{ "aggregates": { "industry_security_controls_benchmark": { "check_pass_rate": 1.0, "checks_per_run": 11, "failed_checks": [], "lab": "industry_security_controls_benchmark", "run_count": 3, "tool_timed_ms": { "median": 1738.89, "p95": 1751.04 }, "wall_ms": { "max": 2198.9, "mean": 2171.21, "median": 2162.66, "min": 2152.07, "p95": 2198.9, "stdev": 20.05 } }, "web_attack_benchmark": { "check_pass_rate": 1.0, "checks_per_run": 17, "failed_checks": [], "lab": "web_attack_benchmark", "run_count": 3, "tool_timed_ms": { "median": 260.96, "p95": 265.31 }, "wall_ms": { "max": 737.25, "mean": 734.74, "median": 735.46, "min": 731.51, "p95": 737.25, "stdev": 2.4 } }, "websocket_attack_benchmark": { "check_pass_rate": 1.0, "checks_per_run": 7, "failed_checks": [], "lab": "websocket_attack_benchmark", "run_count": 3, "tool_timed_ms": { "median": 1329.49, "p95": 1362.19 }, "wall_ms": { "max": 1810.42, "mean": 1796.73, "median": 1800.94, "min": 1778.83, "p95": 1810.42, "stdev": 13.24 } } }, "configuration": { "iterations": 3, "labs": [ "web_attack_benchmark", "websocket_attack_benchmark", "industry_security_controls_benchmark" ], "thresholds": "benchmarks/thresholds.json", "warmup": 1 }, "environment": { "ci": false, "implementation": "CPython", "machine": "AMD64", "platform": "Windows", "platform_release": "11", "python": "3.12.13", "revision": "" }, "evaluation": { "failures": [], "labs": { "industry_security_controls_benchmark": { "checks": { "maximum_failed_checks": true, "maximum_p95_wall_time": true, "minimum_check_pass_rate": true, "minimum_checks": true, "minimum_runs": true }, "passed": true, "rules": { "max_failed_checks": 0, "max_p95_wall_ms": 15000, "min_check_pass_rate": 1.0, "min_checks": 11, "min_runs": 1 } }, "web_attack_benchmark": { "checks": { "maximum_failed_checks": true, "maximum_p95_wall_time": true, "minimum_check_pass_rate": true, "minimum_checks": true, "minimum_runs": true }, "passed": true, "rules": { "max_failed_checks": 0, "max_p95_wall_ms": 10000, "min_check_pass_rate": 1.0, "min_checks": 17, "min_runs": 1 } }, "websocket_attack_benchmark": { "checks": { "maximum_failed_checks": true, "maximum_p95_wall_time": true, "minimum_check_pass_rate": true, "minimum_checks": true, "minimum_runs": true }, "passed": true, "rules": { "max_failed_checks": 0, "max_p95_wall_ms": 10000, "min_check_pass_rate": 1.0, "min_checks": 7, "min_runs": 1 } } }, "passed": true }, "generated_at": "2026-07-19T03:49:07.027581+00:00", "runs": { "industry_security_controls_benchmark": [ { "iteration": 1, "result": { "artifacts": { "http": { "hardened_bola_status": "403", "hardened_cors_risk": "Safe", "hardened_header_findings": 0, "hardened_race": { "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "recommended_severity": "info", "success_count": 1, "suspicious_race_window": false, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_redirect_findings": 0, "hardened_sensitive_findings": 0, "hardened_ssrf_findings": 0, "vulnerable_bola_status": "200", "vulnerable_cors_risk": "High", "vulnerable_header_findings": 3, "vulnerable_race": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_redirect_findings": 14, "vulnerable_sensitive_findings": 4, "vulnerable_ssrf_findings": 16 }, "websocket": { "hardened_origins_accepted": 0, "hardened_race": { "accepted_count": 1, "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "info", "sent_count": 0, "suspicious_race_window": false, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_subscription": { "accepted_mutation_count": 0, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 0, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 0, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "info", "suspicious_attempt_count": 0 }, "vulnerable_origins_accepted": 