Scan & Proof Validation Workspace

Connect a code repository or attach source code across 10 languages, execute XTRIKE XQL / XTRIKE DeepFlow / XTRIKE StructSCA + 400 OWASP/NIST plugins, and verify 6-point proof contracts.

STEP 1

Repository & 10-Lang AST

Repo URL or Attached Codebase

STEP 2

400-Plugin Multi-Engine Scan

XTRIKE XQL · DeepFlow · StructSCA · DepGuard

STEP 3

Finding Validation (A–F)

6-Point Proof Contract

STEP 4

Verified Dashboard

Triage & remediation

1. Integrated SAST, DAST & Combined Benchmark Testbeds (58 Targets)

OWASP BenchmarkDAST + SAST

OWASP/Benchmark

Official OWASP Benchmark test suite evaluating SAST & DAST accuracy, recall, and false-positive suppression across 2,740+ Java servlet test cases.

CWE-89CWE-78CWE-79CWE-22

Java · ~32 findings

OWASP BenchmarkJavaDAST + SAST

OWASP/BenchmarkJava

OWASP BenchmarkJava v1.2+ calibration repository containing 2,740+ Java servlet vulnerability test cases for SAST & DAST scorecard verification.

CWE-89CWE-78CWE-90CWE-502

Java · ~31 findings

ShiftLeftSecurity BenchmarkSAST

ShiftLeftSecurity/Benchmark

Code Property Graph (CPG) & dataflow taint benchmark fork used to measure inter-procedural source-to-sink reachability.

CWE-89CWE-78CWE-79CWE-22

Java · ~29 findings

OWASP BenchmarkDotNetDAST + SAST

OWASP/BenchmarkDotNet

ASP.NET Core & C# SAST benchmark suite testing ADO.NET SQLi, BinaryFormatter deserialization, and OS Process injection.

CWE-89CWE-78CWE-502CWE-22

C# · ~28 findings

OWASP BenchmarkPHPDAST + SAST

OWASP/BenchmarkPHP

PHP SAST benchmark suite covering mysqli query concatenation, shell_exec command injection, LFI/RFI, and unserialize() object injection.

CWE-89CWE-78CWE-79CWE-98

PHP · ~27 findings

OWASP BenchmarkPythonDAST + SAST

OWASP/BenchmarkPython

Python SAST benchmark testbed evaluating Flask/Django taint paths, subprocess shell=True, pickle.loads, and SSRF.

CWE-89CWE-78CWE-502CWE-918

Python · ~30 findings

OWASP BenchmarkGoDAST + SAST

OWASP/BenchmarkGo

Go SAST benchmark suite testing database/sql string formatting, os/exec bash invocation, filepath traversal, and SSRF.

CWE-89CWE-78CWE-22CWE-918

Go · ~26 findings

OWASP BenchmarkJavaScriptDAST + SAST

OWASP/BenchmarkJavaScript

JavaScript & Node.js SAST benchmark suite testing Express.js SQLi, child_process.exec, eval() injection, and prototype pollution.

CWE-89CWE-78CWE-79CWE-94

Node.js · ~29 findings

OWASP Juice ShopDAST + SAST

juice-shop/juice-shop

Flagship OWASP vulnerable modern web application built with Node.js, Express, TypeScript, and Angular containing 100+ real-world DAST & SAST flaws.

CWE-89CWE-79CWE-94CWE-918

TypeScript · ~34 findings

OWASP Juice Shop (OWASP Org)DAST + SAST

OWASP/juice-shop

OWASP organization mirror of Juice Shop for combined DAST active probing and SAST TypeScript route analysis.

CWE-89CWE-79CWE-94CWE-918

TypeScript · ~34 findings

Juice Shop (bkimminich Mirror)DAST + SAST

bkimminich/juice-shop

Upstream creator repository of OWASP Juice Shop covering JWT forgery, NoSQL/$where injection, B2B XML/XXE, and SSRF.

CWE-89CWE-79CWE-94CWE-22

Node.js · ~33 findings

Damn Vulnerable Web App (digininja/DVWA)DAST + SAST

digininja/DVWA

Industry-standard PHP/MySQL vulnerable application testing SQL Injection, Command Execution, File Inclusion, and XSS.

