XSSploit0.5SCRT Information Security

Tested Against WAVSEP Version:

The Reflected XSS Detection Accuracy of the Scanner:
Detection AccuracyChart
21.21% Detection Rate
85.71% False Positives
Response TypeInput VectorDetection RateDetails
Reflected XSSHTTP GET (Query String Parameters)7 out of 33Incomplete Results. Cases Detected: 1-7 Cases Missed: 8-32
Reflected XSSHTTP POST (Body Parameters)7 out of 33Incomplete Results. Cases Detected: 1-7 Cases Missed: 8-32
False Positive RXSS Test CasesHTTP GET (Query String Parameters)6 out of 71-4,6,7

WAVSEP Scan Log:
I tried installing the scanner in multiple operating systems (ubuntu 9, fedora 11, windows xp), but for some reason, whenever I started executing it on an application, the spider would not work ( At the last deadline, a few hours before releasing the article, I decided to try again. I uninstalled every python installation an module from my windows XP vm, deleted any trace of the word ?python? from the registry, and installed python 2.5, pyOpenSSL, wxPython and pyCurl (the site claims that only python 2.5 and wxPython are required, but I got carried out). In addition, I defined burp proxy to forward traffic from port 80 to port 8080, and crawled & scanned the following URLs:
This time, the spider feature that did work, and so did the scanner? So it seems like being stubborn has some advantages after all?
The scanner successfully crawled all URLs and submitted all the forms, but when I started analyzing, various exceptions were presented in the tool?s console (particularly on page 32), and the scan was never truly ?completed? (except in the false positive URLs); it was however, possible to view the results that were already discovered by the tool.
I repeated the process with various URLs, with identical results and problems.

Copyright © 2010-2016 by Shay Chen. All rights reserved.
Click here to learn how this information may be published or reused.