Offensive360 DAST vs Wapiti
Offensive360 DAST
offensive360.comWapiti
wapiti-scanner.github.ioSide by side
| Figure | Offensive360 DAST | Wapiti |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Dynamic Application Security Testing Software | 7.6 (#13) | 7.9 (#10) |
| Purpose | DAST tests live web applications and APIs using a headless browser, more than 40 active exploit checks, and 19 passive analyzers. | Wapiti audits websites and web applications with black-box scans that crawl deployed pages and test scripts and forms with payloads. |
| Vulnerability coverage | Checks include injection, cross-site scripting, authentication, access control, SSRF, API flaws, and known CVEs in listed technologies and frameworks. | Its modules cover issues including SQL injection, XSS, file disclosure, command execution, XXE, SSRF, open redirects, and file upload vulnerabilities. |
Plans
Offensive360 DAST
- Application SecurityPrice not published
- On-PremisePrice not published
In their own words
Offensive360 DAST
Offensive360 DAST has no write-up on Specifiction yet; its figures are above.
Wapiti
Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.