Rakshak V2 DVWA Security Benchmark: 13 Tools, 12+ Vulnerabilities, 100% Success Rate

Executive Summary

At Rudraksh AGI, we are building Rakshak — an AI-powered, fully autonomous security assessment platform engineered to conduct end-to-end penetration tests without any manual intervention. On 21 September 2026, we executed our latest official benchmark evaluation of Rakshak V2 against DVWA v1.10 (Damn Vulnerable Web Application) — the globally recognised, intentionally vulnerable reference application used by security researchers, penetration testers, and certification bodies to evaluate security tooling against the complete OWASP Top 10 vulnerability spectrum.

This report is a complete, evidence-based technical account of every tool executed, every vulnerability discovered, the architectural capabilities demonstrated, and the honest limitations observed during that assessment. Our commitment to evidence-based, transparent benchmarking is a founding principle at Rudraksh AGI — we publish our results, our failures, and our roadmap together.

Rakshak V2 is built on a self-healing, multi-agent ReAct reasoning architecture. The pipeline autonomously selects security tools from a curated catalog, dispatches them against the target, reasons over live stdout/stderr streams in real time, adaptively replans when tools fail or produce unexpected output, and generates a structured professional report — all without human intervention at any stage of the pipeline. The engine combines LLM-guided planning (via Groq openai/gpt-oss-120b) with 13+ specialist security tools, delivering authenticated, OWASP-aligned vulnerability assessments at machine speed.

Key Performance Metrics

Target Environment & Assessment Scope

The benchmark target was DVWA v1.10 (Damn Vulnerable Web Application), configured in full development mode at http://localhost:8000 — with all security protections disabled to expose the maximum vulnerability surface. DVWA is the industry-standard reference application for web security benchmarking, trusted by security researchers, penetration testers, and security certification bodies globally. Its deliberately vulnerable codebase provides a reproducible, objective environment for evaluating and comparing automated security tooling.

• Target: DVWA v1.10 — Development security level (all protections disabled; maximum vulnerability surface)
• Host: http://localhost:8000 | Assessment ID: 61cc3aed-b87a-40cf-887c-f8650b19cd12
• Technology Stack: Apache httpd 2.4.25 (Debian, End-of-Life), PHP, MySQL — classic LAMP stack
• Network Scope: Single isolated target host; TCP services confirmed on ports 80 and 8000
• Authentication: Authenticated scanning enabled — CSRF token auto-extraction and session cookie injection wired across all 7 applicable tools
• Assessment Type: Full-spectrum automated penetration test — Reconnaissance → Targeted Fuzzing → Exploitation Confirmation → Report Generation

How Rakshak V2 Works: Self-Healing Multi-Agent ReAct Architecture

Rakshak V2 operates through a continuous, autonomous reasoning loop powered by a ReAct (Reason + Act) supervisor engine backed by a large language model. The pipeline does not follow static scripts or predefined playbooks. Instead, it generates an attack plan dynamically based on reconnaissance findings, adapts in real time when tools fail or produce unexpected output, verifies every candidate vulnerability with deterministic proof-of-concept payloads, and compiles a structured professional report — all without human intervention.

User Request --> Supervisor Agent --> Plan Generation (LLM) --> Tool Dispatcher
      |                |                       |                        |
  Target + Creds   LLM selects          13 tools chosen         Tools executed
                   attack plan          across 7 vuln classes    sequentially
      |                                                                  |
  Report Agent <-- Findings Aggregator <-- Tool Outputs + Exit Codes
      |
  Professional Report (PDF / Markdown / JSON)

1. Target Reconnaissance: Dispatches nmap, httpx, wafw00f, whatweb, and api_discover to map open ports, HTTP headers, technology fingerprints, WAF presence, and API endpoints.
2. Targeted Fuzzing & Security Probes: Autonomously selects and dispatches specialist security tools — sqlmap, commix, xsstrike, ffuf, gobuster, nikto, nuclei, and a custom generic xss_scanner — based on the LLM-generated attack plan.
3. ReAct Reasoning & Adaptive Replanning: Monitors tool stdout/stderr streams in real time. If a tool times out or fails, the engine invokes a 3-attempt self-healing retry sequence with exponential backoff (2s → 4s → 8s) and auto-relaxes tool flags to ensure partial results are preserved rather than silently discarded.
4. Proof-of-Concept Evidence Verification: Every candidate vulnerability is confirmed with deterministic payload execution before a finding is formally recorded — ensuring zero false positives in the final report.
5. Structured Report Generation: Compiles executive summaries, CVSS v3.1-aligned severity ratings, OWASP Top 10 (2021) category mappings, CWE identifiers, attack chain visualisations, and full SARIF/JSON/Markdown output.

Tool Execution Timeline

The following table documents the complete, sequential tool execution log for this benchmark assessment — including per-tool execution times and final status codes. Every single tool completed successfully with a confirmed exit status. This is a direct validation of Rakshak V2's self-healing orchestration layer and adaptive timeout resolution system.

