# wapiti: Scan Web Applications for Vulnerabilities in Python

This repository profile is provided by osrepos.com, an open source repository discovery platform.

Source: osrepos.com
Repository profile: https://osrepos.com/repo/wapiti-scanner-wapiti
Generated for open source discovery and AI-assisted research.

Wapiti is a black-box web vulnerability scanner written in Python. It crawls deployed web applications, tests their pages and forms with attack payloads, and reports suspected vulnerabilities without inspecting source code.

GitHub: https://github.com/wapiti-scanner/wapiti
OSRepos URL: https://osrepos.com/repo/wapiti-scanner-wapiti

## Summary

Wapiti is a black-box web vulnerability scanner written in Python. It crawls deployed web applications, tests their pages and forms with attack payloads, and reports suspected vulnerabilities without inspecting source code.

## Topics

- python
- security
- cli
- cybersecurity
- security-tools
- web-vulnerability-scanner
- web-application-scanner

## Repository Information

Last analyzed by OSRepos: Sat Nov 07 2026 13:26:23 GMT+0000 (Western European Standard Time)
Detail views: 13
GitHub clicks: 3

## Safety Notice

OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything.

## Content

## Overview
Wapiti is a black-box web vulnerability scanner written in Python. It crawls a deployed web application, finds links and forms, then sends test payloads and checks responses for signs of vulnerabilities. Because it tests the application from the outside rather than analyzing its source, it is intended for assessing running sites and APIs.

It is a command-line tool for security practitioners and developers who need configurable scans and reports in formats such as HTML, JSON, XML, and Markdown. It supports HTTP and HTTPS targets, and Windows users can run it through WSL.

## Key Features
- Tests for common web vulnerabilities including SQL injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects.
- Crawls pages and forms, with scope controls, exclusions, scan limits, and options for authentication.
- Supports GET and POST attacks, multipart requests, and payload injection into JSON bodies and uploaded filenames.
- Includes checks for security headers, cookie flags, HTTPS redirects, and uncommon HTTP methods.
- Can scan REST APIs from an OpenAPI (Swagger) file and use a headless Firefox browser for crawling.
- Saves scan sessions in SQLite so scans or attacks can be suspended and resumed.
- Produces reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.
- Lets users select attack modules and add payloads or custom authentication code.

## Use Cases
- A penetration tester can run a black-box assessment against an authorized staging site and review findings in a report.
- A web development team can check a deployed application for common input-handling and configuration issues before release.
- A security engineer can scan a REST API using its OpenAPI description when a conventional site crawl is not sufficient.
- An assessor can resume a long scan later or limit it to a particular URL, folder, or domain.

## Our Take
Wapiti is an actively maintained Python scanner with a broad set of web-focused checks, suited to authorized black-box assessments where configurable crawling and reports matter.

**Good fit if:**
- You need a command-line scanner that tests running web applications rather than analyzing source code.
- You want selectable attack modules, scan controls, and several report formats.
- Your environment can run Python 3.12 through 3.14, or Windows through WSL, and GPL-2.0 fits your licensing needs.

**Look elsewhere if:**
- You need source-code analysis, which Wapiti explicitly does not perform.
- Your environment cannot use the required Python versions and you cannot run it through a supported setup.
- You need a graphical interface. The README describes command-line usage and suggests GUIs as a possible contribution, not an included feature.

## Project Health

| Signal | Value |
|---|---|
| Status | **Active**: regular commits and releases |
| Last commit | 2026-10-05 (1 month ago) |
| Commits, last 90 days | 13 |
| Releases, last 12 months | 5 (latest 3.3.2, 2026-08-19) |
| Contributors | 32 (top contributor: 60% of commits) |
| Issues closed, last 90 days | 2 |
| Pull requests merged, last 90 days | 5 (typically merged in 2 days) |
| Project age | 6 years |

Checked on 2026-11-07 with the GitHub API.

## Project Facts

- Language: Python
- License: GPL-2.0
- Stars: 1.9k
- Forks: 277
- Website: https://wapiti-scanner.github.io/
- Archived: no

## What You Need

Detected in the repository:

- Python >=3.12,<3.15 (from pyproject.toml)
- A Dockerfile, so it can run in a container
- A test suite and automated checks on GitHub Actions

## Getting Started
Install from PyPI and check the command-line help:

```sh
pip install wapiti3
wapiti -h
```

See the [installation guide](https://github.com/wapiti-scanner/wapiti/blob/master/INSTALL.md) and [README](https://github.com/wapiti-scanner/wapiti) for setup details and scan options.

## License in Plain Words

**GPL-2.0** (strong copyleft).

- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL

A summary, not legal advice: the LICENSE file is what applies.

## Considerations
Wapiti is a security testing tool, and its scans can cause malfunctions, crashes, or data loss on a target. Only scan systems with the owner's prior consent. The project warns that users are responsible for complying with applicable laws and disclaims liability for misuse or damage. Its documented Python requirement is 3.12, 3.13, or 3.14. The project uses GPL-2.0, so review that license before incorporating or distributing it. Its black-box approach also means it cannot identify issues that require source-code inspection; the README describes JavaScript URL extraction as basic.