OWASP ZAP vs Wapiti

OWASP ZAP is a web application scanner and proxy for security testing. Its tools include active and passive scanning, a spider, alerts, and scan policies. ZAP’s Automation Framework uses YAML plans to coordinate jobs such as scanning, spidering, API imports, and report generation. It can import OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons. GitHub Actions are available for baseline, full, and API scans via Docker-packaged scans, and the project publishes Docker images, including a minimal image for CI. Add-ons come from an online Marketplace and are generally installed or removed without restarting ZAP. The software is free and open source, with a free plan at free. It supports Linux, macOS, Windows, API use, and self-hosted deployment. Windows and Linux installers require Java 17 or later; the macOS installer includes Java 17. ZAP says it can support only its latest full release, and current releases are unsigned, though checksums are provided.

Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.