Skip to content
SPECIFICTION
Get listed

Wapiti

wapiti-scanner.github.io

Free plan WindowsmacOSLinuxSelf-hosted
Visit wapiti-scanner.github.io
Spec score 7.9 #10 of 26 in Dynamic Application Security Testing Software

What it is

Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.

Spec sheet

Purpose
Wapiti audits websites and web applications with black-box scans that crawl deployed pages and test scripts and forms with payloads.Read 9 Oct 2026 · wapiti-scanner.github.io
Integrations
It uses the Wappalyzer database to fingerprint web technologies and report related CVE information, and its SSL/TLS module uses sslscan.Read 9 Oct 2026 · wapiti-scanner.github.io
Support
The project directs users to its FAQ, wiki, and GitHub issues for help and bug reports.Read 9 Oct 2026 · github.com
License
Wapiti is released under the GNU General Public License version 2 (GPL).Read 9 Oct 2026 · wapiti-scanner.github.io
API scanning
It can scan REST APIs using an OpenAPI (Swagger) file.Read 9 Oct 2026 · wapiti-scanner.github.io
Attack coverage
Its modules cover issues including SQL and LDAP injection, XSS, file disclosure, command execution, XXE, SSRF, open redirects, and TLS misconfiguration.Read 8 Oct 2026 · wapiti-scanner.github.io
Authentication
Wapiti supports Basic, Digest, and NTLM HTTP authentication, login forms, browser cookie import, and custom Python authentication scripts.Read 8 Oct 2026 · wapiti-scanner.github.io
Authentication and proxies
It supports Basic, Digest, and NTLM HTTP authentication, login-form authentication, and HTTP, HTTPS, and SOCKS5 proxies.Read 9 Oct 2026 · wapiti-scanner.github.io
Command-line tool
Wapiti is a command-line application written in Python.Read 9 Oct 2026 · github.com
Installation
The recommended installation method is pip install wapiti3, and the project requires Python 3.12, 3.13, or 3.14.Read 9 Oct 2026 · github.com
Integrations and data
The project describes Wappalyzer-based technology fingerprinting with related CVE information and use of the Nikto database to find potentially dangerous server files.Read 8 Oct 2026 · wapiti-scanner.github.io
Latest stable version
The official site lists version 3.3.1, released 2026-07-27, as the current stable version.Read 9 Oct 2026 · wapiti-scanner.github.io
Limit and disclaimer
The project warns that scans may cause target malfunctions, crashes, or data loss, and says users are responsible for obtaining prior consent and following applicable laws.Read 8 Oct 2026 · github.com
Price and license
Wapiti is described as free and open-source software released under the GNU General Public License version 2.Read 8 Oct 2026 · wapiti-scanner.github.io
Proxies and browser
Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser-based exploration through a man-in-the-middle proxy, and headless Firefox crawling.Read 8 Oct 2026 · wapiti-scanner.github.io
Reports
It generates reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.Read 9 Oct 2026 · wapiti-scanner.github.io
Scanning controls
It supports scan scope controls, URL exclusions, configurable crawler limits, and a maximum scan time.Read 9 Oct 2026 · wapiti-scanner.github.io
Security checks
Modules check HTTP security headers, cookie Secure and HttpOnly flags, CSP configuration, and TLS configuration.Read 8 Oct 2026 · wapiti-scanner.github.io
Supported systems
The installation instructions describe virtual environment activation for Linux, macOS, and Windows.Read 8 Oct 2026 · github.com
Usage limits
The project warns that scans can cause malfunctions, crashes, or data loss on a target, and says users must have the target owner's consent.Read 9 Oct 2026 · github.com
Vulnerability coverage
Its modules cover issues including SQL injection, XSS, file disclosure, command execution, XXE, SSRF, open redirects, and file upload vulnerabilities.Read 9 Oct 2026 · wapiti-scanner.github.io
Windows support
The project README says running Wapiti on Windows can be accomplished using WSL.Read 9 Oct 2026 · github.com

Plans and prices

Wapiti Free Open-source web application vulnerability scanner Read 9 Oct 2026 · wapiti-scanner.github.io

Every Wapiti plan and price →

Strong points and limits

Strong points

  • Free GPLv2 open-source software
  • Authenticated and API scanning
  • Multiple report output formats
  • Configurable scan scope and crawler behavior
  • Supports several proxy types

Limits

  • Command-line workflow requires technical setup
  • Windows use is described through WSL
  • Scans may cause crashes or data loss
  • Target-owner consent is required

Who it suits

Wapiti suits security practitioners who want self-hosted web, authenticated, and API scanning on supported systems. It is command-line software for users able to manage Python installation and scan authorization.

Verdict

Wapiti provides broad, configurable web application and API scanning without a listed software charge. Its command-line, self-hosted model and operational warnings require careful setup and authorized use.

Where Specifiction places it

Alternatives to WapitiAll alternatives →