Astra DAST Scanner vs Wapiti
Astra DAST Scanner
getastra.comWapiti
wapiti-scanner.github.ioSide by side
| Figure | Astra DAST Scanner | Wapiti |
|---|---|---|
| Price from | $58.25/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | — | Yes |
| Plans published | 7 | 1 |
| Spec score · Dynamic Application Security Testing Software | 8.3 (#6) | 7.9 (#10) |
| API scanning | It scans REST, SOAP, and GraphQL APIs with authenticated or unauthenticated scans and can create an API inventory from DAST scans. | It can scan REST APIs using an OpenAPI (Swagger) file. |
| Authentication | Authenticated scanning supports login forms, TOTP-based MFA through custom login scripts, static OTPs, test accounts without MFA, and manual authentication headers. | Wapiti supports Basic, Digest, and NTLM HTTP authentication, login forms, browser cookie import, and custom Python authentication scripts. |
| Integrations | The product page names GitHub Actions, GitLab CI, Jenkins, and Bitbucket for CI/CD, plus Slack alerts and JIRA ticket creation. | It uses the Wappalyzer database to fingerprint web technologies and report related CVE information, and its SSL/TLS module uses sslscan. |
Plans
Astra DAST Scanner
- $7 trial$7, paid once
- Scanner Lite$69 a month
- Scanner$199 a month
- Scanner Agency$499 a month
- Scanner Lite$699 a year
- Scanner$1,999 a year
- Scanner Agency$4,999 a year
In their own words
Astra DAST Scanner
Astra DAST Scanner has no write-up on Specifiction yet; its figures are above.
Wapiti
Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.