Our take
Activeregular commits and releases- Activity
- 53
- Community
- 58
- Issues
- 53
- Pull requests
- 36
Wapiti is an actively maintained Python scanner with a broad set of web-focused checks, suited to authorized black-box assessments where configurable crawling and reports matter.
Good fit if
- You need a command-line scanner that tests running web applications rather than analyzing source code.
- You want selectable attack modules, scan controls, and several report formats.
- Your environment can run Python 3.12 through 3.14, or Windows through WSL, and GPL-2.0 fits your licensing needs.
Look elsewhere if
- You need source-code analysis, which Wapiti explicitly does not perform.
- Your environment cannot use the required Python versions and you cannot run it through a supported setup.
- You need a graphical interface. The README describes command-line usage and suggests GUIs as a possible contribution, not an included feature.
All health signals
| Last commit | 2026-10-05 (1 month ago) |
|---|---|
| Commits, last 90 days | 13 |
| Releases, last 12 months | 5 (latest 3.3.2, 2026-08-19) |
| Contributors | 32 (top contributor: 60% of commits) |
| Issues closed, last 90 days | 2 |
| Pull requests merged, last 90 days | 5 (typically merged in 2 days) |
| Project age | 6 years |
Checked on 2026-11-07 with the GitHub API.
Overview
Wapiti is a black-box web vulnerability scanner written in Python. It crawls a deployed web application, finds links and forms, then sends test payloads and checks responses for signs of vulnerabilities. Because it tests the application from the outside rather than analyzing its source, it is intended for assessing running sites and APIs.
It is a command-line tool for security practitioners and developers who need configurable scans and reports in formats such as HTML, JSON, XML, and Markdown. It supports HTTP and HTTPS targets, and Windows users can run it through WSL.
Key Features
- Tests for common web vulnerabilities including SQL injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects.
- Crawls pages and forms, with scope controls, exclusions, scan limits, and options for authentication.
- Supports GET and POST attacks, multipart requests, and payload injection into JSON bodies and uploaded filenames.
- Includes checks for security headers, cookie flags, HTTPS redirects, and uncommon HTTP methods.
- Can scan REST APIs from an OpenAPI (Swagger) file and use a headless Firefox browser for crawling.
- Saves scan sessions in SQLite so scans or attacks can be suspended and resumed.
- Produces reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.
- Lets users select attack modules and add payloads or custom authentication code.
Use Cases
- A penetration tester can run a black-box assessment against an authorized staging site and review findings in a report.
- A web development team can check a deployed application for common input-handling and configuration issues before release.
- A security engineer can scan a REST API using its OpenAPI description when a conventional site crawl is not sufficient.
- An assessor can resume a long scan later or limit it to a particular URL, folder, or domain.
What you need
Detected in the repository
- Python >=3.12,<3.15 (from pyproject.toml)
- A Dockerfile, so it can run in a container
- A test suite and automated checks on GitHub Actions
License in plain words
GPL-2.0strong copyleft
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Install from PyPI and check the command-line help:
pip install wapiti3
wapiti -h
See the installation guide and README for setup details and scan options.
Considerations
Wapiti is a security testing tool, and its scans can cause malfunctions, crashes, or data loss on a target. Only scan systems with the owner's prior consent. The project warns that users are responsible for complying with applicable laws and disclaims liability for misuse or damage. Its documented Python requirement is 3.12, 3.13, or 3.14. The project uses GPL-2.0, so review that license before incorporating or distributing it. Its black-box approach also means it cannot identify issues that require source-code inspection; the README describes JavaScript URL extraction as basic.
Found this useful?
Share it with someone who would like wapiti.