Wapiti
The web-application vulnerability scanner.
Overview
Wapiti is a vulnerability scanner for web applications. It performs 'black-box' scans, which means it doesn't study the source code of the application but will scan the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets a list of URLs, forms and their inputs, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.
✨ Key Features
- SQL Injection
- Cross-Site Scripting (XSS)
- File Disclosure
- Command Execution
- CRLF Injection
🎯 Key Differentiators
- Focus on black-box web application scanning
- Open-source and easy to use for basic scans
- Supports both GET and POST HTTP methods for attacks
Unique Value: Provides a free and simple way to perform black-box security testing of web applications.
🎯 Use Cases (2)
✅ Best For
- Finding common web application vulnerabilities in a black-box manner
💡 Check With Vendor
Verify these considerations match your specific requirements:
- Scanning of modern, JavaScript-heavy web applications
- Organizations requiring a graphical user interface and advanced reporting
🏆 Alternatives
Easier to set up and use for basic scans compared to more comprehensive frameworks like OWASP ZAP or Burp Suite.
💻 Platforms
✅ Offline Mode Available
🔌 Integrations
💰 Pricing
Free tier: Fully featured and unlimited.
🔄 Similar Tools in Vulnerability Scanning
Tenable Nessus
A widely used vulnerability scanner for identifying vulnerabilities, misconfigurations, and malware ...
Qualys Vulnerability Management, Detection and Response (VMDR)
A cloud-based service that provides global visibility into IT assets and their vulnerabilities....
Rapid7 InsightVM
A data-rich resource that prioritizes vulnerabilities based on risk and helps you remediate them fas...
OpenVAS
A full-featured, open-source vulnerability scanner....
Acunetix
An automated web application security testing tool that helps you find and fix vulnerabilities....
Burp Suite
A graphical tool for testing Web application security....