Veracode DAST vs Wapiti

Veracode DAST scans live web applications and REST APIs for security vulnerabilities. It can test authenticated or unauthenticated assets, including applications behind firewalls, and inspect API endpoints and workflows to validate business logic. Scans can run automatically or on a schedule, with configurable depth, speed, and accuracy; the cloud-native engine is designed for hundreds of assets across environments. Veracode reports a false positive rate below 5%. CI/CD connections are available through webhooks or the Veracode CLI, and reports can be downloaded as PDF, JUnit, or CSV files. A Quick scan takes approximately three to five minutes and runs non-invasive checks for basic misconfigurations. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. A free 14-day trial is available through the Veracode Platform, while pricing is on request. The service is offered as SaaS with hybrid deployment options. Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform.

Wapiti is a free, open-source command-line scanner for auditing websites and web applications with black-box crawling and injected tests. Its modules check SQL and LDAP injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, open redirects, file uploads, and TLS configuration. It can scan REST APIs from OpenAPI files and inspect security headers, cookie flags, CSP settings, and related controls. Authentication options include Basic, Digest, NTLM, login forms, browser-cookie import, and custom Python scripts. Wapiti supports HTTP, HTTPS, and SOCKS5 proxies, browser exploration through a man-in-the-middle proxy, and headless Firefox crawling. Reports can be exported as HTML, XML, JSON, TXT, CSV, or Markdown. Users can limit scope, exclude URLs, adjust crawler behavior, set time limits, and control concurrent tasks. Installation uses pip and requires Python 3.12, 3.13, or 3.14. It runs on Linux, macOS, and Windows through WSL, with self-hosted deployment.