How do I keep a scan inside scope?

Set --scope to page, folder, domain, or url, and use --exclude to drop URLs the crawler should never touch.

How is wapiti different from nuclei?

wapiti crawls and fuzzes parameters for generic injection classes on one app. nuclei matches YAML templates for known CVEs and misconfigs across many hosts.

How do I limit how long a scan runs?

Set --max-scan-time for the whole run and --max-attack-time per module. Pair with --scan-force polite or sneaky on fragile targets.

Can I scan an authenticated app?

Yes. Pass --cookie with a JSON cookie file, or use --auth-cred and --auth-type for HTTP authentication.

What output formats does it support?

Set --format to csv, html, json, txt, or xml. On Trickest the node writes a folder and a file; prefer json or xml for parsing.

Updated Jul 15, 2026

Scanners

Crawl and fuzz a web app for injection flaws

Black-box crawler and fuzzer for web app injection classes.

Audit a single application end to end Scope a scan to a folder or domain Tune attack pressure to the target

overview

What wapiti does

Point wapiti at a live base URL after a prober confirms the host answers. It crawls pages, forms, and parameters, then injects payloads and reads responses for SQLi, XSS, SSRF, and related classes without needing source access.

Bound the run with --scope (page, folder, domain, url), --depth, --level, and --scan-force. Load modules with --module and write csv, html, json, txt, or xml via --format.

Trickest runs wapiti as a managed scanner node that takes a URL and emits a file plus a results folder. Prefer nuclei when you need template-driven CVE checks across many hosts.

source github.com/wapiti-scanner/wapiti

use cases

Where wapiti fits

Audit a single application end to end

Point wapiti at a base URL, let it crawl the scope, and fuzz every discovered form and parameter for injection and disclosure flaws in one run.

Scope a scan to a folder or domain

Set the scan scope to page, folder, domain, or url so the crawler stays inside the area you are authorized to test instead of wandering off-site.

Tune attack pressure to the target

Use the attack level and scan-force settings to run a polite pass on a fragile app or an aggressive pass on a hardened one.

Emit a machine-readable report

Write JSON or XML output so the findings feed a triage stage or a ticketing step instead of a human reading an HTML page.

reference

wapiti inputs and flags

34 inputs

Name	Type	Flag	Description
url	STRING	--url	The base URL used to define the scan scope
scope	STRING	--scope	Set scan scope (page, folder, domain, url, or punk)
module	STRING	--module	List of modules to load
level	STRING	--level	Set attack level
depth	STRING	--depth	Set how deep the scanner should explore the website
format	STRING	--format	Set output format. Supported: csv, html, json, txt, xml. Default is html.
scan-force	STRING	--scan-force	Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane
max-scan-time	STRING	--max-scan-time	Set how many seconds you want the scan to last (floats accepted)

Showing key inputs. wapiti exposes 34 inputs in total.

Full flag reference (34 inputs)