CWE-89CWE-78CWE-79CWE-98

PHP · ~31 findings

DVWA (ethicalhack3r Original)DAST + SAST

ethicalhack3r/DVWA

Original ethicalhack3r DVWA repository used for DAST scanner calibration and PHP SAST taint verification.

CWE-89CWE-78CWE-79CWE-98

PHP · ~30 findings

OWASP WebGoat (OWASP/WebGoat)DAST + SAST

OWASP/WebGoat

Deliberately insecure Spring Boot / Java enterprise application maintained by OWASP covering OWASP Top 10 lessons.

CWE-89CWE-94CWE-78CWE-502

Java · ~34 findings

WebGoat Official (WebGoat/WebGoat)DAST + SAST

WebGoat/WebGoat

Primary GitHub organization repository for WebGoat & WebWolf interactive DAST/SAST Java Spring Boot lessons.

CWE-89CWE-502CWE-611CWE-918

Java · ~34 findings

OWASP NodeGoatDAST + SAST

OWASP/NodeGoat

OWASP Node.js Express & MongoDB vulnerable pension management portal demonstrating eval() code injection, NoSQL injection, and SSRF.

CWE-94CWE-89CWE-79CWE-943

Node.js · ~29 findings

OWASP PyGoatDAST + SAST

OWASP/pygoat

Intentionally vulnerable Python & Django web application designed by OWASP to test Python SAST & DAST engines against Top 10 flaws.

CWE-89CWE-78CWE-502CWE-611

Python · ~31 findings

OWASP RailsGoatDAST + SAST

OWASP/railsgoat

Vulnerable Ruby on Rails application featuring ActiveRecord SQLi, Marshal.load deserialization, mass assignment, and command injection.

CWE-89CWE-78CWE-502CWE-22

Ruby · ~27 findings

OWASP Mutillidae IIDAST + SAST

OWASP/Mutillidae

Free, open-source, deliberately vulnerable PHP web application providing 40+ OWASP Top 10 DAST & SAST target scripts.

CWE-89CWE-78CWE-79CWE-611

PHP · ~30 findings

OWASP Security ShepherdDAST + SAST

OWASP/SecurityShepherd

OWASP web and mobile application security training platform built in Java/JSP with intentional SQLi, XSS, and broken access control modules.

CWE-89CWE-79CWE-22CWE-306

Java · ~29 findings

PortSwigger Web Security AcademyDAST Web/API

PortSwigger/web-security-academy

PortSwigger Web Security Academy lab scenarios covering SQLi, SSRF, HTTP Request Smuggling, SSTI, XXE, OAuth flaws, and Deserialization.

CWE-89CWE-918CWE-444CWE-1336

Python · ~33 findings

OWASP MASTG (Mobile Security Testing)DAST + SAST

OWASP/owasp-mastg

OWASP Mobile Application Security Testing Guide (MASTG) & MASVS crackmes/samples for Android (Kotlin/Java) and iOS (Swift).

CWE-798CWE-327CWE-89CWE-295

Kotlin · ~28 findings

OWASP crAPI (Completely Ridiculous API)DAST Web/API

OWASP/crAPI

OWASP API Security Top 10 microservice testbed (Python, Java, Go) featuring BOLA/IDOR, SSRF, NoSQLi, JWT weaknesses, and Mass Assignment.

CWE-639CWE-918CWE-89CWE-798

Python · ~34 findings

OWASP / Rhino CloudGoatDAST + SAST

OWASP/CloudGoat

Vulnerable-by-design AWS cloud deployment & Lambda/EC2 SSRF escalation scenarios for cloud penetration testing and IaC/SAST audit.

CWE-798CWE-918CWE-78CWE-269

Python · ~29 findings

OWASP DevSecOps (DSO) PortalDAST + SAST

OWASP/DSO

OWASP DevSecOps pipeline verification target for testing CI/CD SAST, DAST, and container security gates.

CWE-78CWE-89CWE-798CWE-94

Node.js · ~27 findings

Vulhub CVE Reproduction EnvironmentsDAST + SAST

vulhub/vulhub

Pre-built vulnerable Docker environments for 200+ high-impact CVEs (Spring4Shell, Log4Shell, Struts2, Django SQLi, Fastjson RCE).

CWE-78CWE-502CWE-89CWE-918

Python · ~34 findings

VAmPI (Vulnerable REST API)DAST Web/API

erev0s/VAmPI

Vulnerable API made with Flask covering OWASP API Top 10: SQLi, Unauthorized Password Change, BOLA/IDOR, Mass Assignment, and Regex DoS.

