Study Tests How Often Web Vulnerability Scanner Findings Are Real

The author examines how many findings a web vulnerability scanner reports are genuine, arguing that false positives erode trust and waste responders' time. The scanner, Web-Vuln-Scanner, is an open-source early-stage project that requires explicit target and authorization confirmation before running. It currently implements four checks: reflected XSS, error-based SQL injection, security response headers, and sensitive-path probing, while other features remain unimplemented. The author tested the pipeline against six targets designed to measure detection of real flaws, correct handling of clean sites, the nature of false positives, and the pipeline's limits. The results indicate that the sensitive-path and error-based SQLi checks produced false positives because they lack a baseline comparison against normal responses.