wapiti scan

wapiti -u <url>

Scan the web application with Wapiti, detecting vulnerabilities with the audit modules (injection, XSS, file, SSRF, XXE).

Run it when you want DAST with the community scanner: wapiti crawls the app and runs the audit modules (SQL injection, XSS, command injection, file inclusion, SSRF, XXE) and reports findings with detail. It's the open source scanner with configurable modules and reports in multiple formats. In DevSecOps, Wapiti is one of the DAST options in the pipeline (or for point-in-time scanning): selected modules and findings report.

Don't use it for the pipeline if ZAP is already there: ZAP is the reference option — Wapiti is the complement with its modules. Active scanning generates real traffic: the test environment is the site. And watch out: coverage depends on the crawl (routes with auth require session configuration) and findings are triaged (false positives). DAST complements SAST: the app at runtime with the team's scanner.