w3af

w3af_console -s <script>

Runs the w3af web application analysis framework with a script, detecting app vulnerabilities with configurable plugins.

Run it when you want dynamic analysis with the configurable framework: w3af_console executes the script (audit plugins: injection, XSS, file inclusion — and crawl) against the URL and reports findings with detail. It's the classic community DAST framework: configuration via plugins (the audits to run) in the script. In DevSecOps, w3af is one of the DAST options in the pipeline (or for point-in-time scans of the staging environment): selected plugins and the findings report.

Don't use it for quick scanning: w3af is a classic framework — its development slowed compared to ZAP (the current reference option); for the modern pipeline, ZAP (011/012) is the choice and w3af the historical complement. Active scanning generates real traffic: the staging environment is the place. And note: plugin configuration (the script) defines coverage — without audit plugins, the scan only crawls; false positives are triaged. DAST complements SAST: the app at runtime, with the framework the team chooses.