2, "vulnerable_race": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_subscription": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } } }, "checks": { "bola_distinguishes_missing_and_enforced_object_authorization": true, "cors_distinguishes_reflection_and_allowlist": true, "csrf_replay_distinguishes_unprotected_and_protected_actions": true, "headers_distinguish_vulnerable_and_hardened_profiles": true, "http_race_distinguishes_duplicate_acceptance_and_idempotency": true, "redirect_distinguishes_open_and_local_only": true, "sensitive_data_distinguishes_leak_and_redaction": true, "ssrf_distinguishes_metadata_access_and_egress_filter": true, "ws_origin_distinguishes_open_and_allowlisted_handshakes": true, "ws_race_distinguishes_duplicate_acceptance_and_idempotency": true, "ws_subscription_distinguishes_tenant_hop_and_enforcement": true }, "lab": "industry_security_controls_benchmark", "summary": { "checks_passed": 11, "checks_total": 11, "paired_controls": 11, "timings_ms": { "hardened_bola": 1.52, "hardened_cors": 8.51, "hardened_csrf": 1.68, "hardened_headers": 1.35, "hardened_http_race": 61.54, "hardened_redirect": 32.67, "hardened_sensitive_data": 1.24, "hardened_ssrf": 45.52, "hardened_ws_origin": 3.37, "hardened_ws_race": 402.74, "hardened_ws_subscription": 312.01, "vulnerable_bola": 1.66, "vulnerable_cors": 8.68, "vulnerable_csrf": 1.44, "vulnerable_headers": 1.65, "vulnerable_http_race": 64.55, "vulnerable_redirect": 29.15, "vulnerable_sensitive_data": 1.31, "vulnerable_ssrf": 45.64, "vulnerable_ws_origin": 4.97, "vulnerable_ws_race": 408.17, "vulnerable_ws_subscription": 311.67 }, "total_timed_ms": 1751.04 } }, "wall_ms": 2162.66 }, { "iteration": 2, "result": { "artifacts": { "http": { "hardened_bola_status": "403", "hardened_cors_risk": "Safe", "hardened_header_findings": 0, "hardened_race": { "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "recommended_severity": "info", "success_count": 1, "suspicious_race_window": false, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_redirect_findings": 0, "hardened_sensitive_findings": 0, "hardened_ssrf_findings": 0, "vulnerable_bola_status": "200", "vulnerable_cors_risk": "High", "vulnerable_header_findings": 3, "vulnerable_race": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_redirect_findings": 14, "vulnerable_sensitive_findings": 4, "vulnerable_ssrf_findings": 16 }, "websocket": { "hardened_origins_accepted": 0, "hardened_race": { "accepted_count": 1, "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "info", "sent_count": 0, "suspicious_race_window": false, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_subscription": { "accepted_mutation_count": 0, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 0, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 0, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "info", "suspicious_attempt_count": 0 }, "vulnerable_origins_accepted": 2, "vulnerable_race": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_subscription": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } } }, "checks": { "bola_distinguishes_missing_and_enforced_object_authorization": true, "cors_distinguishes_reflection_and_allowlist": true, "csrf_replay_distinguishes_unprotected_and_protected_actions": true, "headers_distinguish_vulnerable_and_hardened_profiles": true, "http_race_distinguishes_duplicate_acceptance_and_idempotency": true, "redirect_distinguishes_open_and_local_only": true, "sensitive_data_distinguishes_leak_and_redaction": true, "ssrf_distinguishes_metadata_access_and_egress_filter": true, "ws_origin_distinguishes_open_and_allowlisted_handshakes": true, "ws_race_distinguishes_duplicate_acceptance_and_idempotency": true, "ws_subscription_distinguishes_tenant_hop_and_enforcement": true }, "lab": "industry_security_controls_benchmark", "summary": { "checks_passed": 11, "checks_total": 11, "paired_controls": 11, "timings_ms": { "hardened_bola": 1.43, "hardened_cors": 7.65, "hardened_csrf": 1.46, "hardened_headers": 1.61, "hardened_http_race": 63.47, "hardened_redirect": 28.9, "hardened_sensitive_data": 1.33, "hardened_ssrf": 40.8, "hardened_ws_origin": 3.24, "hardened_ws_race": 388.36, "hardened_ws_subscription": 314.43, "vulnerable_bola": 1.52, "vulnerable_cors": 8.42, "vulnerable_csrf": 1.71, "vulnerable_headers": 1.76, "vulnerable_http_race": 60.96, "vulnerable_redirect": 26.19, "vulnerable_sensitive_data": 1.37, "vulnerable_ssrf": 65.07, "vulnerable_ws_origin": 4.47, "vulnerable_ws_race": 389.96, "vulnerable_ws_subscription": 310.25 }, "total_timed_ms": 1724.36 } }, "wall_ms": 2152.07 }, { "iteration": 3, "result": { "artifacts": { "http": { "hardened_bola_status": "403", "hardened_cors_risk": "Safe", "hardened_header_findings": 0, "hardened_race": { "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "recommended_severity": "info", "success_count": 1, "suspicious_race_window": false, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_redirect_findings": 0, "hardened_sensitive_findings": 0, "hardened_ssrf_findings": 0, "vulnerable_bola_status": "200", "vulnerable_cors_risk": "High", "vulnerable_header_findings": 3, "vulnerable_race": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_redirect_findings": 14, "vulnerable_sensitive_findings": 4, "vulnerable_ssrf_findings": 16 }, "websocket": { "hardened_origins_accepted": 0, "hardened_race": { "accepted_count": 1, "attempt_count": 6, "behavior_group_count": 2, "concurrency": 3, "duplicate_success_observed": false, "error_count": 0, "later_wave_success_observed": false, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "info", "sent_count": 0, "suspicious_race_window": false, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 1, "wave_2": 0 } }, "hardened_subscription": { "accepted_mutation_count": 0, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 0, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 0, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "info", "suspicious_attempt_count": 0 }, "vulnerable_origins_accepted": 2, "vulnerable_race": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "vulnerable_subscription": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } } }, "checks": { "bola_distinguishes_missing_and_enforced_object_authorization": true, "cors_distinguishes_reflection_and_allowlist": true, "csrf_replay_distinguishes_unprotected_and_protected_actions": true, "headers_distinguish_vulnerable_and_hardened_profiles": true, "http_race_distinguishes_duplicate_acceptance_and_idempotency": true, "redirect_distinguishes_open_and_local_only": true, "sensitive_data_distinguishes_leak_and_redaction": true, "ssrf_distinguishes_metadata_access_and_egress_filter": true, "ws_origin_distinguishes_open_and_allowlisted_handshakes": true, "ws_race_distinguishes_duplicate_acceptance_and_idempotency": true, "ws_subscription_distinguishes_tenant_hop_and_enforcement": true }, "lab": "industry_security_controls_benchmark", "summary": { "checks_passed": 11, "checks_total": 11, "paired_controls": 11, "timings_ms": { "hardened_bola": 1.97, "hardened_cors": 11.94, "hardened_csrf": 1.91, "hardened_headers": 1.45, "hardened_http_race": 63.78, "hardened_redirect": 32.72, "hardened_sensitive_data": 2.07, "hardened_ssrf": 47.15, "hardened_ws_origin": 3.24, "hardened_ws_race": 391.61, "hardened_ws_subscription": 313.37, "vulnerable_bola": 2.29, "vulnerable_cors": 10.76, "vulnerable_csrf": 1.76, "vulnerable_headers": 1.86, "vulnerable_http_race": 66.7, "vulnerable_redirect": 34.69, "vulnerable_sensitive_data": 