Hello, I'm a student in the Cybersecurity field and in the last months I've been writing a thesis on the topic "Evaluation of Static Analysis Tools in Detecting OWASP Top 10 Vulnerabilities". As you can imagine, most of the work done here consists of using some applications as test cases for the tools and finally evaluating their performance in detecting the OWASP Top 10 vulnerabilities. WebGoat was part of the workload used, i.e. the test cases.
One problem that was identified is the lack of, for example, a checklist of the located vulnerable and non-vulnerable instances of the WebGoat application to help those who wanted to use this application as a component of the test cases set. So, with this pull request, I provide an Excel file that can be used to check if a certain tool or set of them has detected the instances gathered from the analysis of WebGoat manually.

The first 2 columns are the file and line where the vulnerable or non-vulnerable instance is located. The next 2 columns correspond to the sink and source of the instance, which will basically be the function and the parameters of the function that could trigger a possible vulnerability or not. Following this we have the vulnerability column, which basically indicates the vulnerability associated with the instance. Finally, the last columns work as a checkbox to indicate if tool x, y or z has detected a given vulnerability or not.

Here it will be really intuitive to understand, if there is an "x" the tool detected the instance as vulnerable, otherwise, the tool didn't classify it as anything.

I hope this will help new tool testers with the difficult task of analyzing SAST tools! If you have any suggestions, doubts or comments, feel free to do so! :)
In the next link, you can find my repository where I have developed some scripts to help collect the number of TPs, FNs, FPs and TNs obtained by the tools.
https://github.com/inesmarcal/Thesis-Scripts-Assess-of-SAST-Tools-against-OWASP-Top-10-vulns