GO KALI FREE

Wapiti

Web Application

Intermediatemedium risk

Wapiti allows you to audit the security of your websites or web applications. It performs black-box scanning by crawling pages and injecting payloads to discover vulnerabilities like SQL injection, XSS, and file inclusions.

Installation

sudo apt install wapiti

Basic Syntax

wapiti -u <URL>

Quick Facts

Full Name
Wapiti
License
GPL v2
Written In
Python
Platforms
Linux, macOS, Windows
Category
Web Vulnerability Scanner
Modules
SQLi, XSS, LFI, Command Injection, CRLF, XXE
First Release
2007
Author
Nicolas Surribas

Tool Overview

Wapiti is a powerful black-box web application vulnerability scanner that automatically crawls websites and tests for security flaws. It supports multiple attack modules including SQL injection, cross-site scripting (XSS), file inclusion, command execution, CRLF injection, and XXE vulnerabilities.

The scanner works by first crawling the target website to discover all pages, forms, and parameters. It then systematically tests each input point with payloads appropriate to each vulnerability type, classifying findings by severity and generating detailed HTML reports.

Security professionals use Wapiti as part of their web application testing toolkit, often combining it with manual testing and other specialized scanners for comprehensive coverage.

Common Commands

wapiti -hDisplay the full help listing of options and modules
wapiti --versionPrint the installed Wapiti version
wapiti -u http://example.com/Crawl and scan a target web application with default modules
wapiti --list-modulesList every available attack module Wapiti can run
wapiti -u http://example.com/ -m xssRun only the XSS attack module against the target
wapiti -u http://example.com/ -m "sql,xss,exec"Run a chosen subset of modules by name
wapiti -u http://example.com/ -m allEnable every attack module for a thorough scan
wapiti -u http://example.com/ -l 2Raise the attack thoroughness level for deeper testing
wapiti -u http://example.com/ --scope domainLimit crawling and attacks to the whole domain
wapiti -u http://example.com/ -d 5Set the maximum crawl depth to five levels
wapiti -u http://example.com/ --max-links-per-page 20Cap how many links are followed per page while crawling
wapiti -u http://example.com/ -x http://example.com/logoutExclude a URL from crawling and attacks
wapiti -u http://example.com/ -p http://127.0.0.1:8080Route all traffic through an HTTP proxy such as Burp
wapiti -u http://example.com/ --torSend requests through a local Tor SOCKS proxy
wapiti -u http://example.com/ -c cookies.jsonLoad session cookies from a JSON cookie file

Step-by-Step Guide

  1. 1Determine the root URL of the application to test
  2. 2Permit the tool to spider the site and map its structure
  3. 3Examine the list of inputs and variables it discovers
  4. 4Allow the automated injection sequences to complete
  5. 5Study the finalized report to understand the findings

Warnings

Use Cases

Automated Vulnerability Detection

Crawl web applications and automatically test for SQL injection, XSS, and file inclusion vulnerabilities.

Security Auditing

Perform comprehensive security audits of web applications during development or pre-deployment.

Penetration Testing Support

Use automated scanning results to guide manual penetration testing efforts.

Compliance Verification

Verify that web applications meet security compliance requirements through automated scanning.

Vulnerability Classification

Generate severity-classified vulnerability reports with detailed payload and parameter information.

Related Tools

Nikto

Vulnerability Analysis

Open source web server scanner for misconfigurations and outdated software.

Nuclei

Vulnerability Analysis

Template-based vulnerability scanner with community-contributed templates.

SQLMap

Web Application

Automated SQL injection detection and exploitation tool with database takeover.

Dirb

Web Application

Web content scanner that brute-forces directory and file names on web servers.

WhatWeb

Web Application

Web technology fingerprinting tool that identifies frameworks, CMS, and libraries.

Frequently Asked Questions

What is Wapiti used for?

Wapiti is a black-box web application vulnerability scanner that crawls websites and injects payloads to detect SQL injection, XSS, file inclusion, command execution, CRLF injection, and other common web vulnerabilities.

