Wapiti

Wapiti is a free, open-source command-line tool for auditing websites and web applications. It crawls pages and tests scripts and forms with injected payloads in black-box scans. Its modules cover SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file upload vulnerabilities, and TLS misconfiguration. It can scan REST APIs from an OpenAPI (Swagger) file and check security headers, cookie flags, CSP settings, and TLS configuration.

Users can limit scan scope, exclude URLs, adjust crawler behavior, set time limits, and configure concurrent HTTP tasks. Authentication options include Basic, Digest, and NTLM, login forms, imported browser cookies, and custom Python scripts. It supports HTTP, HTTPS, and SOCKS5 proxies, browser-based exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports are available in HTML, XML, JSON, TXT, CSV, and Markdown. Wapiti is installed with pip and requires Python 3.12, 3.13, or 3.14. The project warns that scans can cause malfunctions, crashes, or data loss, and requires users to obtain the target owner's consent and follow applicable laws.

Wapiti offers broad scan controls, authentication options, and reporting formats at no listed cost. Its command-line setup and warning about potential target impact make authorized, careful use essential.

It suits security practitioners who want to run self-hosted website, web application, or API scans from a command line. Users should be able to manage Python installation and obtain permission before scanning a target.

Wapiti is a self-hosted command-line scanner for websites, web applications, and REST APIs. It is best for security practitioners comfortable managing Python tools and defining scan boundaries. Its broad checks and flexible authentication make it useful for authorized audits, while its command-line workflow and potential impact on targets call for care.

Overview

Wapiti crawls pages, scripts, and forms, then tests them with injected payloads using a black-box approach. That makes it suitable for assessing running applications without depending on access to their source code. Coverage spans common web vulnerabilities and configuration checks, but scan results still need informed review and follow-up by someone who understands the application.

The project warns that scans can cause malfunctions, crashes, or data loss. Wapiti belongs in authorized assessments with a carefully limited scope; it is a poor fit for casual probing or systems whose owners have not consented.

Key features

Vulnerability checks and reports

Modules cover SQL and LDAP injection, cross-site scripting, file disclosure and upload vulnerabilities, command execution, XXE, SSRF, open redirects, and TLS misconfiguration. Other checks examine HTTP security headers, cookie Secure and HttpOnly flags, and CSP configuration. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown, giving teams useful choices for review and processing.

Scan control and authentication

Users can limit scope, exclude URLs, tune crawler behavior, set time limits, and configure concurrent HTTP tasks. These controls help keep scans aligned with an assessment, though they place responsibility for safe settings on the operator. Authentication supports Basic, Digest, and NTLM HTTP methods, login forms, imported browser cookies, and custom Python scripts, which helps with protected applications but assumes more setup than a point-and-click workflow.

Proxies, browsers, and APIs

Wapiti works with HTTP, HTTPS, and SOCKS5 proxies, supports browser exploration through a man-in-the-middle proxy, and can crawl with headless Firefox. It can also scan REST APIs from an OpenAPI (Swagger) file. Together these options make it more adaptable to authenticated and API-focused assessments than a crawler limited to public pages.

Technology data

Wappalyzer-based fingerprinting can report related CVE information, while the Nikto database helps identify potentially dangerous server files. The SSL/TLS module uses sslscan. These integrations add useful context to an audit, but they do not replace validation of findings against the target.

Pricing

Wapiti is free and open source under the GNU General Public License version 2. Its Wapiti plan costs nothing and includes the web application vulnerability scanner. There is no free trial because the software is already free. No paid plan or usage quota is described, so teams can avoid a subscription while accepting responsibility for installation, operation, and safe scanning.

Platforms

Wapiti is a Python command-line application that can be installed with pip install wapiti3. Installation instructions require Python 3.12, 3.13, or 3.14 and cover Linux, macOS, and Windows virtual environments; the README says Windows use can be accomplished through WSL. It is self-hosted, which gives operators control of the environment but requires them to manage it themselves.

Who it's for

Wapiti is a strong fit for developers, security teams, and technically capable assessors who need configurable black-box scans, authenticated crawling, API coverage, and several report formats without a license charge. It is less suitable for users who expect a graphical interface, guided setup, or a managed scanning service. The project points users to its wiki and FAQ for help and asks bug reporters to file GitHub issues.

Pros and cons

• Pros: Broad vulnerability and configuration coverage gives auditors one tool for many common web checks.
• Pros: Authentication choices, proxies, browser-based exploration, and OpenAPI scanning support varied application setups.
• Pros: Six report formats and no license cost make it practical for teams with different review workflows and budgets.
• Cons: The command-line Python installation requires technical setup and operation.
• Cons: Scans can disrupt a target or cause data loss, so careless or unauthorized use carries real operational risk.

Alternatives

For a broader directory of options, see Dynamic Application Security Testing Software.

OWASP ZAP is another free, open-source choice for readers comparing self-hosted web security tools. w3af is also a free, open-source web application security scanner. Choose Beagle Security if its free tier of one lite test per month, monthly surface scan reports, and SSL and domain expiry monitoring suits your needs; its Essential plan is $99 a month, billed Billed $1188 annual. DASTA-AI offers a free Demo with one scan and a Personal plan at $100 a month for 30 scans per month; its Pro plan covers 300 scans per month with custom pricing. Detectify Surface Monitoring has a Starter plan at no cost, billed annual platform fee, with up to five users and one team; Surface Monitoring costs extra per domain. Its Standard plan is €2,500 a year, billed annual. Qualys External Attack Surface Management has a 30-day no-cost trial of CSAM with EASM. For readers seeking tailored commercial solutions, Bright Security DAST and Burp Suite DAST offer alternatives.

Verdict

Choose Wapiti if you can manage a Python command-line tool and want a free, configurable scanner for authorized website and API assessments. Its strongest case is the combination of broad checks, authentication options, and flexible reporting without a license fee. Look elsewhere if your team needs a graphical or managed workflow, or cannot safely control scans that may affect the target.