How do I keep a scan inside scope?

Set --scope to page, folder, domain, or url, and use --exclude to drop URLs the crawler should never touch.

How is wapiti different from nuclei?

wapiti crawls and fuzzes parameters for generic injection classes on one app. nuclei matches YAML templates for known CVEs and misconfigs across many hosts.

How do I limit how long a scan runs?

Set --max-scan-time for the whole run and --max-attack-time per module. Pair with --scan-force polite or sneaky on fragile targets.

Can I scan an authenticated app?

Yes. Pass --cookie with a JSON cookie file, or use --auth-cred and --auth-type for HTTP authentication.

What output formats does it support?

Set --format to csv, html, json, txt, or xml. On Trickest the node writes a folder and a file; prefer json or xml for parsing.

Updated Jul 15, 2026

Scanners

Crawl and fuzz a web app for injection flaws

Black-box crawler and fuzzer for web app injection classes.

Audit a single application end to end Scope a scan to a folder or domain Tune attack pressure to the target

overview

What wapiti does

Point wapiti at a live base URL after a prober confirms the host answers. It crawls pages, forms, and parameters, then injects payloads and reads responses for SQLi, XSS, SSRF, and related classes without needing source access.

Bound the run with --scope (page, folder, domain, url), --depth, --level, and --scan-force. Load modules with --module and write csv, html, json, txt, or xml via --format.

Trickest runs wapiti as a managed scanner node that takes a URL and emits a file plus a results folder. Prefer nuclei when you need template-driven CVE checks across many hosts.

source github.com/wapiti-scanner/wapiti

use cases

Where wapiti fits

Audit a single application end to end

Point wapiti at a base URL, let it crawl the scope, and fuzz every discovered form and parameter for injection and disclosure flaws in one run.

Scope a scan to a folder or domain

Set the scan scope to page, folder, domain, or url so the crawler stays inside the area you are authorized to test instead of wandering off-site.

Tune attack pressure to the target

Use the attack level and scan-force settings to run a polite pass on a fragile app or an aggressive pass on a hardened one.

Emit a machine-readable report

Write JSON or XML output so the findings feed a triage stage or a ticketing step instead of a human reading an HTML page.

reference

wapiti inputs and flags

34 inputs

Name	Type	Flag	Description
url	STRING	--url	The base URL used to define the scan scope
scope	STRING	--scope	Set scan scope (page, folder, domain, url, or punk)
module	STRING	--module	List of modules to load
level	STRING	--level	Set attack level
depth	STRING	--depth	Set how deep the scanner should explore the website
format	STRING	--format	Set output format. Supported: csv, html, json, txt, xml. Default is html.
scan-force	STRING	--scan-force	Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane
max-scan-time	STRING	--max-scan-time	Set how many seconds you want the scan to last (floats accepted)

Showing key inputs. wapiti exposes 34 inputs in total.

Full flag reference (34 inputs)

Name	Type	Flag	Description
url	STRING	--url	The base URL used to define the scan scope
data	STRING	--data	Urlencoded data to send with the base URL if it is a POST request
skip	STRING	--skip	Skip attacking given parameter(s)
color	BOOLEAN	--color	Colorize output
depth	STRING	--depth	Set how deep the scanner should explore the website
level	STRING	--level	Set attack level
proxy	STRING	--proxy	Set the HTTP(S) proxy to use. Supported: http(s) and socks proxies
scope	STRING	--scope	Set scan scope (page, folder, domain, url, or punk)
start	STRING	--start	Adds a url to start scan with
tasks	STRING	--tasks	Number of concurrent tasks to use for the exploration (crawling) of the target.
cookie	FILE	--cookie	Set a JSON cookie file to use.
format	STRING	--format	Set output format. Supported: csv, html, json, txt, xml. Default is html.
header	STRING	--header	Set a custom header to use for every requests
module	STRING	--module	List of modules to load
remove	STRING	--remove	Remove this parameter from urls
exclude	STRING	--exclude	Adds a url to exclude from the scan
timeout	STRING	--timeout	Set timeout for requests in seconds
verbose	STRING	--verbose	Set verbosity level (0: quiet, 1: normal, 2: verbose)
endpoint	STRING	--endpoint	URL serving as endpoint for both attacker and target
auth-cred	STRING	--auth-cred	Set HTTP authentication credentials
auth-type	STRING	--auth-type	Set the authentication type to use (basic, digest, ntlm, or post)
scan-force	STRING	--scan-force	Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal, aggressive, insane
user-agent	STRING	--user-agent	Set a custom user-agent to use for every requests
verify-ssl	STRING	--verify-ssl	Set SSL check (0 or 1, default is 0)
dns-endpoint	STRING	--dns-endpoint	Domain serving as DNS endpoint for Log4Shell attack
no-bugreport	BOOLEAN	--no-bugreport	Don't send automatic bug report when an attack module fails
max-scan-time	STRING	--max-scan-time	Set how many seconds you want the scan to last (floats accepted)
max-parameters	STRING	--max-parameters	URLs and forms having more than MAX input parameters will be erased before attack.
drop-set-cookie	BOOLEAN	--drop-set-cookie	Ignore Set-Cookie header from HTTP responses
max-attack-time	STRING	--max-attack-time	Set how many seconds you want each attack module to last (floats accepted)
external-endpoint	STRING	--external-endpoint	URL serving as endpoint for target
internal-endpoint	STRING	--internal-endpoint	URL serving as endpoint for attacker
max-files-per-dir	STRING	--max-files-per-dir	Set how many pages the scanner should explore per directory
max-links-per-page	STRING	--max-links-per-page	Set how many (in-scope) links the scanner should extract for each page

example

Run wapiti

wapiti · command

# crawl example.com in domain scope, XSS+SQL modules, JSON reportwapiti --url https://example.com/ --scope domain --module xss,sql --level 1 --depth 3 --format json --max-scan-time 600

sample output

[*] Wapiti 3.x - a web application vulnerability scanner[*] Target: https://example.com/[*] Scope: domain[+] https://example.com/login[+] https://example.com/search?q=[+] https://example.com/api/v1/items[*] Attack module xss loaded[*] Attack module sql loaded[!] XSS found in GET https://example.com/search?q=[!] SQL Injection found in GET https://example.com/product?id=[*] Report saved as report.json

guidance

Choosing wapiti

Reach for wapiti when you need an automated black-box audit of a web app's forms and parameters. Crawl and fuzz one confirmed-live target. For template-driven CVE checks across many hosts, use nuclei instead.

nuclei

Template-driven scanner for known CVEs and misconfigurations. wapiti fuzzes parameters generically instead.

wascan

Another black-box fuzzing scanner. wapiti has a broader, better-maintained module set.

nikto

Classic server scanner focused on known files and configs. wapiti goes deeper into form and parameter injection.

faq

wapiti questions

No. It works black-box over HTTP, crawling the app and fuzzing the forms and URLs it finds, so it runs against any backend stack.

Run wapiti yourself

A target is confirmed live by httpx, then Wapiti crawls and fuzzes it before the findings land as a queryable output.

Open wapiti in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Crawl and fuzz a web app for injection flaws

What wapiti does

Where wapiti fits

Audit a single application end to end

Scope a scan to a folder or domain

Tune attack pressure to the target

Emit a machine-readable report

wapiti inputs and flags

Run wapiti

Choosing wapiti

nuclei

wascan

nikto

wapiti questions

More Scanners tools

ac-scanner

airixss

bedrock-keys-security

cmseek

jaeles

joomscan

Run wapiti yourself