{
  "bench": "BENCH-05",
  "target": "https://public-firing-range.appspot.com/",
  "generated": "2026-07-18T09:17:09.194465+00:00",
  "reflected_executed": 15,
  "reflected_confirmed": 15,
  "reflected_distinct_paths": 15,
  "reflected_endpoints_seen": 40,
  "reflected_probe_urls": [
    "https://public-firing-range.appspot.com/reflected/parameter/body/400",
    "https://public-firing-range.appspot.com/reflected/parameter/body/401",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_quoted",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_unquoted",
    "https://public-firing-range.appspot.com/reflected/parameter/javascript",
    "https://public-firing-range.appspot.com/reflected/parameter/tagname",
    "https://public-firing-range.appspot.com/reflected/parameter/textarea",
    "https://public-firing-range.appspot.com/reflected/parameter/title",
    "https://public-firing-range.appspot.com/reflected/contentsniffing/json",
    "https://public-firing-range.appspot.com/reflected/contentsniffing/plaintext",
    "https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_quoted/DOUBLE_QUOTED_ATTRIBUTE",
    "https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_singlequoted/SINGLE_QUOTED_ATTRIBUTE",
    "https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_unquoted/UNQUOTED_ATTRIBUTE",
    "https://public-firing-range.appspot.com/reflected/filteredcharsets/attribute_unquoted/DoubleQuoteSinglequote",
    "https://public-firing-range.appspot.com/reflected/filteredcharsets/body/SpaceDoubleQuoteSlashEquals",
    "https://public-firing-range.appspot.com/reflected/filteredstrings/body/caseInsensitive/script",
    "https://public-firing-range.appspot.com/reflected/filteredstrings/body/caseSensitive/SCRIPT",
    "https://public-firing-range.appspot.com/reflected/filteredstrings/body/caseSensitive/script",
    "https://public-firing-range.appspot.com/reflected/index.html",
    "https://public-firing-range.appspot.com/reflected/jsoncallback",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_name",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_script",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_singlequoted",
    "https://public-firing-range.appspot.com/reflected/parameter/body/403",
    "https://public-firing-range.appspot.com/reflected/parameter/body/404",
    "https://public-firing-range.appspot.com/reflected/parameter/body/500",
    "https://public-firing-range.appspot.com/reflected/parameter/body",
    "https://public-firing-range.appspot.com/reflected/parameter/body_comment",
    "https://public-firing-range.appspot.com/reflected/parameter/css_style",
    "https://public-firing-range.appspot.com/reflected/parameter/css_style_font_value",
    "https://public-firing-range.appspot.com/reflected/parameter/css_style_value",
    "https://public-firing-range.appspot.com/reflected/parameter/form",
    "https://public-firing-range.appspot.com/reflected/parameter/head",
    "https://public-firing-range.appspot.com/reflected/parameter/iframe_attribute_value",
    "https://public-firing-range.appspot.com/reflected/parameter/iframe_srcdoc",
    "https://public-firing-range.appspot.com/reflected/parameter/js_assignment",
    "https://public-firing-range.appspot.com/reflected/parameter/js_comment",
    "https://public-firing-range.appspot.com/reflected/parameter/js_eval",
    "https://public-firing-range.appspot.com/reflected/parameter/js_quoted_string",
    "https://public-firing-range.appspot.com/reflected/parameter/js_singlequoted_string"
  ],
  "reflected_endpoints": [
    "https://public-firing-range.appspot.com/reflected/filteredcharsets/body/SpaceDoubleQuoteSlashEquals?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/filteredstrings/body/caseInsensitive/script?q=%3Cimg+src%3Dx+onerror%3Dalert%28%27VEX_REFL_XSS%27%29%3E",
    "https://public-firing-range.appspot.com/reflected/filteredstrings/body/caseSensitive/SCRIPT?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_name?q=%27%3E%3Cimg+src%3Dx+onerror%3Dalert%28%27VEX_REFL_XSS%27%29%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/attribute_singlequoted?q=%27%3E%3Cimg+src%3Dx+onerror%3Dalert%28%27VEX_REFL_XSS%27%29%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body/400?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body/401?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body/403?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body/404?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body/500?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/body?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/form?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/head?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/iframe_srcdoc?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E",
    "https://public-firing-range.appspot.com/reflected/parameter/tagname?q=%3Cscript%3Ealert%28%27VEX_REFL_XSS%27%29%3C%2Fscript%3E"
  ],
  "reflected_distinct_path_list": [
    "/reflected/filteredcharsets/body/spacedoublequoteslashequals",
    "/reflected/filteredstrings/body/caseinsensitive/script",
    "/reflected/filteredstrings/body/casesensitive/script",
    "/reflected/parameter/attribute_name",
    "/reflected/parameter/attribute_singlequoted",
    "/reflected/parameter/body",
    "/reflected/parameter/body/400",
    "/reflected/parameter/body/401",
    "/reflected/parameter/body/403",
    "/reflected/parameter/body/404",
    "/reflected/parameter/body/500",
    "/reflected/parameter/form",
    "/reflected/parameter/head",
    "/reflected/parameter/iframe_srcdoc",
    "/reflected/parameter/tagname"
  ],
  "dom_executed": 3,
  "dom_confirmed": 3,
  "dom_distinct_paths": 3,
  "dom_evidenced_ceiling": 1,
  "dom_evidenced_sink_paths": [
    "/dom/toxicdom/document/referrer/documentWrite"
  ],
  "dom_intermittent_sink_paths": [
    "/dom/toxicdom/document/referrer/innerHtml"
  ],
  "dom_endpoints": [
    "https://public-firing-range.appspot.com/dom/eventtriggering/document/inputTyping/documentWrite",
    "https://public-firing-range.appspot.com/dom/eventtriggering/document/inputTyping/innerHtml",
    "https://public-firing-range.appspot.com/dom/toxicdom/document/referrer/documentWrite?q=%3Cscript%3Ealert%28%27VEX_DOM_XSS%27%29%3C%2Fscript%3E"
  ],
  "dom_distinct_path_list": [
    "/dom/eventtriggering/document/inputtyping/documentwrite",
    "/dom/eventtriggering/document/inputtyping/innerhtml",
    "/dom/toxicdom/document/referrer/documentwrite"
  ],
  "reflected_observed_only": 0,
  "dom_observed_only": 0,
  "min_reflected": 15,
  "min_dom": 1,
  "gate_pass": true,
  "gate_note": "DOM gate = evidenced ceiling from live toxicdom matrix (1 stable sink(s); innerHtml intermittent \u2014 see dom_intermittent_sink_paths). Reflected denominator = DEPTH-16 seed probe surface (not whole lab).",
  "elapsed_s": 1366.6,
  "findings_total": 22,
  "firing_range_findings": 19,
  "scan_complete": true,
  "error": null,
  "sample_reflected": [
    "Reflected XSS in 'q'",
    "Reflected XSS in 'q'",
    "Reflected XSS in 'q'",
    "Reflected XSS in 'q'",
    "Reflected XSS in 'q'"
  ],
  "sample_dom": [
    "DOM-Based XSS (Exploited) \u2014 parameter 'q'",
    "DOM-Based XSS (Exploited) \u2014 parameter 'input[input[type='text']]'",
    "DOM-Based XSS (Exploited) \u2014 parameter 'input[input[type='text']]'"
  ]
}