How does Wapiti differ from Nikto?

Wapiti performs deep application-level scanning by crawling pages and testing parameters, while Nikto focuses on server-level checks like outdated software and misconfigurations.

Does Wapiti require authentication?

Wapiti can handle basic authentication through command-line options, but complex session-based authentication may require manual cookie configuration or browser proxy setup.

Can Wapiti scan APIs?

Yes, Wapiti can scan REST APIs by specifying the URL structure. It will crawl endpoints and test parameters for vulnerabilities, though dedicated API scanners may be more effective.

What web vulnerabilities does Wapiti detect?

Wapiti detects SQL injection, XSS, file inclusion (LFI/RFI), command execution, CRLF injection, XXE vulnerabilities, and open redirects through automated payload injection.

How does Wapiti crawl websites?

Wapiti uses a built-in crawler that follows links, parses forms, and extracts URL parameters. It builds a map of the application structure before testing each discovered input point.

Can Wapiti test authenticated pages?

Yes, Wapiti supports authentication via cookies, custom headers, or basic auth. You can provide a cookies file or use login scripts to access authenticated sections of the application.

How does Wapiti handle scanning reports?

Wapiti generates detailed HTML reports listing each vulnerability with the affected URL, parameter, payload used, severity classification, and recommended remediation steps.

Is Wapiti suitable for compliance testing?

Wapiti can be part of compliance testing by identifying common web vulnerabilities required by standards like OWASP Top 10. However, it should be combined with manual testing for comprehensive compliance coverage.

What is the difference between Wapiti and SQLMap?

Wapiti is a multi-vulnerability scanner that tests for many types of web flaws. SQLMap is specialized for SQL injection detection and exploitation with database takeover capabilities.

How do I scan only specific vulnerability types with Wapiti?

Use the -m flag to select specific modules: wapiti -u http://target.com -m sql,xss,lf. Available modules include sql (SQL injection), xss (cross-site scripting), lfi (local file inclusion), and more.

Can Wapiti scan SPAs (Single Page Applications)?

Wapiti's crawler handles basic JavaScript but may miss dynamic content in heavy SPAs. For comprehensive SPA testing, combine Wapiti with tools that support headless browser crawling like Burp Suite or OWASP ZAP.

How do I limit Wapiti scan scope?

Use --scope folder to limit scanning to the URL path directory, or --scope domain to stay within the same domain. This prevents Wapiti from following links to external domains or out-of-scope resources.

Can Wapiti test for open redirects?

Yes, Wapiti includes an open redirect detection module. Enable it with -m redirect to test URL parameters for open redirect vulnerabilities that could be used in phishing attacks.

How do I authenticate Wapiti to scan behind login?

Provide authentication cookies with -c cookie.txt where the file contains session cookies in Netscape format. You can also use --auth-type basic for HTTP basic authentication or --auth-type digest for digest authentication.

Can Wapiti scan REST APIs?

Yes, Wapiti can scan REST API endpoints by specifying the API URL. It will crawl and test parameters in API requests. For dedicated API testing, combine with tools like OWASP ZAP or Postman with automated scanning.

How do I generate a Wapiti HTML report?

Use -o report_name to generate an HTML report in the specified directory. Wapiti creates index.html with a summary, vulnerability details, affected URLs, and recommended remediation steps.

Can Wapiti detect SSRF vulnerabilities?

Wapiti includes basic SSRF detection through its injection modules. For comprehensive SSRF testing, combine with dedicated SSRF testing tools or manual testing using out-of-band techniques.

How do I update Wapiti to the latest version?

Update with: pip3 install --upgrade wapiti3. Or from source: git clone https://github.com/wapiti-scanner/wapiti.git && cd wapiti && pip3 install -r requirements.txt.

Tags

#web-application#vulnerability-scanner#vulnerability-detection#black-box#injection

Output Explanation

Classifies vulnerabilities by type and severity. The generated report details the exact URL parameters affected and the specific payloads that triggered the flaw.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.