The OWASP Benchmark Project is a Java and Python test suite designed to verify the speed and accuracy of vulnerability detection tools. It is a fully runnable, open-source web application that can be analyzed by any Application Security Testing (AST) tool, including SAST, DAST (such as ZAP), and IAST. The intent is that all vulnerabilities deliberately included in and scored by the Benchmark are actually exploitable, making it a fair test for any application vulnerability detection tool.
Scorecard Generators
The Benchmark project also includes scorecard generators for numerous open source and commercial AST tools, and the set of supported tools is growing all the time. This scoring capability is implemented in the BenchmarkUtils project, which is at: https://github.com/OWASP-Benchmark/BenchmarkUtils.
The project documentation is all on the OWASP site at the OWASP Benchmark project pages. Please refer to that site for all the project details.
The current latest release is v1.2. Note that all the releases that are available here: https://github.com/OWASP-Benchmark/BenchmarkJava/releases, are historical. The latest release is always available live by simply cloning or pulling the head of this repository (i.e., git pull).
Running Benchmark Itself:
runBenchmark.sh - run the Benchmark Web Application (accessible via local machine only)
runRemoteAccessibleBenchmark.sh - like the above but allows port 8443 to be accessible outside the machine Benchmark is running on.
Project Resources
Project Leaders
Project Information
Slack