wapiti v2.2.1 - Web application vulnerability scanner & security auditor
Wapiti is a vulnerability scanner for web applications. It currently search vulnerabilities like XSS, SQL and XPath injections, file inclusions, command execution, LDAP injections, CRLF injections... It uses the Python programming language.
- Wapiti allows you to audit the security of your web applications.
- It performs "black-box" scans, i.e. it does not study the source code of the application but it will scan the webpages of the deployed webapp, looking for scripts and forms where it can inject data.
- Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.
Wapiti can detect the following vulnerabilities:
- File Handling Errors (Local and remote include/require, fopen, readfile...)
- Database Injections (PHP/JSP/ASP SQL Injections and XPath Injections)
- XSS (Cross Site Scripting) Injection
- LDAP Injection
- Command Execution detection (eval(), system(), passtru()...)
- CRLF Injection (HTTP Response Splitting, session fixation...)
Wapiti is able to differentiate punctual and permanent XSS vulnerabilities.
Wapiti prints a warning every time it founds a script allowing HTTP uploads.
A warning is also issued when a HTTP 500 code is returned (useful for ASP/IIS)
Wapiti does not rely on a vulnerability database like Nikto do, although it integrates its database as a type of attack since the version 2.2.1
Wapiti prints a warning every time it founds a script allowing HTTP uploads.
A warning is also issued when a HTTP 500 code is returned (useful for ASP/IIS)
Wapiti does not rely on a vulnerability database like Nikto do, although it integrates its database as a type of attack since the version 2.2.1
Wapiti aims to discover unknown vulnerabilities in web applications.
It does not provide a GUI for the moment and you must use it from a terminal.
Wapiti is able to create complete reports that include all the found vulnerabilities and related information in order to help to fix them. Take a look at the README file.
Download -
Version 2.2.1 (Latest version)
Vulnerabilities detector
- New attacks based on the Nikto database
- Improvements in the existent attacks
Source -
Usage -
Wapiti-2.2.1 - A web application vulnerability scanner
Usage: python wapiti.py http://server.com/base/url/ [options]
Supported options are:
-s
--start
To specify an url to start with
-x
--exclude
To exclude an url from the scan (for example logout scripts)
You can also use a wildcard (*)
Example : -x "http://server/base/?page=*&module=test"
or -x http://server/base/admin/* to exclude a directory
-p
--proxy
To specify a proxy
Exemple: -p http://proxy:port/
-c
--cookie
To use a cookie
-t
--timeout
To fix the timeout (in seconds)
-a
--auth
Set credentials for HTTP authentication
Doesn't work with Python 2.4
-r
--remove
Remove a parameter from URLs
-n
--nice
Define a limit of urls to read with the same pattern
Use this option to prevent endless loops
Must be greater than 0
-m
--module
Set the modules and HTTP methods to use for attacks.
Example: -m "-all,xss:get,exec:post"
-u
--underline
Use color to highlight vulnerables parameters in output
-v
--verbose
Set the verbosity level
0: quiet (default), 1: print each url, 2: print every attack
-f
--reportType
Set the type of the report
xml: Report in XML format
html: Report in HTML format
-o 