplied and our callback fired, which is SSRF. WAVSEP scores that case for remote file inclusion, which does not occur. It is counted against us anyway.
71,966 requests · ≈ 4 h*
Google Security Crawl Maze
85 / 85 scored cases found.
- 6 cases excluded: the deployment does not serve them (Angular, Polymer and React framework routes). Excluded from the denominator, not counted as misses.
230 requests · ≈ 1 min*
OWASP VulnerableApp
102 / 154 · 66.2%
- 52 expected findings missed.
- Graded by the project’s own
/scanner/benchmarkharness. - 206 findings sent, 101 unmatched by the harness.
graded by the corpus harness*
Selected vulhub targets
Selected targets only; no aggregate score.
| CVE / issue | Software | Check |
|---|---|---|
| CVE-2018-7600 “Drupalgeddon2” | Drupal | injection/drupal_render |
| CVE-2021-22205 | GitLab (ExifTool) | injection/gitlab_exiftool |
| S2-045, S2-059, S2-061 | Apache Struts 2 | injection/struts_ognl |
| CVE-2024-27956 | WordPress Automatic | injection/wp_automatic_sqli |
| CVE-2026-63030 | WordPress (batch) | injection/wp_batch_sqli |
| CVE-2024-6624 | WordPress JSON API User | auth/wp_json_api_user_privesc |
| CVE-2020-25213 | WP File Manager | upload/unauth_connector |
| Magento 2.2 SQL injection | Magento | injection/sqli |
Raw results
* Every run above was measured on 2026-09-09
against engine a2b55e7 with a clean tree; each JSON below
carries its own provenance stamp, written by the harness rather than
typed here. Durations marked ≈ are derived, not recorded:
the harness did not time these runs, so the figure is the request count
over the median throughput of 4.8 operations per second measured across
47 other runs. The harness records wall-clock time from now on, and
these will be replaced by measured values on the next run.