Wapiti

Wapiti is a free, open-source command-line scanner for auditing websites, web applications, and REST APIs. It suits technically comfortable users who can run Python tools and control scan scope; its breadth and configurable authentication are useful, but scans can disrupt targets, so consent is essential.

Overview

Wapiti crawls web pages and tests scripts and forms with injected payloads, taking a black-box approach that does not depend on application source code. Its modules cover a broad range of web risks, from injection and cross-site scripting to server-side request forgery and TLS misconfiguration. Because it runs from the command line and is self-hosted, it is best suited to users who can manage their own environment and interpret scan results.

The project warns that scans may cause malfunctions, crashes, or data loss. Obtain the target owner's consent, follow applicable laws, and set a deliberate scope before scanning; Wapiti is not a safe choice for probing systems without authorization.

Key features

Coverage and reporting

Modules test for SQL and LDAP injection, XSS, file disclosure and upload vulnerabilities, command execution, XXE, SSRF, open redirects, and TLS misconfiguration. Checks also cover HTTP security headers, cookie Secure and HttpOnly flags, and CSP configuration. Reports can be generated in HTML, XML, JSON, TXT, CSV, or Markdown, giving teams several formats for review or downstream handling.

Control and authenticated scans

Users can constrain scan scope, exclude URLs, adjust crawler behavior, set time limits, and configure concurrent HTTP tasks. Those controls help keep scans focused, though they also place responsibility on the operator to choose settings that suit the target. Authentication options include Basic, Digest, and NTLM HTTP authentication, login forms, imported browser cookies, and custom Python scripts—useful for testing areas that an unauthenticated crawl cannot reach.

Browser, proxy, and API support

Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. It can also scan REST APIs from an OpenAPI (Swagger) file. Wappalyzer-based technology fingerprinting supplies related CVE information, while the Nikto database helps identify potentially dangerous server files; its SSL/TLS module uses sslscan.

Pricing

Wapiti is free and open-source under the GNU General Public License version 2. The Wapiti plan costs nothing and provides an open-source web application vulnerability scanner. There is no free trial because the software itself is free. Self-hosting avoids a paid plan, but users need to install and operate the command-line tool themselves.

Platforms

Wapiti is a Python command-line application installable with pip install wapiti3. The installation instructions require Python 3.12, 3.13, or 3.14 and describe virtual-environment activation for Linux, macOS, and Windows. The README says Windows use can be accomplished with WSL. It is self-hosted rather than a hosted scanning service.

Who it's for

Wapiti is a strong fit for developers and security practitioners who want a configurable, no-cost scanner they can run against authorized web applications and APIs. Authentication methods, scan controls, and multiple report formats make it adaptable to varied targets. It is a weaker fit for readers seeking a graphical, managed service or a tool that removes the need to configure and oversee scans. Help is directed to the project wiki and FAQ; bug reports go through GitHub issues.

Pros and cons

• Pros: Broad vulnerability coverage, including API testing, authenticated scanning, browser-based crawling, and multiple report formats, makes one free tool useful across varied web targets.
• Pros: Scope exclusions, crawler controls, time limits, and concurrency settings give operators practical ways to tailor a scan.
• Cons: The command-line, Python-based setup requires technical comfort and local operation; it is not a hosted service.
• Cons: Scans can cause target disruption or data loss, so unauthorized or poorly scoped use carries real risk.

Alternatives

For another free, open-source scanner, compare OWASP ZAP; choose w3af if its free web application security scanner better fits your workflow. Readers considering paid or freemium options can also compare Qualys External Attack Surface Management, Beagle Security, Detectify Surface Monitoring, Bright Security DAST, DASTA-AI, and Veracode DAST.

Browse more options in Dynamic Application Security Testing Software.

Verdict

Choose Wapiti if you want a free, self-hosted black-box scanner with configurable scope, authentication support, API scanning, and broad report formats—and are prepared to operate it carefully. Look elsewhere if you need managed deployment or cannot accept the operational risk of scans that may affect a target.