2.09, "vulnerable_ssrf": 45.09, "vulnerable_ws_origin": 4.05, "vulnerable_ws_race": 389.81, "vulnerable_ws_subscription": 308.58 }, "total_timed_ms": 1738.89 } }, "wall_ms": 2198.9 } ], "web_attack_benchmark": [ { "iteration": 1, "result": { "artifacts": { "cors_findings": 5, "crawler_stats": { "api_endpoints_found": 1, "elapsed_seconds": 0.01, "errors_count": 0, "forms_found": 2, "pages_crawled": 4, "scripts_found": 1, "sensitive_files_found": 3 }, "directory_findings": 1, "fuzzer_findings": 2, "http_authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "77d433e9bf55439c", "error": "", "http_status": "200", "identities": [ { "flow_id": null, "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 40, "response_preview": "{\"ok\":true,\"role\":\"admin\",\"scope\":\"all\"}", "status": "received" }, { "behavior_hash": "90a5f826c68fa07c", "error": "", "http_status": "403", "identities": [ { "flow_id": null, "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 46, "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}", "status": "received" } ], "http_status_breakdown": { "200": 1, "403": 1 }, "identity_count": 2, "interesting_identities": [ { "http_status": "403", "identity_alias": "user", "identity_id": "benchmark-user", "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}" } ], "recommended_severity": "high", "status_breakdown": { "received": 2 } }, "http_race_summary": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "prototype_findings": 17, "redirect_findings": 15, "sensitive_types": [ "AWS Access Key", "Email Address", "Internal IPv4" ], "ssrf_findings": 5, "technologies": [ "Express.js", "WordPress", "jQuery" ], "waf_products": [ "ModSecurity" ] }, "checks": { "cors_tester_detects_origin_reflection": true, "crawler_discovers_pages_and_sensitive_files": true, "csrf_forge_replays_unprotected_action": true, "directory_scanner_finds_admin": true, "fingerprinter_detects_stack": true, "fuzzer_detects_reflection": true, "header_analyzer_handles_http_hsts": true, "http_authz_diff_detects_role_change": true, "http_race_detects_duplicate_success": true, "http_replay_uses_identity": true, "port_scanner_finds_lab_port": true, "prototype_pollution_detects_canary": true, "redirect_scanner_detects_external_redirect": true, "sensitive_finder_uses_auth_headers": true, "ssrf_long_page_control_has_no_false_positive": true, "ssrf_prober_uses_auth_and_finds_metadata": true, "waf_detector_identifies_modsecurity": true }, "lab": "web_attack_benchmark", "summary": { "checks_passed": 17, "checks_total": 17, "payloads_exercised": 116, "timings_ms": { "cors_tester": 6.09, "crawler": 10.53, "csrf_forge": 1.56, "directory_scanner": 6.92, "fuzzer": 4.09, "header_analyzer": 1.08, "http_authz_diff": 2.43, "http_race": 86.99, "http_replay": 1.24, "port_scanner": 0.6, "prototype_pollution": 20.82, "redirect_scanner": 21.86, "sensitive_finder": 1.14, "ssrf_false_positive_control": 38.38, "ssrf_prober": 37.63, "tech_fingerprint": 1.43, "waf_detector": 6.46 }, "total_timed_ms": 249.25 } }, "wall_ms": 731.51 }, { "iteration": 2, "result": { "artifacts": { "cors_findings": 5, "crawler_stats": { "api_endpoints_found": 1, "elapsed_seconds": 0.01, "errors_count": 0, "forms_found": 2, "pages_crawled": 4, "scripts_found": 1, "sensitive_files_found": 3 }, "directory_findings": 1, "fuzzer_findings": 2, "http_authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "77d433e9bf55439c", "error": "", "http_status": "200", "identities": [ { "flow_id": null, "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 40, "response_preview": "{\"ok\":true,\"role\":\"admin\",\"scope\":\"all\"}", "status": "received" }, { "behavior_hash": "90a5f826c68fa07c", "error": "", "http_status": "403", "identities": [ { "flow_id": null, "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 46, "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}", "status": "received" } ], "http_status_breakdown": { "200": 1, "403": 1 }, "identity_count": 2, "interesting_identities": [ { "http_status": "403", "identity_alias": "user", "identity_id": "benchmark-user", "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}" } ], "recommended_severity": "high", "status_breakdown": { "received": 2 } }, "http_race_summary": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "prototype_findings": 17, "redirect_findings": 15, "sensitive_types": [ "AWS Access Key", "Email Address", "Internal IPv4" ], "ssrf_findings": 5, "technologies": [ "Express.js", "WordPress", "jQuery" ], "waf_products": [ "ModSecurity" ] }, "checks": { "cors_tester_detects_origin_reflection": true, "crawler_discovers_pages_and_sensitive_files": true, "csrf_forge_replays_unprotected_action": true, "directory_scanner_finds_admin": true, "fingerprinter_detects_stack": true, "fuzzer_detects_reflection": true, "header_analyzer_handles_http_hsts": true, "http_authz_diff_detects_role_change": true, "http_race_detects_duplicate_success": true, "http_replay_uses_identity": true, "port_scanner_finds_lab_port": true, "prototype_pollution_detects_canary": true, "redirect_scanner_detects_external_redirect": true, "sensitive_finder_uses_auth_headers": true, "ssrf_long_page_control_has_no_false_positive": true, "ssrf_prober_uses_auth_and_finds_metadata": true, "waf_detector_identifies_modsecurity": true }, "lab": "web_attack_benchmark", "summary": { "checks_passed": 17, "checks_total": 17, "payloads_exercised": 116, "timings_ms": { "cors_tester": 6.91, "crawler": 12.84, "csrf_forge": 1.48, "directory_scanner": 9.0, "fuzzer": 4.28, "header_analyzer": 1.24, "http_authz_diff": 3.11, "http_race": 72.21, "http_replay": 1.3, "port_scanner": 0.6, "prototype_pollution": 23.15, "redirect_scanner": 29.0, "sensitive_finder": 1.23, "ssrf_false_positive_control": 45.23, "ssrf_prober": 45.35, "tech_fingerprint": 1.41, "waf_detector": 6.97 }, "total_timed_ms": 265.31 } }, "wall_ms": 737.25 }, { "iteration": 3, "result": { "artifacts": { "cors_findings": 5, "crawler_stats": { "api_endpoints_found": 1, "elapsed_seconds": 0.01, "errors_count": 0, "forms_found": 2, "pages_crawled": 4, "scripts_found": 1, "sensitive_files_found": 3 }, "directory_findings": 1, "fuzzer_findings": 2, "http_authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "77d433e9bf55439c", "error": "", "http_status": "200", "identities": [ { "flow_id": null, "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 40, "response_preview": "{\"ok\":true,\"role\":\"admin\",\"scope\":\"all\"}", "status": "received" }, { "behavior_hash": "90a5f826c68fa07c", "error": "", "http_status": "403", "identities": [ { "flow_id": null, "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 46, "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}", "status": "received" } ], "http_status_breakdown": { "200": 1, "403": 1 }, "identity_count": 2, "interesting_identities": [ { "http_status": "403", "identity_alias": "user", "identity_id": "benchmark-user", "response_preview": "{\"ok\":false,\"error\":\"forbidden\",\"role\":\"user\"}" } ], "recommended_severity": "high", "status_breakdown": { "received": 2 } }, "http_race_summary": { "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "recommended_severity": "high", "success_count": 6, "suspicious_race_window": true, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "prototype_findings": 17, "redirect_findings": 15, "sensitive_types": [ "AWS Access Key", "Email Address", "Internal IPv4" ], "ssrf_findings": 5, "technologies": [ "Express.js", "WordPress", "jQuery" ], "waf_products": [ "ModSecurity" ] }, "checks": { "cors_tester_detects_origin_reflection": true, "crawler_discovers_pages_and_sensitive_files": true, "csrf_forge_replays_unprotected_action": true, "directory_scanner_finds_admin": true, "fingerprinter_detects_stack": true, "fuzzer_detects_reflection": true, "header_analyzer_handles_http_hsts": true, "http_authz_diff_detects_role_change": true, "http_race_detects_duplicate_success": true, "http_replay_uses_identity": true, "port_scanner_finds_lab_port": true, "prototype_pollution_detects_canary": true, "redirect_scanner_detects_external_redirect": true, "sensitive_finder_uses_auth_headers": true, "ssrf_long_page_control_has_no_false_positive": true, "ssrf_prober_uses_auth_and_finds_metadata": true, "waf_detector_identifies_modsecurity": true }, "lab": "web_attack_benchmark", "summary": { "checks_passed": 17, "checks_total": 17, "payloads_exercised": 116, "timings_ms": { "cors_tester": 6.81, "crawler": 11.21, "csrf_forge": 1.31, "directory_scanner": 7.34, "fuzzer": 4.26, "header_analyzer": 1.16, "http_authz_diff": 2.5, "http_race": 76.17, "http_replay": 1.43, "port_scanner": 0.72, "prototype_pollution": 21.96, "redirect_scanner": 28.02, "sensitive_finder": 1.3, "ssrf_false_positive_control": 45.24, "ssrf_prober": 43.43, "tech_fingerprint": 1.43, "waf_detector": 6.67 }, "total_timed_ms": 260.96 } }, "wall_ms": 735.46 } ], "websocket_attack_benchmark": [ { "iteration": 1, "result": { "artifacts": { "authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "5c9ecc7f5df82919", "error": "", "identities": [ { "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 59, "response_preview": "{\"type\": \"error\", \"error\": \"forbidden\", \"status_code\": 403}", "status": "received" }, { "behavior_hash": "fa0031de329a0b92", "error": "", "identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 58, "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "identity_count": 2, "interesting_identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin", "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "recommended_severity": "medium", "status_breakdown": { "received": 2 } }, "error_replay_effective_success": false, "origin_probe": { "accepted_origin_count": 2, "probe_error_count": 0, "tested_origins": 2 }, "race_summary": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "replay_prelude_frames": 1, "replay_status": "received", "subscription_summary": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } }, "checks": { "all_attack_transports_complete_without_errors": true, "application_error_is_not_counted_as_success": true, "authz_diff_compares_live_identities": true, "origin_probe_observes_untrusted_origin_acceptance": true, "race_attack_detects_duplicate_success": true, "replay_skips_welcome_frame": true, "subscription_abuse_detects_tenant_hop": true }, "lab": "websocket_attack_benchmark", "summary": { "checks_passed": 7, "checks_total": 7, "frames_exercised": 12, "timings_ms": { "websocket_origin_probe": 5.35, "ws_authz_diff": 318.85, "ws_error_classification": 158.72, "ws_race": 408.59, "ws_replay": 156.13, "ws_subscription_abuse": 314.55 }, "total_timed_ms": 1362.19 } }, "wall_ms": 1810.42 }, { "iteration": 2, "result": { "artifacts": { "authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "5c9ecc7f5df82919", "error": "", "identities": [ { "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 59, "response_preview": "{\"type\": \"error\", \"error\": \"forbidden\", \"status_code\": 403}", "status": "received" }, { "behavior_hash": "fa0031de329a0b92", "error": "", "identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 58, "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "identity_count": 