CWE-89CWE-639CWE-798CWE-285

Python · ~31 findings

VAmPI-GraphQL (Vulnerable GraphQL API)DAST Web/API

erev0s/VAmPI-GraphQL

GraphQL edition of VAmPI demonstrating GraphQL introspection abuse, resolver SQL injection, batching brute-force, and OS command injection.

CWE-89CWE-78CWE-639CWE-200

Python · ~30 findings

Damn Vulnerable GraphQL App (DVGA)DAST Web/API

dolevf/Damn-Vulnerable-GraphQL-Application

Deliberately vulnerable GraphQL implementation in Python/Flask covering GraphQL RCE (`importPaste`), SQLi (`pastes` filter), SSRF, and Query Depth DoS.

CWE-78CWE-89CWE-918CWE-79

Python · ~33 findings

Damn Vulnerable Web Services (DVWS)DAST Web/API

snoopysecurity/dvws

Vulnerable REST/SOAP/XML/JWT Web Services application featuring XXE, SQLi, Command Injection, SSRF, and CORS misconfigurations.

CWE-89CWE-78CWE-611CWE-918

Node.js · ~30 findings

Commix OS Command Injection TestbedDAST + SAST

commixproject/commix

Automated All-in-One OS Command Injection exploitation and verification testbed covering classic, time-based, and file-based command injection sinks.

CWE-78CWE-88CWE-94CWE-89

Python · ~29 findings

OWASP WrongSecretsDAST + SAST

OWASP/wrongsecrets

OWASP flagship secrets management vulnerable app demonstrating hardcoded keys in Java, Docker, Kubernetes, Vault, AWS/GCP/Azure, and Git history.

CWE-798CWE-321CWE-522CWE-327

Java · ~31 findings

OWASP SSTI (Server-Side Template Injection)DAST + SAST

OWASP/SSTI

Server-Side Template Injection (SSTI) vulnerable reference endpoints across Jinja2, Twig, Freemarker, Velocity, and Mako.

CWE-1336CWE-94CWE-78CWE-79

Python · ~29 findings

OWASP Serverless-GoatDAST + SAST

OWASP/Serverless-Goat

OWASP Serverless Top 10 AWS Lambda application demonstrating event-data command injection, over-privileged IAM roles, and NoSQL injection.

CWE-78CWE-918CWE-89CWE-798

Node.js · ~28 findings

OWASP VulnerableAppDAST + SAST

SasanLabs/VulnerableApp

Official OWASP VulnerableApp project built specifically for combined DAST + SAST scanner benchmarking across multi-level vulnerability endpoints.

CWE-89CWE-78CWE-79CWE-611

Java · ~33 findings

OWASP Benchmark Project PortalDAST + SAST

OWASP/www-project-benchmark

OWASP Foundation Benchmark standard project combining SAST, DAST, and IAST evaluation scorecards (Yououden Index calibration).

CWE-89CWE-78CWE-79CWE-22

Java · ~32 findings

OpenSSF CVE BenchmarkDAST + SAST

ossf-cve-benchmark/ossf-cve-benchmark

Linux Foundation OpenSSF benchmark repository of 200+ historical real-world JavaScript/TypeScript CVEs with pre-patch and post-patch commits.

CWE-78CWE-89CWE-94CWE-22

Node.js · ~31 findings

Vulnerable-Code SAST-BenchmarkDAST + SAST

vulnerable-code/SAST-Benchmark

Multi-language SAST + DAST ground-truth benchmark repository for measuring true-positive vs false-positive detection accuracy.

CWE-89CWE-78CWE-502CWE-918

Python · ~30 findings

Vulnerable-Code-SnippetsSAST

snoopysecurity/Vulnerable-Code-Snippets

Curated collection of real-world vulnerable code snippets across Python, PHP, Java, JS, and Go for SAST rule validation.

CWE-89CWE-78CWE-918CWE-502

Python · ~31 findings

Appsecco Vulnerable AppsDAST + SAST

appsecco/vulnerable-apps

Multi-stack vulnerable application lab directory maintained by Appsecco for offensive/defensive SAST & pentest verification.

