| Scanner | Version | Vendor |
| Web Injection Scanner (WIS) | 0.4 | netXeyes |
| Tested Against WAVSEP Version: |
| Detection Accuracy | Chart | ||||
| 0.00% Detection Rate 0.00% False Positives | (0/136) (0/10) |
| Response Type | Input Vector | Detection Rate | Details |
| Errorneous 500 Responses | HTTP GET (Query String Parameters) | 0 out of 20 | Execution Failed. |
| Errorneous 500 Responses | HTTP POST (Body Parameters) | 0 out of 20 | Execution Failed. |
| Errorneous 200 Responses | HTTP GET (Query String Parameters) | 0 out of 20 | Execution Failed. |
| Errorneous 200 Responses | HTTP POST (Body Parameters) | 0 out of 20 | Execution Failed. |
| Valid 200 Responses | HTTP GET (Query String Parameters) | 0 out of 20 | Execution Failed. |
| Valid 200 Responses | HTTP POST (Body Parameters) | 0 out of 20 | Execution Failed. |
| Identical 200 Responses | HTTP GET (Query String Parameters) | 0 out of 8 | Execution Failed. |
| Identical 200 Responses | HTTP POST (Body Parameters) | 0 out of 8 | Execution Failed. |
| False Positive SQLi Test Cases | HTTP GET (Query String Parameters) | 0 out of 10 | Execution Failed. |
| When I attempted to use this tool against a vulnerable .Net application, I only managed to cause it to crawl using the following command on a full URL (no vulnerabilities were identified):
wis http://192.168.52.129/aspx/login.aspx In the current benchmark the tool seemed to work, but failed to crawl the application or locate any exposures. I tried a couple more options, but still got the same results. Among the options attempted: wis http://192.168.46.2:8080/wavsep/index-sql.jsp wis http://192.168.46.2:8080/wavsep/index-false.jsp wis http://192.168.46.2:8080/wavsep/ (after copying the content of index-sql.jsp into index.jsp) wis http://192.168.46.2:8080/wavsep wis ?http://192.168.46.2:8080/wavsep/? wis ?http://192.168.46.2:8080/wavsep/index-sql.jsp? wis http://192.168.46.2:8080/wavsep/SInjection-Detection-Evaluation-GET-500Error/Case1-InjectionInLogin-String-LoginBypass-WithErrors.jsp?username=textvalue&password=textvalue2 wis ?http://192.168.46.2:8080/wavsep/SInjection-Detection-Evaluation-GET-500Error/Case1-InjectionInLogin-String-LoginBypass-WithErrors.jsp?username=textvalue&password=textvalue2? |