A Comparative Analysis of OWASP ZAP, Arachni and Wapiti against the Reinforced WAVSEP Benchmark

Sharma, Chetanya (2025) A Comparative Analysis of OWASP ZAP, Arachni and Wapiti against the Reinforced WAVSEP Benchmark. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (851kB) | Preview
Preview	PDF (Configuration Manual) Download (1MB) | Preview

Abstract

The increasing complexity of the modern web applications has increased the need for an effective automated vulnerability assessment technique. The study evaluates the practical-effectiveness of three widely used Dynamic Application Security Testing (DAST) tools- OWASP ZAP, Arachni and Wapiti- using the Reinforced WAVSEP benchmark under realistic, full black-box conditions. The benchmark was deployed in a controlled virtualized environment, and every scanner was executed using a default-configurations to reflect common practitioner usage. A custom evaluation framework was developed to map scanner outputs to the ground truth cases and compute the detection accuracy.

The results highlighted substantial variations in tool performance. Arachni achieved highest overall detection capability (F1= 0.88), followed by the Wapiti (F1=0.68 while ZAP recorded the lowest performance of F1 =0.55, previously published Reinforced WAVSEP evaluations, all the tools demonstrated notably lower performance in this study also highlighting the gap between benchmark-optimised configurations and real-world scanning behaviour. These findings throw light on the need of improved scanner tuning, hybrid testing strategies and the enhanced benchmark realism in order to support the reliable we application security assessment.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Moldovan, Arghir Nicolae UNSPECIFIED
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	04 Sep 2026 10:56
Last Modified:	04 Sep 2026 10:56
URI:	https://norma.ncirl.ie/id/eprint/9832

Actions (login required)

View Item