Checkmarx DAST vs Wapiti
Checkmarx DAST
checkmarx.comWapiti
wapiti-scanner.github.ioSide by side
| Figure | Checkmarx DAST | Wapiti |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Dynamic Application Security Testing Software | 7.7 (#11) | 7.9 (#10) |
| Authentication | DAST supports browser-recorded login flows, two-factor authentication, and instant verification for application coverage. | Wapiti supports Basic, Digest, and NTLM HTTP authentication, login forms, browser cookie import, and custom Python authentication scripts. |
| Integrations | Checkmarx lists CI/CD integrations including Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, and SonarQube. | It uses the Wappalyzer database to fingerprint web technologies and report related CVE information, and its SSL/TLS module uses sslscan. |
| Purpose | Checkmarx DAST is a language-agnostic tool that tests live web applications and APIs by simulating real-world attacks. | Wapiti audits websites and web applications with black-box scans that crawl deployed pages and test scripts and forms with payloads. |
| Support | Premium Support includes 24/7 coverage and a two-hour response time for critical P1 issues; Standard Support lists six hours for P1 issues during working hours on business days. | The project directs users to its FAQ, wiki, and GitHub issues for help and bug reports. |
Plans
In their own words
Checkmarx DAST
Checkmarx DAST has no write-up on Specifiction yet; its figures are above.
Wapiti
Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.