March 7, 2026

WAFBench Security Hardening: From 37/46 to 46/46

Security testing fails quietly when payload delivery is wrong. The MockForge 0.3.46 through 0.3.54 release arc fixed the mechanics of how attacks are delivered so the WAFBench benchmark result means something.

What Was Hardened

Payload distribution across virtual users, actual security payload injection into generated requests, cookie jar behavior and header interactions, acceptance of all WAFBench CRS payloads, grouping of multi-part URI/header/body payloads into single requests, URL decoding and form handling, and explicit path injection and form-encoded body delivery.

Benchmark Progression

Expected SQLi detection improved from 37/46, to 44/46, then 45/46, and finally 46/46. The signal is that request semantics were corrected until the benchmark became substantially more trustworthy.

Broader Implications

If your security test harness splits grouped attacks across separate requests, encodes body or URI payloads incorrectly, lets cookie state interfere with intended headers, or sends traffic in formats the target does not actually inspect, then your benchmark is not giving you the answer you think it is.

Practical Takeaway

The credibility of a security benchmark depends on transport semantics, not just the size of the attack catalog. Fix the harness, verify the delivery shape, then trust the score.