Wapiti

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Wapiti is ranked #6 of 29 in web application security scanners on Inferse. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Compared on web application security scanners

Free plan: Yeswapiti.sourceforge.io
Deployment: on-premisewapiti.sourceforge.io
Authenticated scans: Yeswapiti.sourceforge.io
JavaScript crawling: Yeswapiti.sourceforge.io
API scanning: Yeswapiti.sourceforge.io

Facts

Purpose: Wapiti is a Python web vulnerability scanner that audits websites and web applications.github.com · 3 Oct 2026
Scan method: It crawls deployed web applications and tests links, forms, and scripts with payloads without examining source code.github.com · 3 Oct 2026
Vulnerability coverage: Its listed checks include SQL and XPath injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects.github.com · 3 Oct 2026
Reports: It generates reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.github.com · 3 Oct 2026
Authentication: It supports Basic, Digest, and NTLM authentication, login forms, browser cookie imports, and custom Python code for complicated authentication cases.github.com · 3 Oct 2026
Traffic and scan controls: It supports HTTP, HTTPS, and SOCKS5 proxies, configurable scan scope, crawler limits, and custom HTTP headers.github.com · 3 Oct 2026
Scan sessions: It can suspend and resume scans using sessions stored in SQLite databases.github.com · 3 Oct 2026
Requirements: The README lists Python 3.12, 3.13, or 3.14 as requirements and says Windows use can be done through WSL.github.com · 3 Oct 2026
Installation: The project homepage offers installation with pip install wapiti3.wapiti.sourceforge.io · 3 Oct 2026
Support: The project README directs users to its FAQ and invites bug reports through GitHub issues.github.com · 3 Oct 2026
Safety and limits: The README warns that assessments may cause target malfunctions, crashes, or data loss, and says users need the target owner's consent.github.com · 3 Oct 2026
License: The README states that Wapiti is released under the GNU General Public License version 2.github.com · 3 Oct 2026
Latest listed release: The project's SourceForge files page lists version 3.3.2 dated 2026-08-19.sourceforge.net · 3 Oct 2026