2, "interesting_identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin", "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "recommended_severity": "medium", "status_breakdown": { "received": 2 } }, "error_replay_effective_success": false, "origin_probe": { "accepted_origin_count": 2, "probe_error_count": 0, "tested_origins": 2 }, "race_summary": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "replay_prelude_frames": 1, "replay_status": "received", "subscription_summary": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } }, "checks": { "all_attack_transports_complete_without_errors": true, "application_error_is_not_counted_as_success": true, "authz_diff_compares_live_identities": true, "origin_probe_observes_untrusted_origin_acceptance": true, "race_attack_detects_duplicate_success": true, "replay_skips_welcome_frame": true, "subscription_abuse_detects_tenant_hop": true }, "lab": "websocket_attack_benchmark", "summary": { "checks_passed": 7, "checks_total": 7, "frames_exercised": 12, "timings_ms": { "websocket_origin_probe": 5.23, "ws_authz_diff": 312.91, "ws_error_classification": 155.73, "ws_race": 380.28, "ws_replay": 157.08, "ws_subscription_abuse": 318.26 }, "total_timed_ms": 1329.49 } }, "wall_ms": 1778.83 }, { "iteration": 3, "result": { "artifacts": { "authz_summary": { "behavior_changed": true, "behavior_group_count": 2, "behavior_groups": [ { "behavior_hash": "5c9ecc7f5df82919", "error": "", "identities": [ { "identity_alias": "user", "identity_id": "benchmark-user" } ], "response_length": 59, "response_preview": "{\"type\": \"error\", \"error\": \"forbidden\", \"status_code\": 403}", "status": "received" }, { "behavior_hash": "fa0031de329a0b92", "error": "", "identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin" } ], "response_length": 58, "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "identity_count": 2, "interesting_identities": [ { "identity_alias": "admin", "identity_id": "benchmark-admin", "response_preview": "{\"type\": \"admin_data\", \"ok\": true, \"scope\": \"all-tenants\"}", "status": "received" } ], "recommended_severity": "medium", "status_breakdown": { "received": 2 } }, "error_replay_effective_success": false, "origin_probe": { "accepted_origin_count": 2, "probe_error_count": 0, "tested_origins": 2 }, "race_summary": { "accepted_count": 6, "attempt_count": 6, "behavior_group_count": 6, "concurrency": 3, "duplicate_success_observed": true, "error_count": 0, "later_wave_success_observed": true, "mode": "duplicate_action", "received_count": 6, "recommended_severity": "high", "sent_count": 0, "suspicious_race_window": true, "timeout_count": 0, "wave_count": 2, "wave_success": { "wave_1": 3, "wave_2": 3 } }, "replay_prelude_frames": 1, "replay_status": "received", "subscription_summary": { "accepted_mutation_count": 1, "baseline_count": 1, "behavior_change_count": 1, "field_summary": [ { "accepted_attempts": 1, "attempts": 1, "field_name": "tenant_id", "suspicious_attempts": 1, "values": [ "tenant-beta" ] } ], "identity_count": 1, "mutation_count": 1, "recommended_severity": "medium", "suspicious_attempt_count": 1 } }, "checks": { "all_attack_transports_complete_without_errors": true, "application_error_is_not_counted_as_success": true, "authz_diff_compares_live_identities": true, "origin_probe_observes_untrusted_origin_acceptance": true, "race_attack_detects_duplicate_success": true, "replay_skips_welcome_frame": true, "subscription_abuse_detects_tenant_hop": true }, "lab": "websocket_attack_benchmark", "summary": { "checks_passed": 7, "checks_total": 7, "frames_exercised": 12, "timings_ms": { "websocket_origin_probe": 4.44, "ws_authz_diff": 313.14, "ws_error_classification": 158.86, "ws_race": 377.9, "ws_replay": 156.34, "ws_subscription_abuse": 310.58 }, "total_timed_ms": 1321.26 } }, "wall_ms": 1800.94 } ] }, "schema_version": 1 }