Wapiti

Overview

Wapiti is a Python scanner that crawls deployed websites and web applications, then probes what it finds for vulnerabilities. It suits technically equipped teams that need configurable, authenticated scans without a license fee. Its breadth of controls and report formats is useful, but scanning can disrupt a target, so permission and a carefully limited scope are essential.

Key features

Rather than inspect source code, Wapiti follows links, submits forms and tests scripts with payloads. Its checks cover SQL and XPath injection, cross-site scripting, file disclosure, command execution, XXE, SSRF and open redirects. That deployed-application approach is a practical fit for assessing exposed behavior, but it is not a source-code review.

Authentication options include Basic, Digest and NTLM, login forms, imported browser cookies and custom Python code for more complicated cases. This range makes it usable beyond anonymous public pages, though custom authentication can call for technical effort. For API work, it can scan REST endpoints from an OpenAPI (Swagger) file.

Users can route traffic through HTTP, HTTPS or SOCKS5 proxies, set scan scope and crawler limits, and add custom HTTP headers. Scans can be suspended and resumed through sessions stored in SQLite databases. Reports are available in HTML, XML, JSON, TXT, CSV and Markdown, giving teams several formats for review or further handling.

These controls do not remove the risk of an active assessment: scans may cause malfunctions, crashes or data loss. Obtain the target owner's consent and keep the scope deliberate.

Pricing

The plan is released under GNU GPL version 2. There is no paid tier or per-seat or scan quota stated for Wapiti. That makes it a cost-free option, but not a managed service: users need to handle setup, scan configuration, authorization and interpretation themselves.

Platforms

Wapiti is available for API, Linux, macOS, self-hosted and Windows environments, with on-premise deployment. The project lists Python 3.12, 3.13 or 3.14 as requirements; Windows use can be done through WSL. Installation is offered with pip install wapiti3. JavaScript crawling is supported. The README points users to its FAQ and GitHub issues for support.

Who it's for

Wapiti is best for developers and security practitioners who can run Python software, define a safe target scope and want to assess deployed web applications or REST APIs at no license cost. Its authentication support and resumable sessions help when scans need access or take time. It is a poor fit for users seeking a turnkey service, or anyone unable to secure explicit authorization and tolerate the operational risk of active probing.

Pros and cons

• Pros: Broad checks, authenticated scanning and OpenAPI-based REST API scanning cover more than anonymous page crawling alone.
• Pros: Scope controls, crawler limits, proxy support and resumable sessions provide useful control over scan execution.
• Pros: Six report formats and a free GPL-licensed plan avoid licensing cost and accommodate different reporting workflows.
• Cons: Python requirements and on-premise operation put setup and maintenance on the user.
• Cons: Active scans can disrupt systems or lose data, so careless or unauthorized use is not an acceptable shortcut.
• Cons: Wapiti tests deployed behavior rather than source code, so it does not replace source-code analysis.

Alternatives

Web Application Security Scanners is the broader category for comparing tools in this field. Choose Nuclei instead if a free, MIT-licensed standalone CLI is the priority. OWASP ZAP is another free, open-source choice for users who want a project that invites community contributions.

Qualys External Attack Surface Management may suit readers who want to evaluate a freemium product through its 30-day no-cost trial rather than adopt a free plan. Beagle Security offers a free plan with one lite test per month and monthly surface scan reports, while its Essential plan is $99 a month, billed Billed $1188 annual.

ZeroThreat may appeal to those who want to begin with five free scan credits valid for 15 days, then one scan credit per month for one target per account. ImmuniWeb is an alternative for Android and iOS app scanning, with its Neuron Mobile monthly subscription priced at €395 a month per app.

Burp Suite DAST is a paid alternative for buyers seeking a tailored solution with pricing based on portfolio. Pentest-Tools.com API Scanner is another option for API scanning; its NetSec plan starts at $95 a month with five assets, with price varying by asset count and billing cycle.

Verdict

Choose Wapiti if you need a no-cost, configurable scanner for authorized assessments of deployed websites or REST APIs and can manage its Python-based, on-premise operation. Its strongest case is the combination of authentication support, scope controls and broad reports without a license fee. Look elsewhere if you need a managed workflow or source-code analysis, or if the risk of disruption cannot be responsibly controlled.