| Scanner | Version | Vendor |
| JSky Free Edition | 1.0.0 | NoSec |
| Tested Against WAVSEP Version: |
| Detection Accuracy | Chart | ||||
| 38.24% Detection Rate 20.00% False Positives | (52/136) (2/10) |
| Response Type | Input Vector | Detection Rate | Details |
| Errorneous 500 Responses | HTTP GET (Query String Parameters) | 20 out of 20 | Cases Detected: 1(1st&2nd)-19 |
| Errorneous 500 Responses | HTTP POST (Body Parameters) | 0 out of 20 | POST values are not covered by this tool |
| Errorneous 200 Responses | HTTP GET (Query String Parameters) | 20 out of 20 | Cases Detected: 1(1st&2nd)-19 |
| Errorneous 200 Responses | HTTP POST (Body Parameters) | 0 out of 20 | POST values are not covered by this tool |
| Valid 200 Responses | HTTP GET (Query String Parameters) | 9 out of 20 | Cases Detected: 6-8,11-13,16-18 Cases Missed: 1-5,9,10,14,15,19 |
| Valid 200 Responses | HTTP POST (Body Parameters) | 0 out of 20 | POST values are not covered by this tool |
| Identical 200 Responses | HTTP GET (Query String Parameters) | 3 out of 8 | Cases Detected: 1-3 Cases Missed: 5-8 |
| Identical 200 Responses | HTTP POST (Body Parameters) | 0 out of 8 | POST values are not covered by this tool |
| False Positive SQLi Test Cases | HTTP GET (Query String Parameters) | 2 out of 10 | 7,8 |
| Detection Accuracy | Chart | ||||
| 12.12% Detection Rate 42.86% False Positives | (8/66) (3/7) |
| Response Type | Input Vector | Detection Rate | Details |
| Reflected XSS | HTTP GET (Query String Parameters) | 8 out of 33 | Cases Detected: 1-5, 30(1st&2nd),32 Cases Missed: 6-29,31 |
| Reflected XSS | HTTP POST (Body Parameters) | 0 out of 33 | POST values are not covered by this tool |
| False Positive RXSS Test Cases | HTTP GET (Query String Parameters) | 3 out of 7 | 1,2,6 |
| I enabled all the XSS, SQLi and LFI/RFI plugins, marked the ?URLs are case sensitive? checkbox in the scan wizard and did not configure exclusions (the entire site is public).
The scan was executed in front of the following URLs: http://192.168.1.100:8080/wavsep/index-xss.jsp http://192.168.1.100:8080/wavsep/index-sql.jsp http://192.168.1.100:8080/wavsep/index-false.jsp The tool managed to crawl all the URLs, detected vulnerabilities in GET parameters, but did not detect vulnerabilities in POST parameters. |