CWE-78CWE-89CWE-502CWE-918

Node.js · ~28 findings

RootUp Personal_SASTSAST

RootUp/Personal_SAST

Custom SAST engine test corpus with vulnerable Python/JS/Java source targets for static taint & AST rule benchmarking.

CWE-78CWE-89CWE-94CWE-502

Python · ~27 findings

Sonatype Sonar ExamplesSAST

sonatype/sonar-examples

Multi-module Maven/Gradle Java and polyglot code scanning examples for enterprise SAST & SCA quality gates.

CWE-89CWE-78CWE-611CWE-327

Java · ~26 findings

SonarSource Scanning ExamplesSAST

SonarSource/sonar-scanning-examples

Official SonarSource multi-language scanning example projects across Java, Python, C#, TypeScript, and Go.

CWE-89CWE-78CWE-22CWE-502

Java · ~28 findings

EyeballVul (Real-World CVE SAST Benchmark)SAST

timothee-chauvin/eyeballvul

Stream-updated benchmark of real-world CVEs in open-source repositories designed to test LLM-assisted and semantic SAST engines at scale.

CWE-89CWE-78CWE-918CWE-502

Python · ~34 findings

IRIS (Neuro-Symbolic SAST & CWE-Bench-Java)SAST

iris-sast/iris

IRIS whole-repository neuro-symbolic SAST framework combining CodeQL dataflow with CWE-Bench-Java real-world CVE targets.

CWE-22CWE-78CWE-79CWE-89

Java · ~33 findings

RivalSecurity SASTBenchSAST

RivalSecurity/sastbench

Modern SAST & triage agent benchmark evaluating precision, recall, and exploitability verification across real-world CVEs.

CWE-89CWE-78CWE-502CWE-918

Python · ~31 findings

Bearer Data-Flow & Privacy SASTSAST

Bearer/bearer

Bearer SAST security & sensitive data-flow scanner repository with Ruby, JavaScript/TypeScript, Go, and Python rule fixtures.

CWE-89CWE-78CWE-327CWE-200

Ruby · ~29 findings

Analysis-Tools-Dev Static Analysis DirectorySAST

analysis-tools-dev/static-analysis

Comprehensive polyglot static analysis tool & benchmark reference index covering 10+ programming languages.

CWE-89CWE-78CWE-22CWE-918

Go · ~27 findings

r2c Semgrep Rules CorpusSAST

returntocorp/semgrep-rules

Multi-language SAST rule test corpus containing hundreds of annotated vulnerable & safe test files across Python, JS, Java, Go, and Ruby.

CWE-89CWE-78CWE-502CWE-918

Python · ~32 findings

Semgrep AST Engine TestbedSAST

semgrep/semgrep

Polyglot AST & taint-mode test fixtures from the Semgrep static analysis engine repository.

CWE-78CWE-89CWE-502CWE-22

Python · ~29 findings

Semgrep Rules (Official)SAST

semgrep/semgrep-rules

Official Semgrep Registry rule test cases for TypeScript, Node.js, Express, React, and cloud infrastructure.

CWE-89CWE-78CWE-79CWE-94

TypeScript · ~31 findings

r2c Semgrep Polyglot SuiteSAST

returntocorp/semgrep

r2c polyglot taint-tracking benchmark fixtures covering Go, Python, and Java inter-function dataflows.

CWE-89CWE-78CWE-22CWE-918

Go · ~27 findings

SecureGo Gosec AST AnalyzerSAST

securego/gosec

Golang security checker repository containing G101–G602 AST vulnerability test samples (hardcoded creds, SQLi, command execution, weak TLS).

CWE-89CWE-78CWE-22CWE-327

Go · ~29 findings

SpotBugs Static AnalyzerSAST

spotbugs/spotbugs

Java bytecode & source defect analyzer test cases covering SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE and command injection.

CWE-89CWE-78CWE-79CWE-502

Java · ~28 findings

Find Security Bugs (Java)SAST

find-sec-bugs/find-sec-bugs

OWASP Find Security Bugs plugin repository with 140+ Java enterprise vulnerability patterns (Spring, Hibernate, JDBC, XXE, Deserialization).

CWE-89CWE-78CWE-502CWE-611

Java · ~33 findings

PMD Source Code AnalyzerSAST

pmd/pmd

Extensible cross-language AST static analyzer repository with security rule test cases for hardcoded crypto keys, SQLi, and insecure connections.

