How to Use Wapiti for Black - Box Web Vulnerability Scanning

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Wapiti is a free, open - source black - box scanner written in Python 3.
• It crawls a site, extracts links/forms, and attacks them with payloads for SQL - i, XSS, SSRF, command execution and many other classes of bugs.
• You can run it from the command line, pick individual modules, set concurrency, use proxies, and generate HTML, JSON or CSV reports.
• The scanner stores its state in an SQLite database, so you can pause and resume long scans.

What is Wapiti and why choose it?

Wapiti is a Python - based black - box web vulnerability scanner that works without source code access. It is ideal for developers and small teams who need a quick, scriptable way to discover common web flaws without paying for a SaaS solution.

How does Wapiti discover vulnerabilities?

Wapiti first crawls the target URL, follows internal links, and extracts all HTML forms. It then sends crafted payloads to each parameter and analyzes the responses for signs of injection, XSS, SSRF, insecure headers, and other issues. The scanner uses a modular architecture, so each vulnerability type is tested by a dedicated module.

Installing Wapiti

# Ensure you have Python 3.12+ (3.12, 3.13 or 3.14 are supported)
python3 -m pip install --upgrade pip
pip install wapiti3

The installation pulls all required dependencies automatically.

Running a basic scan

wapiti -u https://example.com

The command above starts a crawl of https://example.com, runs all default modules, and writes an HTML report to report.html.

Selecting specific modules

You can limit the scan to only the tests you care about with the -m flag. For example, to run only SQL injection and XSS checks:

wapiti -u https://example.com -m sql,xss

Supported module names include sql, xss, ldap, xxe, crlf, cmd, shellshock, log4shell, spring4shell, fi, dirb, subtakeover, ssrf, redirect, csp, csrf, header, cookie, cms, api and many others.

Configuring concurrency and proxies

Wapiti can send multiple HTTP requests in parallel. Adjust the -t option to control the number of concurrent threads (default is 10):

wapiti -u https://example.com -t 20

To route traffic through a SOCKS5 proxy, use --proxy:

wapiti -u https://example.com --proxy socks5://127.0.0.1:1080

Both HTTP and HTTPS are supported out of the box.

Authenticating to a protected site

Wapiti supports several authentication methods:

• Basic/Digest/NTLM - supply --auth-type and credentials.
• Form - based login - provide the login URL and form fields using --auth-login and --auth-payload. Example for basic auth:

wapiti -u https://example.com --auth-type basic --auth-login admin --auth-payload secret

Form - based authentication can be automated by capturing a browser session cookie and passing it with --cookie.

Pausing and resuming scans

Long scans can be interrupted safely. Wapiti stores its state in an SQLite file (wapiti.db). To resume, simply re - run the same command; the scanner will pick up where it left off.

wapiti -u https://example.com --resume

Generating reports in different formats

After a scan finishes, you can export results in HTML, JSON, XML, TXT or CSV using -f:

wapiti -u https://example.com -f json -o findings.json

HTML reports are the most readable for stakeholders, while JSON or CSV are convenient for CI pipelines.

Example: Scanning a REST API from an OpenAPI spec

If you have an OpenAPI or Swagger file, Wapiti can import it and test the defined endpoints:

wapiti -u https://api.example.com --api-spec openapi.yaml -m api

The api module checks each parameter for injection, insecure headers, and authentication misconfigurations.

Comparison with a SaaS scanner (Decloak free scan)

Interpreting findings

Each finding includes:

• Location - URL or API endpoint where the issue was observed.
• Payload - The malicious input that triggered the response.
• Evidence - Snippet of the server response showing the vulnerability.
• Severity - Low, medium, high, or critical (based on impact). Review high - severity items first (e.g., SQL injection, command execution) and verify false positives by reproducing the request manually.

Remediation checklist

1. Patch or upgrade vulnerable libraries - Wapiti flags outdated jQuery, Bootstrap, etc.
2. Validate and sanitize input - Use parameterized queries for SQL and proper output encoding for HTML.
3. Apply security headers - Content - Security - Policy, X - Content - Type - Options, Strict - Transport - Security.
4. Restrict HTTP methods - Disable PUT, DELETE if not needed.
5. Review authentication flows - Ensure login forms enforce rate limiting and MFA.
6. Secure API endpoints - Enforce proper auth, input validation, and rate limits.

Automating Wapiti in CI/CD

Add a step to your pipeline that runs Wapiti against a staging URL and fails the build if any critical findings appear:

- name: Run Wapiti scan
 run: |
 wapiti -u https://staging.example.com -m sql,xss,ssrf -t 30 -f json -o scan.json
 jq '.findings[] | select(.severity=="high" or .severity=="critical")' scan.json && exit 1 || exit 0

This keeps security testing continuous and prevents regressions.

When to switch to a SaaS scanner

Open - source scanners like Wapiti give you full control but require maintenance and expertise. If you need:

• Automatic TLS and HTTP posture checks,
• Third - party domain mapping and vibe - coded platform security,
• AI - written executive summaries,
• Enterprise - grade Active Testing and AI Pentesting, then a managed solution such as Decloak (free tier for quick checks, paid tiers for deeper analysis) may be more efficient.

Conclusion

Wapiti provides a powerful, scriptable way to discover a wide range of web vulnerabilities without leaving your terminal. By installing it, selecting the right modules, and integrating the scan into your CI pipeline, you can catch critical bugs early and maintain a strong security posture.

For more on how AI - powered scanners evaluate platform - specific misconfigurations, see Decloak’s vibe - coded platform security layer.