w3af
What it is
w3af is a free, open-source scanner for web application vulnerability assessments and penetration tests. The project says it can identify more than 200 vulnerabilities, including cross-site scripting, SQL injection, and OS command injection. Its workflow uses crawler plugins to find URLs and injection points, audit plugins to test for vulnerabilities, and attack plugins to exploit findings. Other plugins cover infrastructure detection, request and response analysis, output, brute force, request modification, and evasion. Users can scan and analyze results through a GTK graphical interface or a console. The REST API lets developers use w3af from different programming languages and can run in Docker. Scripts and the API support automation, and web application payloads can interact with Metasploit when an exploit provides exec() capability. The scanner supports Linux and macOS, along with web, API, and self-hosted use. Its documentation warns that REST API traffic is unencrypted by default and recommends additional protection, such as an SSL proxy, for publicly reachable deployments.
For and against
For
- Identifies more than 200 vulnerability types
- Uses crawler, audit, and attack plugin stages
- Offers GTK and console interfaces
- Can run in Docker and supports automation
Against
- REST API traffic is unencrypted by default
- Public API deployments need added transport protection
The verdict
w3af provides a free scanning framework with plugin-based assessment, multiple interfaces, and API automation. Publicly reachable REST API deployments need extra transport protection.
Who it suits
w3af suits developers and penetration testers conducting web application vulnerability assessments. It offers both a graphical interface and console, plus API access and self-hosted deployment.
Plans and prices
w3af
Open-source web application security scanner
Read 9 Oct 2026 · github.com
On the record
- Additional plugins
- Other plugin types include infrastructure detection, request and response analysis, output, bruteforce, request modification, and evasion.docs.w3af.org · read 9 Oct 2026
- API authentication
- The REST API can require HTTP Basic authentication using a SHA512-hashed password.docs.w3af.org · read 9 Oct 2026
- API security
- The documentation says basic authentication does not encrypt REST API traffic and recommends additional precautions, such as placing a public API behind an SSL proxy.docs.w3af.org · read 9 Oct 2026
- API transport security
- The documentation warns that HTTP API traffic is unencrypted and recommends an SSL proxy for publicly reachable deployments; it also describes TLS/SSL options.docs.w3af.org · read 9 Oct 2026
- Assessment workflow
- The framework has crawl, audit, and attack plugins: crawlers find URLs and injection points, audit plugins test for vulnerabilities, and attack plugins exploit findings.docs.w3af.org · read 9 Oct 2026
- Automation
- The guide includes automation using scripts and a REST API.docs.w3af.org · read 9 Oct 2026
- Deployment
- The installation guide documents running w3af in Docker and provides installation instructions for Mac OS X.docs.w3af.org · read 9 Oct 2026
- Detection
- The project says the scanner can identify more than 200 vulnerabilities, including cross-site scripting, SQL injection, and OS command injection.github.com · read 9 Oct 2026
- Docker
- The installation guide describes running w3af in Docker without installing its dependencies, with Docker as the prerequisite.docs.w3af.org · read 9 Oct 2026
- Integrations
- The documentation describes Metasploit integration and suggests sending vulnerabilities to an internal issue tracker through its REST API.docs.w3af.org · read 9 Oct 2026
- Intended use
- The documentation describes w3af as an environment for web vulnerability assessments and penetration tests.docs.w3af.org · read 9 Oct 2026
- Metasploit
- Web application payloads can interact with Metasploit to upload and execute payloads when an exploit provides the exec() capability.docs.w3af.org · read 9 Oct 2026
- Other plugins
- Other plugin types include infrastructure, grep, output, mangle, bruteforce, and evasion plugins.docs.w3af.org · read 9 Oct 2026
- Project support
- The project repository says pull requests are welcome and names Holm Security as a sponsor.github.com · read 9 Oct 2026
- Purpose
- w3af is an open-source web application security scanner for developers and penetration testers to identify and exploit vulnerabilities.github.com · read 9 Oct 2026
- REST API
- The REST API lets developers use w3af as a service from any development language and can be run in a Docker container.docs.w3af.org · read 9 Oct 2026
- Scan workflow
- Its plugin workflow uses crawl plugins to discover URLs and injection points, audit plugins to test for vulnerabilities, and attack plugins to exploit findings.docs.w3af.org · read 9 Oct 2026
- Support
- For installation issues, the guide directs users to create a ticket and include their Linux distribution, dependency-install script, pip freeze output, and Python version.docs.w3af.org · read 9 Oct 2026
