Wapiti
What it is
Wapiti is a Python tool for scanning deployed websites and web applications for vulnerabilities. It crawls applications and sends payloads to links, forms, and scripts rather than examining source code. Its listed checks include SQL and XPath injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, and open redirects. It can scan REST APIs from an OpenAPI (Swagger) file and supports authenticated scans using Basic, Digest, or NTLM authentication, login forms, browser cookie imports, or custom Python code. Users can configure scan scope, crawler limits, HTTP headers, and HTTP, HTTPS, or SOCKS5 proxies. Sessions stored in SQLite let scans be suspended and resumed. Reports can be generated in HTML, XML, JSON, TXT, CSV, and Markdown formats. The project lists Python 3.12, 3.13, or 3.14 as requirements, and says Windows use can be done through WSL. Wapiti is free under GNU GPL version 2, with installation offered through pip. Its README warns scans can disrupt targets, cause crashes, or lead to data loss; users need the target owner's consent.
For and against
For
- Scans REST APIs from OpenAPI files.
- Supports multiple authentication methods.
- Scan sessions can be suspended and resumed.
- Reports are available in six formats.
Against
- Requires Python 3.12, 3.13, or 3.14.
- Windows use is through WSL.
- Scans may cause malfunctions, crashes, or data loss.
- Target-owner consent is required.
The verdict
Wapiti provides configurable crawling, authenticated scanning, and several report formats at no cost. Use it only with the target owner's consent, since assessments can disrupt systems or lose data.
Who it suits
Wapiti suits people responsible for assessing deployed websites or web applications, including authenticated sites and REST APIs. It requires one of the listed Python versions.
Plans and prices
Free and open-source
GNU GPL version 2
Read 3 Oct 2026 · github.com
On the record
- API scanning
- It can scan REST APIs from an OpenAPI (Swagger) file.github.com · read 3 Oct 2026
- Authentication
- It supports Basic, Digest, and NTLM authentication, login forms, browser cookie imports, and custom Python code for complicated authentication cases.github.com · read 3 Oct 2026
- Installation
- The project homepage offers installation with pip install wapiti3.wapiti.sourceforge.io · read 3 Oct 2026
- Latest listed release
- The project's SourceForge files page lists version 3.3.2 dated 2026-08-19.sourceforge.net · read 3 Oct 2026
- License
- The README states that Wapiti is released under the GNU General Public License version 2.github.com · read 3 Oct 2026
- Purpose
- Wapiti is a Python web vulnerability scanner that audits websites and web applications.github.com · read 3 Oct 2026
- Reports
- It generates reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.github.com · read 3 Oct 2026
- Requirements
- The README lists Python 3.12, 3.13, or 3.14 as requirements and says Windows use can be done through WSL.github.com · read 3 Oct 2026
- Safety and limits
- The README warns that assessments may cause target malfunctions, crashes, or data loss, and says users need the target owner's consent.github.com · read 3 Oct 2026
- Scan method
- It crawls deployed web applications and tests links, forms, and scripts with payloads without examining source code.github.com · read 3 Oct 2026
- Scan sessions
- It can suspend and resume scans using sessions stored in SQLite databases.github.com · read 3 Oct 2026
- Support
- The project README directs users to its FAQ and invites bug reports through GitHub issues.github.com · read 3 Oct 2026
- Traffic and scan controls
- It supports HTTP, HTTPS, and SOCKS5 proxies, configurable scan scope, crawler limits, and custom HTTP headers.github.com · read 3 Oct 2026
- Vulnerability coverage
- Its listed checks include SQL and XPath injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects.github.com · read 3 Oct 2026
