Wapiti

Wapiti is a free, self-hosted command-line scanner for websites, web applications, and REST APIs. It is strongest for technically equipped teams that want configurable, authenticated black-box scans and flexible reports; its Python requirements and lack of a graphical interface narrow its audience.

Overview

Wapiti crawls pages, scripts, and forms, then probes them with injected payloads without relying on application source code. Its broad web-risk coverage and control over scan scope make it a practical option for security work on systems you are authorized to assess. The trade-off is operational responsibility: Wapiti runs in your environment, and the project warns scans can cause malfunctions, crashes, or data loss. Get the target owner's consent and follow applicable laws before scanning.

Key features

Coverage and reports

Modules check for SQL and LDAP injection, cross-site scripting (XSS), file disclosure and upload vulnerabilities, command execution, XXE, SSRF, open redirects, and TLS misconfiguration. It also checks HTTP security headers, cookie Secure and HttpOnly flags, and CSP configuration. Reports in HTML, XML, JSON, TXT, CSV, and Markdown suit different review and processing workflows.

Scope, authentication, and crawling

Users can exclude URLs, set scan time limits, tune crawler behavior, and control concurrent HTTP tasks. Authentication options include Basic, Digest, and NTLM, login forms, imported browser cookies, and custom Python scripts. Browser-based exploration through a man-in-the-middle proxy and headless Firefox crawling extend its reach beyond basic crawling, while HTTP, HTTPS, and SOCKS5 proxy support helps fit it into different network setups. These controls are useful for authenticated applications, but they require users to configure and manage the scan themselves.

APIs and technology context

Wapiti can scan REST APIs from OpenAPI (Swagger) files. Wappalyzer-based technology fingerprinting connects detected technologies with related CVE information, and the Nikto database helps identify potentially dangerous server files. Its SSL/TLS module uses sslscan. These checks add useful context, though they do not remove the need to assess findings in the target's context.

Pricing

Wapiti is free and open-source under the GNU General Public License version 2. The Wapiti plan costs nothing and includes the open-source web application vulnerability scanner. There is no free trial because the software is free; no paid tier is presented. That makes it accessible without a subscription, but users must supply and maintain their own scanning environment.

Platforms

Wapiti is a Python command-line application installed with pip install wapiti3. Installation instructions require Python 3.12, 3.13, or 3.14 and describe virtual environment activation on Linux, macOS, and Windows. The README says Windows use can be accomplished through WSL. Its self-hosted deployment gives users control over where scans run, but Python setup and command-line operation are prerequisites rather than optional extras.

Who it's for

Wapiti fits security practitioners and development teams who can run Python software, define safe scan boundaries, and work with command-line output. Authenticated crawling and OpenAPI input make it relevant to teams assessing login-protected applications or REST APIs. It is a poor fit for users who need a graphical-only scanner or cannot meet the Python version requirements. Help is directed through the project wiki and FAQ; bug reports go to GitHub issues.

Pros and cons

Pros

• Broad web coverage: Its modules address injection, XSS, file risks, server-side request forgery, and configuration issues in one scanner.
• Flexible authenticated scanning: Multiple HTTP authentication methods, login forms, cookie import, and custom scripts help reach protected areas.
• Useful output and API support: Six report formats and OpenAPI-based REST API scanning accommodate varied workflows.
• Free and self-hosted: GPL-licensed software can run in an environment the user controls without a paid plan.

Cons

• Command-line and Python required: Users must manage installation and scanning from a Python environment meeting the stated version requirement.
• Scanning carries risk: The project cautions that scans may disrupt targets or cause data loss, making authorization and careful scope essential.
• Windows setup may require WSL: The README's stated Windows approach adds an environment step for Windows users.

Alternatives

Browse dynamic application security testing software for more options. OWASP ZAP is another free, open-source choice for teams seeking a scanner with Linux, macOS, Windows, API, and self-hosted platform support. w3af is another free, open-source web application security scanner for readers comparing self-hosted tools.

Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM trial for readers who want to evaluate that freemium product. Beagle Security may suit readers who prefer a web-based option with a free plan for one lite test per month, monthly surface scan reports, and SSL and domain expiry monitoring; its Essential plan is $99 a month, billed $1188 annually. DASTA-AI offers a one-scan Demo and a Personal plan with 30 scans per month at $100 a month, for readers comparing scan-count-based plans.

Detectify Surface Monitoring has a Starter plan with up to five users and one team at no cost, billed as an annual platform fee, with Surface Monitoring costing extra per domain; it may suit readers weighing that structure. Bright Security DAST is an alternative for readers considering a paid DAST product with demo requests and custom pricing. Burp Suite DAST is another paid option with tailored pricing based on portfolio size.

Verdict

Choose Wapiti if you need a free, self-hosted scanner that can handle authenticated web applications and OpenAPI-described REST APIs, with controls for shaping scans and reports. Its main advantage is that breadth without a license fee; its main drawback is the technical and operational burden of command-line Python setup and scans that can affect targets. If those demands do not fit your team, consider a different tool.