Name	Type	Flag	Description
url	STRING	--url	The base URL used to define the scan scope
data	STRING	--data	Urlencoded data to send with the base URL if it is a POST request
skip	STRING	--skip	Skip attacking given parameter(s)
color	BOOLEAN	--color	Colorize output
depth	STRING	--depth	Set how deep the scanner should explore the website
level	STRING	--level	Set attack level
proxy	STRING	--proxy	Set the HTTP(S) proxy to use. Supported: http(s) and socks proxies
scope	STRING	--scope	Set scan scope (page, folder, domain, url, or punk)
start	STRING	--start	Adds a url to start scan with
tasks	STRING	--tasks	Number of concurrent tasks to use for the exploration (crawling) of the target.
cookie	FILE	--cookie	Set a JSON cookie file to use.
format	STRING	--format	Set output format. Supported: csv, html, json, txt, xml. Default is html.
header	STRING	--header	Set a custom header to use for every requests
module	STRING	--module	List of modules to load
remove	STRING	--remove	Remove this parameter from urls
exclude	STRING	--exclude	Adds a url to exclude from the scan
timeout	STRING	--timeout	Set timeout for requests in seconds
verbose	STRING	--verbose	Set verbosity level (0: quiet, 1: normal, 2: verbose)
endpoint	STRING	--endpoint	URL serving as endpoint for both attacker and target
auth-cred	STRING	--auth-cred	Set HTTP authentication credentials
auth-type	STRING	--auth-type	Set the authentication type to use (basic, digest, ntlm, or post)
scan-force	STRING	--scan-force	Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane
user-agent	STRING	--user-agent	Set a custom user-agent to use for every requests
verify-ssl	STRING	--verify-ssl	Set SSL check (0 or 1, default is 0)
dns-endpoint	STRING	--dns-endpoint	Domain serving as DNS endpoint for Log4Shell attack
no-bugreport	BOOLEAN	--no-bugreport	Don't send automatic bug report when an attack module fails
max-scan-time	STRING	--max-scan-time	Set how many seconds you want the scan to last (floats accepted)
max-parameters	STRING	--max-parameters	URLs and forms having more than MAX input parameters will be erased before attack.
drop-set-cookie	BOOLEAN	--drop-set-cookie	Ignore Set-Cookie header from HTTP responses
max-attack-time	STRING	--max-attack-time	Set how many seconds you want each attack module to last (floats accepted)
external-endpoint	STRING	--external-endpoint	URL serving as endpoint for target
internal-endpoint	STRING	--internal-endpoint	URL serving as endpoint for attacker
max-files-per-dir	STRING	--max-files-per-dir	Set how many pages the scanner should explore per directory
max-links-per-page	STRING	--max-links-per-page	Set how many (in-scope) links the scanner should extract for each page

example

Run wapiti

wapiti · command

# crawl example.com in domain scope, XSS+SQL modules, JSON reportwapiti --url https://example.com/ --scope domain --module xss,sql --level 1 --depth 3 --format json --max-scan-time 600

sample output

[*] Wapiti 3.x - a web application vulnerability scanner[*] Target: https://example.com/[*] Scope: domain[+] https://example.com/login[+] https://example.com/search?q=[+] https://example.com/api/v1/items[*] Attack module xss loaded[*] Attack module sql loaded[!] XSS found in GET https://example.com/search?q=[!] SQL Injection found in GET https://example.com/product?id=[*] Report saved as report.json

guidance

Choosing wapiti

Reach for wapiti when you need an automated black-box audit of a web app's forms and parameters. Crawl and fuzz one confirmed-live target. For template-driven CVE checks across many hosts, use nuclei instead.

nuclei

Template-driven scanner for known CVEs and misconfigurations. wapiti fuzzes parameters generically instead.

wascan

Another black-box fuzzing scanner. wapiti has a broader, better-maintained module set.

nikto

Classic server scanner focused on known files and configs. wapiti goes deeper into form and parameter injection.

faq

wapiti questions

No. It works black-box over HTTP, crawling the app and fuzzing the forms and URLs it finds, so it runs against any backend stack.

Run wapiti yourself

A target is confirmed live by httpx, then Wapiti crawls and fuzzes it before the findings land as a queryable output.

Run wapiti in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

--url

The base URL used to define the scan scope

scope

STRING

--scope

Set scan scope (page, folder, domain, url, or punk)

module

STRING

--module

List of modules to load

level

STRING

--level

Set attack level

depth

STRING

--depth

Set how deep the scanner should explore the website

format

STRING

--format

Set output format. Supported: csv, html, json, txt, xml. Default is html.

scan-force

STRING

--scan-force

Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane

max-scan-time

STRING

--max-scan-time

Set how many seconds you want the scan to last (floats accepted)

Name

Type

Flag

Description

url

STRING

--url

The base URL used to define the scan scope

data

STRING

--data

Urlencoded data to send with the base URL if it is a POST request

skip

STRING

--skip

Skip attacking given parameter(s)

color

BOOLEAN

--color

Colorize output

depth

STRING

--depth

Set how deep the scanner should explore the website

level

STRING

--level

Set attack level

proxy

STRING

--proxy

Set the HTTP(S) proxy to use. Supported: http(s) and socks proxies

scope

STRING

--scope

Set scan scope (page, folder, domain, url, or punk)

start

STRING

--start

Adds a url to start scan with

tasks

STRING

--tasks

Number of concurrent tasks to use for the exploration (crawling) of the target.

