Detailed Scan Results - ParosPro - WAVSEP Benchmark 2014/2016

Logo	Scanner	Version	Vendor
	ParosPro	1.9.12	MileSCAN Technologies

Tested Against WAVSEP Version:

1.2

The SQL Injection Detection Accuracy of the Scanner:

Detection Accuracy

Chart

93.38% Detection Rate
0.00% False Positives

(127/136)
(0/10)

Response Type	Input Vector	Detection Rate	Details
Errorneous 500 Responses	HTTP GET (Query String Parameters)	20 out of 20	Cases Detected: 1(1st&2nd)-19
Errorneous 500 Responses	HTTP POST (Body Parameters)	20 out of 20	Cases Detected: 1(1st&2nd)-19
Errorneous 200 Responses	HTTP GET (Query String Parameters)	20 out of 20	Cases Detected: 1(1st&2nd)-19
Errorneous 200 Responses	HTTP POST (Body Parameters)	20 out of 20	Cases Detected: 1(1st&2nd)-19
Valid 200 Responses	HTTP GET (Query String Parameters)	19 out of 20	Cases Detected: 1(1st&2nd)-13,15-19 Cases Missed: 14
Valid 200 Responses	HTTP POST (Body Parameters)	19 out of 20	Cases Detected: 1(1st&2nd)-13,15-19 Cases Missed: 14
Identical 200 Responses	HTTP GET (Query String Parameters)	5 out of 8	Cases Detected: 1-3,5,8 Cases Missed: 4,6,7
Identical 200 Responses	HTTP POST (Body Parameters)	4 out of 8	Cases Detected: 1-3,5 Cases Missed: 4,6-8
False Positive SQLi Test Cases	HTTP GET (Query String Parameters)	0 out of 10	None

The Reflected XSS Detection Accuracy of the Scanner:

Detection Accuracy

Chart

98.48% Detection Rate
0.00% False Positives

(65/66)
(0/7)

Response Type	Input Vector	Detection Rate	Details
Reflected XSS	HTTP GET (Query String Parameters)	32 out of 33	Cases Detected: 1-30(1st&2nd),31 Cases Missed: 32
Reflected XSS	HTTP POST (Body Parameters)	33 out of 33	Cases Detected: 1-30(1st&2nd),31,32
False Positive RXSS Test Cases	HTTP GET (Query String Parameters)	0 out of 7	None

The Local File Inclusion Detection Accuracy of the Scanner:

Detection Accuracy

Chart

12.75% Detection Rate
37.50% False Positives

(104/816)
(3/8)

Response Type	Input Vector	Detection Rate	Details
Errorneous 500 Responses	HTTP GET (Query String Parameters)	18 out of 68	Detected: 15,16,17,18,25,26,31,32,41,42,46,49,50,57,58,62,65,66
Errorneous 500 Responses	HTTP POST (Body Parameters)	0 out of 68	None
Errorneous 200 Responses	HTTP GET (Query String Parameters)	18 out of 68	Detected: 15,16,17,18,25,26,31,32,41,42,46,49,50,57,58,62,65,66
Errorneous 200 Responses	HTTP POST (Body Parameters)	0 out of 68	None
Valid 200 Responses	HTTP GET (Query String Parameters)	18 out of 68	Detected: 15,16,17,18,25,26,31,32,41,42,46,49,50,57,58,62,65,66
Valid 200 Responses	HTTP POST (Body Parameters)	0 out of 68	None
Identical 200 Responses	HTTP GET (Query String Parameters)	18 out of 68	Detected: 15,16,17,18,25,26,31,32,41,42,46,49,50,57,58,62,65,66
Identical 200 Responses	HTTP POST (Body Parameters)	0 out of 68	None
Redirect (302) Responses	HTTP GET (Query String Parameters)	14 out of 68	Detected: 15,16,25,31,41,42,46,49,50,57,58,62,65,66
Redirect (302) Responses	HTTP POST (Body Parameters)	0 out of 68	None
Erroneous 404 Responses	HTTP GET (Query String Parameters)	18 out of 68	Detected: 15,16,17,18,25,26,31,32,41,42,46,49,50,57,58,62,65,66
Erroneous 404 Responses	HTTP POST (Body Parameters)	0 out of 68	None
False Positive Lfi Test Cases	HTTP GET (Query String Parameters)	3 out of 8	1,5,6

WAVSEP Scan Log:

The scans were executed with the following plug-in groups enabled: Miscellaneous, Information Gathering, Injection, Client-Browser, Cross Site Scripting.
I didn't rescan the XSS/SQLi pages since the version did not change, and neither did the pages in wavsep, but I did try the File Path Manipulation plugin against the various RFI/LFI directories.
Each directory was scanned separately.

The WIVET Score of the Scanner:

Detection Accuracy

Chart

19.0% Detection Rate

WIVET Scan Log:

Initially, I didn't manage to make ParosPro scan WIVET properly, but after investigating the issue, I found out that the menu page in WIVET presented relative links that not all the scanners managed to follow (1-21.php), so I duplicated those links with a prefix that will enable the various scanners to track them ("pages/"), and that seemed to enable parospro (and other scanners) to get *some* result in WIVET (after using Fiddler with preconfigured valid session filter as an upstream proxy).
As usual, prior to the scan, I took the following steps:
Initialized WIVET's session, selected the a policy with spider without any actual tests (and verified the results with a policy that includes only XSS), limited the parallel connection threads to 1 single thread (but verified with more), defined a valid session identifier in fiddler (which was defined as an upstream proxy) and excluded the logout URL (100.php) by manually removing it from WIVET's menu.
I verified the results twice, and they came out the same.