Skip to content
SPECIFICTION
Get listed

w3af

w3af.org

Free plan WebmacOSLinuxAPISelf-hosted
Visit w3af.org
Spec score 8.2 #7 of 26 in Dynamic Application Security Testing Software

What it is

w3af is a free, open-source web application security scanner for vulnerability assessments and penetration tests. It can identify more than 200 vulnerabilities, including cross-site scripting, SQL injection, and OS command injection. Its workflow starts with crawler plugins that find URLs and injection points, continues with audit plugins that check for vulnerabilities, and can use attack plugins to exploit findings. Other plugin types cover infrastructure detection, request and response analysis, output, brute force, request modification, and evasion.

Users can scan and analyze results in a GTK graphical interface or a console. Web application payloads can interact with Metasploit when an exploit provides exec() capability. Developers can use the REST API from development languages and run it in Docker; scripts and the API also support automation. The project documents Linux and macOS installation, including running in Docker without installing w3af dependencies. It is available for Linux, macOS, web, API, and self-hosted deployment. REST API traffic over HTTP is unencrypted, so the documentation recommends added protection such as an SSL proxy for publicly reachable deployments.

Spec sheet

Purpose
w3af is an open-source web application security scanner for developers and penetration testers to identify and exploit vulnerabilities.Read 9 Oct 2026 · github.com
Platforms
The installation guide says w3af has been tested on Linux distributions, Mac OS X, FreeBSD, and OpenBSD; it does not recommend or support Windows installation.Read 9 Oct 2026 · docs.w3af.org
Deployment
The installation guide documents running w3af in Docker and provides installation instructions for Mac OS X.Read 9 Oct 2026 · docs.w3af.org
Integrations
The documentation describes Metasploit integration and suggests sending vulnerabilities to an internal issue tracker through its REST API.Read 9 Oct 2026 · docs.w3af.org
Support
For installation issues, the guide directs users to create a ticket and include their Linux distribution, dependency-install script, pip freeze output, and Python version.Read 9 Oct 2026 · docs.w3af.org
Additional plugins
Other plugin types include infrastructure detection, request and response analysis, output, bruteforce, request modification, and evasion.Read 9 Oct 2026 · docs.w3af.org
API authentication
The REST API can require HTTP Basic authentication using a SHA512-hashed password.Read 9 Oct 2026 · docs.w3af.org
API security
The documentation says basic authentication does not encrypt REST API traffic and recommends additional precautions, such as placing a public API behind an SSL proxy.Read 9 Oct 2026 · docs.w3af.org
API transport security
The documentation warns that HTTP API traffic is unencrypted and recommends an SSL proxy for publicly reachable deployments; it also describes TLS/SSL options.Read 9 Oct 2026 · docs.w3af.org
Assessment workflow
The framework has crawl, audit, and attack plugins: crawlers find URLs and injection points, audit plugins test for vulnerabilities, and attack plugins exploit findings.Read 9 Oct 2026 · docs.w3af.org
Automation
The guide includes automation using scripts and a REST API.Read 9 Oct 2026 · docs.w3af.org
Detection
The project says the scanner can identify more than 200 vulnerabilities, including cross-site scripting, SQL injection, and OS command injection.Read 9 Oct 2026 · github.com
Docker
The installation guide describes running w3af in Docker without installing its dependencies, with Docker as the prerequisite.Read 9 Oct 2026 · docs.w3af.org
Intended use
The documentation describes w3af as an environment for web vulnerability assessments and penetration tests.Read 9 Oct 2026 · docs.w3af.org
Metasploit
Web application payloads can interact with Metasploit to upload and execute payloads when an exploit provides the exec() capability.Read 9 Oct 2026 · docs.w3af.org
Other plugins
Other plugin types include infrastructure, grep, output, mangle, bruteforce, and evasion plugins.Read 9 Oct 2026 · docs.w3af.org
Project support
The project repository says pull requests are welcome and names Holm Security as a sponsor.Read 9 Oct 2026 · github.com
REST API
The REST API lets developers use w3af as a service from any development language and can be run in a Docker container.Read 9 Oct 2026 · docs.w3af.org
Scan workflow
Its plugin workflow uses crawl plugins to discover URLs and injection points, audit plugins to test for vulnerabilities, and attack plugins to exploit findings.Read 9 Oct 2026 · docs.w3af.org
Support channels
The project documentation links to user and developer mailing lists and an IRC channel.Read 9 Oct 2026 · docs.w3af.org
User interface
w3af provides a GTK graphical interface for scanning and analyzing results, as well as a console interface.Read 9 Oct 2026 · docs.w3af.org
User interfaces
The documentation covers a console and a GTK graphical user interface.Read 9 Oct 2026 · docs.w3af.org
Vulnerability coverage
The project repository says the scanner can identify more than 200 vulnerabilities, including cross-site scripting, SQL injection, and OS command injection.Read 9 Oct 2026 · github.com

Plans and prices

w3af Free Open-source web application security scanner Read 9 Oct 2026 · github.com

Every w3af plan and price →

Strong points and limits

Strong points

  • Identifies more than 200 vulnerability types.
  • Crawl, audit, and attack plugins support a staged assessment.
  • Offers both GTK graphical and console interfaces.
  • REST API and scripts support automation.
  • Free at free.

Limits

  • REST API HTTP traffic is unencrypted by default.
  • Publicly reachable APIs need additional transport protection.

Who it suits

w3af suits developers and penetration testers conducting web vulnerability assessments. Its interfaces, plugins, REST API, and Docker deployment offer several ways to run scans and work with results.

Verdict

w3af brings vulnerability discovery, testing, and exploitation into one plugin-based scanning framework. Anyone exposing its REST API should account for the documented transport-security limitation.

Where Specifiction places it

Alternatives to w3afAll alternatives →