Safeguard DAST vs Wapiti

Safeguard DAST dynamically tests running applications, reporting findings alongside how much discovered attack surface the scan reached. Its graph-aware crawler uses Safeguard SAST call graphs, route tables, and authentication middleware. Endpoint inventories can come from OpenAPI, GraphQL introspection, gRPC reflection, and live traffic samples. Targeted payloads cover SQL, OS command, SSRF, XSS, and deserialization sink classes, with parameter shapes informing generation. Authenticated flows include form authentication, OAuth 2.0 refresh, JWT bearer, session cookies, SAML, and mutual TLS. Listed scan modes are Fast, Deep, Progressive, and Reconnaissance; Reconnaissance sends no probes. Coverage Score explains reached surface and stopping reasons, while stated coverage includes the OWASP Top 10 and API Top 10. JavaScript, JSON, and source maps are analyzed for exposed credentials, routes, endpoints, cloud references, personal data, configuration, and comments. Secret samples are redacted, ownership verification gates requests, and scope, rate, and budget limits constrain them. It supports self-hosted and web use, hybrid deployment, CI integrations, pull-request and IDE workflows, and listed infrastructure analyses. Pricing is freemium: Free plan; paid from $9/mo.

Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.