FILE

--cookie

Set a JSON cookie file to use.

format

STRING

--format

Set output format. Supported: csv, html, json, txt, xml. Default is html.

header

STRING

--header

Set a custom header to use for every requests

module

STRING

--module

List of modules to load

remove

STRING

--remove

Remove this parameter from urls

exclude

STRING

--exclude

Adds a url to exclude from the scan

timeout

STRING

--timeout

Set timeout for requests in seconds

verbose

STRING

--verbose

Set verbosity level (0: quiet, 1: normal, 2: verbose)

endpoint

STRING

--endpoint

URL serving as endpoint for both attacker and target

auth-cred

STRING

--auth-cred

Set HTTP authentication credentials

auth-type

STRING

--auth-type

Set the authentication type to use (basic, digest, ntlm, or post)

scan-force

STRING

--scan-force

Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane

user-agent

STRING

--user-agent

Set a custom user-agent to use for every requests

verify-ssl

STRING

--verify-ssl

Set SSL check (0 or 1, default is 0)

dns-endpoint

STRING

--dns-endpoint

Domain serving as DNS endpoint for Log4Shell attack

no-bugreport

BOOLEAN

--no-bugreport

Don't send automatic bug report when an attack module fails

max-scan-time

STRING

--max-scan-time

Set how many seconds you want the scan to last (floats accepted)

max-parameters

STRING

--max-parameters

URLs and forms having more than MAX input parameters will be erased before attack.

drop-set-cookie

BOOLEAN

--drop-set-cookie

Ignore Set-Cookie header from HTTP responses

max-attack-time

STRING

--max-attack-time

Set how many seconds you want each attack module to last (floats accepted)

external-endpoint

STRING

--external-endpoint

URL serving as endpoint for target

internal-endpoint

STRING

--internal-endpoint

URL serving as endpoint for attacker

max-files-per-dir

STRING

--max-files-per-dir

Set how many pages the scanner should explore per directory

max-links-per-page

STRING

--max-links-per-page

Set how many (in-scope) links the scanner should extract for each page

[*] Wapiti 3.x - a web application vulnerability scanner[*] Target: https://example.com/[*] Scope: domain[+] https://example.com/login[+] https://example.com/search?q=[+] https://example.com/api/v1/items[*] Attack module xss loaded[*] Attack module sql loaded[!] XSS found in GET https://example.com/search?q=[!] SQL Injection found in GET https://example.com/product?id=[*] Report saved as report.json

Crawl and fuzz a web app for injection flaws

What wapiti does

Where wapiti fits

Audit a single application end to end

Scope a scan to a folder or domain

Tune attack pressure to the target

Emit a machine-readable report

wapiti inputs and flags

Run wapiti

Choosing wapiti

nuclei

wascan

nikto

wapiti questions

More Scanners tools

airixss

cmseek

joomscan

nikto

nomore403

nuclei

Run wapiti yourself

Crawl and fuzz a web app for injection flaws

What wapiti does

Where wapiti fits

Audit a single application end to end

Scope a scan to a folder or domain

Tune attack pressure to the target

Emit a machine-readable report

wapiti inputs and flags

Run wapiti

Choosing wapiti

nuclei

wascan

nikto

wapiti questions

More Scanners tools

airixss

cmseek

joomscan

nikto

nomore403

nuclei

Run wapiti yourself