Wapiti review
Free command-line DAST with authenticated crawling, API scanning, and flexible reports.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Wapiti is a free, open-source command-line web application vulnerability scanner for developers, security professionals, and system administrators. It performs black-box testing against deployed websites by crawling links, forms, and inputs, then injecting payloads to identify security weaknesses. Local deployment supports Windows, Linux, macOS, and self-hosted environments, making it a fit for teams that want command-line DAST without a hosted service.
Its strongest area is scan coverage for modern web applications. Wapiti supports authenticated testing through Basic, Digest, NTLM, login forms, cookies, and custom authentication scripts. JavaScript URL extraction and Firefox headless-browser crawling extend coverage beyond simple static pages, while OpenAPI or Swagger imports support REST API scanning. Detection modules cover SQL injection, cross-site scripting, SSRF, XXE, CSRF, file disclosure, and command injection, alongside TLS configuration and security-header checks. Integrations with Wappalyzer and sslscan add related application and TLS inspection capabilities.
The published product model is straightforward: Wapiti is distributed as free open-source software under the GPLv2 license, with no tiered commercial structure described. Reports can be exported in HTML, XML, JSON, TXT, CSV, and Markdown, and SQLite session databases allow scans to be suspended and resumed. That flexibility suits developers and security practitioners who can work with a local command-line workflow and want control over scan output. Organizations seeking a hosted interface, scheduled scanning, or a commercial support model should choose a product designed around those requirements instead.
Wapiti pros and cons
- Where it wins
- Free, GPLv2-licensed, and open source
- Authenticated crawling with JavaScript and headless-browser support
- Scans REST APIs and exports reports in six formats
- Where it doesn't
- Runs locally rather than as a hosted service
- Command-line operation may require technical security expertise
- No paid tiers or commercial plan structure
Wapiti fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update