Wapiti
Wapiti is a black-box web vulnerability scanner that crawls a site and fuzzes forms and parameters to find issues such as XSS and SQL injection.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Run a quick automated check against a local test application
- Compare its findings with ZAP's output
Key features
- Crawler and attack modules
- HTML/JSON reports
- Authentication support
Installation
Install with `pip install wapiti3` or from your distribution.
Beginner usage guide
Point it at a test site, choose modules (-m) and open the generated report to review each finding.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Scan with an HTML report
wapiti -u http://127.0.0.1:8081/ -f html -o report-f selects the report format and -o the output path.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary wapiti (██╗ ██╗ █████╗ ██████╗ ██╗████████╗██╗██████╗) on 2026-10-27.