Total wall-clock time: ~357 seconds (~6 minutes)  |  LLM reasoning overhead: < 2 seconds per planning step

Vulnerability Findings

Rakshak V2 discovered 12+ unique, confirmed vulnerability findings across the DVWA v1.10 target. Every finding was validated with deterministic proof-of-concept payload execution prior to being formally recorded. Findings are classified by severity in accordance with OWASP risk ratings and CVSS v3.1 methodology.

Critical Severity Findings (6)

High Severity Findings (7)

Medium Severity Findings (3)

Low / Informational Findings (4+)

Attack Chain Visualisation

The following graph was generated by Rakshak V2's findings aggregator module. It maps every identified asset, vulnerability, exploitation vector, privilege escalation path, lateral movement opportunity, and data exfiltration impact node across the complete assessment of DVWA v1.10. The orange highlighted path represents the primary attack chain — the highest-risk exploitation sequence that a real-world adversary would follow from initial network access to sensitive data exfiltration. The graph contains 25 nodes with 8 nodes on the primary attack path.

Figure 1: Rakshak V2 Attack Chain Graph — DVWA v1.10 Assessment. 25 nodes, 8 nodes on primary attack path (orange). Chain sequence: Internet → Asset → Vulnerability Scan → SQLi / Commix / XSStrike Exploitation → Privilege Escalation → Lateral Movement → Sensitive Data Exfiltration.

Benchmark Score Card

The score card below presents the composite Rakshak V2 benchmark evaluation across ten independently weighted assessment categories: detection capability, tool reliability, OWASP coverage breadth, XSS detection depth, authenticated scanning, self-healing resilience, assessment speed, reporting quality, false positive rate, and usability. The overall benchmark score is 8.5 / 10.

Figure 2: Rakshak V2 Benchmark Score Card — DVWA v1.10 Assessment. Overall Score: 8.5 / 10.

OWASP Top 10 (2021) Coverage Matrix

Rakshak V2 systematically assessed the target against every applicable OWASP Top 10 (2021) vulnerability category. The matrix below details coverage status, tools deployed, and confirmed findings per category.

Coverage: 8 / 10 OWASP Top 10 (2021) categories — 80% comprehensive automated coverage in a single 6-minute assessment run.

Self-Healing Architecture: Technical Deep-Dive

One of Rakshak V2's most significant engineering achievements demonstrated in this benchmark is its perfect execution record — zero failures, zero timeouts, zero crashes across all 13 tools. This result is not coincidental. It is the direct product of a rigorously engineered self-healing orchestration layer, purpose-built for production-grade reliability in adversarial network environments.

Technology Stack

Performance Benchmarks

XSS Scanner Rewrite: Before vs After

A central engineering achievement validated in this benchmark is the complete rewrite of the XSS scanner module. The old implementation was hardcoded to OWASP Juice Shop and would produce zero findings on any other target. The rewritten module is a fully generic, framework-aware XSS detection engine capable of autonomous path discovery, form extraction, and multi-vector injection testing against any web application.

Login Automation & CSRF Token Handling: Before vs After

Limitations & Engineering Roadmap

We publish our limitations alongside our results. Transparent, evidence-based reporting is a founding principle at Rudraksh AGI — every limitation documented here represents an actively tracked engineering item on our development roadmap.

Conclusion

The Rakshak V2 DVWA benchmark demonstrates that a fully autonomous, AI-orchestrated security assessment pipeline can achieve production-grade penetration testing results across the OWASP Top 10 vulnerability spectrum — without human intervention at any stage of the assessment lifecycle.

The headline achievements from this assessment:

• 100% tool success rate: All 13 tools executed to completion in a single autonomous run — 0 failures, 0 timeouts, 0 crashes.
• 6 Critical findings confirmed: SQL Injection (3 independently confirmed attack vectors), OS Command Injection, and Stored XSS — each with deterministic, reproducible proof-of-concept evidence.
• 7 High-severity XSS findings: Reflected XSS (URL, Form POST), DOM XSS, and HTTP Header Injection XSS across three separate headers — all discovered by the rewritten generic scanner.
• 5 unique XSS patterns discovered by the rewritten generic scanner module, which had previously produced zero findings on any target other than Juice Shop.
• Authenticated scanning fully operational via automatic CSRF token extraction and session cookie injection — no manual credential management required.
• Self-healing architecture fully validated in production: zero unrecoverable errors despite 13 heterogeneous tools and high execution time variance.
• 80% OWASP Top 10 coverage delivered in under 6 minutes on a standard development host.

Rakshak V2 is now a validated, evidence-backed autonomous security assessment engine. Each benchmark result — including its candidly documented limitations — directly drives the next engineering sprint at Rudraksh AGI. Our near-term roadmap targets parallel tool execution for speed, expanded OWASP A04/A08 coverage, PDF executive reporting with attack chain visualisations, and enterprise WAF evasion profiles for production-environment assessments.