StackHawk HawkScan vs Wapiti
StackHawk HawkScan
stackhawk.comWapiti
wapiti-scanner.github.ioSide by side
| Figure | StackHawk HawkScan | Wapiti |
|---|---|---|
| Price from | $10/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Dynamic Application Security Testing Software | 7.9 (#9) | 7.9 (#10) |
| Integrations | The documentation lists CI/CD integrations including GitHub Actions, GitLab CI/CD, Azure Pipelines, Jenkins, CircleCI, and Bitbucket Pipelines, plus workflow integrations such as Slack, Jira Cloud, Microsoft Teams, and GitHub CodeQL. | It uses the Wappalyzer database to fingerprint web technologies and report related CVE information, and its SSL/TLS module uses sslscan. |
| Support | The pricing comparison lists Standard support for Wingman and Enterprise support for Scale. | The project directs users to its FAQ, wiki, and GitHub issues for help and bug reports. |
| Vulnerability coverage | Wingman lists examples from more than 150 vulnerability types, including SQL injection, sensitive data exposure, cross-site scripting, and remote code execution. | Its modules cover issues including SQL injection, XSS, file disclosure, command execution, XXE, SSRF, open redirects, and file upload vulnerabilities. |
Plans
StackHawk HawkScan
- Wingman by StackHawk$10 a month
- StackHawk ScalePriced on request
In their own words
StackHawk HawkScan
StackHawk HawkScan has no write-up on Specifiction yet; its figures are above.
Wapiti
Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.