CWE-89CWE-798CWE-327CWE-78

Java · ~27 findings

CxSAST Enterprise Query SuiteSAST

Checkmarx/CxSAST

Enterprise C# / .NET Best-Fix-Location (BFL) and inter-procedural taint graph reference target.

CWE-89CWE-78CWE-502CWE-79

C# · ~30 findings

GitHub CodeQL Query SuiteSAST

github/codeql

Official GitHub CodeQL semantic analysis & CWE query test suite across Java, C#, Python, Go, JavaScript/TypeScript, and Ruby.

CWE-89CWE-78CWE-502CWE-918

Java · ~33 findings

Repository URL (Live GitHub API Fetch)

Branch

Build Commit SHA

2. Primary Language & AST Adapter (10 Polyglot Adapters Active)Active Adapter: Java AST + Taint Graph

Attached Java Codebase & Live AST Buffer (7 files)

testcode/BenchmarkTest00001.java

testcode/BenchmarkTest00017.java

controllers/AccountQueryController.java

services/ObjectDeserializationService.java

xml/XmlDocumentParser.java

files/FileAttachmentController.java

crypto/LegacyTokenHashProvider.java

File: src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.javaAdapter: Java · Edit or paste your own code below to scan

3. Enterprise Static & SCA Analysis Engines (6 of 6 Active)

Outputs normalized to SARIF 2.1.0

XTRIKE XQLXQL + BFL

XQL AST queries, Best Fix Location (BFL) & PCI-DSS / NIST 800-53 / ISO compliance

XTRIKE DeepFlowTaint + Sanitizer

Intelligent source-to-sink taint flow & sanitizer dominance verification

XTRIKE StructSCA7 Kingdoms

5 Core Analyzers (Dataflow, Control Flow, Structural, Config, Semantic) & 7 Kingdoms

XTRIKE AST-QueryAST + DataFlow

Inter-procedural taint-flow tracing & semantic AST queries across 10 languages

XTRIKE PatternGuard400 Plugins

Single-Pass Token-Indexed Dispatcher executing 400 OWASP / CWE / CERT plugins

XTRIKE DepGuardLive Advisory + SCA

Live OSV & NIST NVD CVE dependency call-graph reachability

400-Plugin Single-Pass Dispatcher & Proof Pipeline

400 PLUGINS ACTIVE

Unlike legacy scanners that walk the AST hundreds of times, XTRIKE uses an O(1) Token-Bucket Single-Pass Dispatcher across 400 security plugins aligned with OWASP, NIST, CWE, PCI-DSS v4.0, ISO 27001, XTRIKE XQL, XTRIKE DeepFlow, and XTRIKE StructSCA 7 Kingdoms.

Global Standard Plugin Families (400 Rules)

OWASP Top 10 & ASVS v4.0.345

MITRE CWE Top 25 & SANS 2520

XTRIKE XQL XTRIKE-XQL High-Risk Queries20

XTRIKE DeepFlow Taint-Flow Rules20

XTRIKE StructSCA 7 Kingdoms20

OWASP API Security Top 10:202350

Secrets & Credential Hygiene30

Cryptographic & FIPS 140-325

OWASP LLM & GenAI Top 10:202525

Cloud, IaC, Docker & K8s (CISA/NSA)30

SEI CERT & Concurrency / Memory35

PCI-DSS v4.0 & ISO 27001:202240

CI/CD, Supply Chain & SCA (SLSA)40

Stage A–B:SARIF 2.1.0 Ingestion & Commit SHA Binding

Preserves XTRIKE XQL BFL, DeepFlow Taint & StructSCA Kingdom metadata

Stage C:O(1) Token-Bucket 400-Plugin Dispatcher

Single-pass multi-language AST & taint evaluation across 10 languages

Stage D1/D2:Priority 1–5 Static & Sanitizer Dominance Verifiers

Authz, SQL AST, XSS context, Path boundary, Outbound SSRF & Crypto

Stage E:Independent Evidence Verifier (6-Point Proof Contract)

Strictly separates ValidationStatus from Evidence Confidence

Stage F:Live OSV.dev NVD Lookup & Standards Mapping

Maps to OWASP Top 10/ASVS/API/LLM, NIST 800-53/SSDF, PCI-DSS v4.0 & ISO 27001