How to benchmark security tools: a case study using WebGoat

This post contributes to the understanding of security tool benchmarking by analyzing the limitations of using WebGoat as a target. It details the architectural components of WebGoat and provides a methodology for evaluating SAST and DAST tool findings against specific lessons. The analysis categorizes flaws by type (e.g., SQL Injection), assesses the probability of detection by SAST and DAST tools, and provides reasoning and example attacks. It highlights that WebGoat's synthetic flaws may not fully exercise advanced SAST capabilities like taint tracking and that DAST tools may struggle with direct SQL query injection.