Is WAScan open source and free to use?

Yes. WAScan is open source on GitHub (github.com/R3dFruitRollUp/WAScan) and free to run. It targets Python 2.7 and is no longer actively maintained upstream, so for a maintained module set look at Wapiti, and for template-based CVE checks use nuclei.

What vulnerabilities can WAScan find?

It fuzzes for common web flaws including SQL injection, cross-site scripting, local and remote file inclusion, source and information disclosure, and server misconfigurations. Because it works by sending payloads and reading error responses, it flags reflected and error-based issues rather than DOM-only bugs that never reach the server.

How do I choose what a WAScan run does?

Set the scan-option flag (-s) from 0 to 5: 0 fingerprints the app, 1 runs attacks, 2 is an audit, 3 brute forces hidden parameters, 4 checks for disclosure, and 5 is a full scan. Start with 0 to profile the target cheaply, then escalate to 5 once the host is confirmed in scope.

Can WAScan scan pages behind a login?

Yes. Pass Basic Auth credentials with -a, a session cookie with -c, and any custom headers with -H so the crawler reaches forms that require a session. Switch to POST with -m and send body data with -d to fuzz login and form submissions directly.

Does WAScan read the application's source code?

No. It is a black-box scanner, so it never studies source. It only sees what the deployed app returns over HTTP, crawling pages, harvesting links and forms, and inferring flaws from the responses to its payloads.

Updated Jul 14, 2026

Scanners

Crawl and fuzz a web app to find vulnerabilities

An open-source black-box web application security scanner.

Fuzz forms on a deployed app Pick the right scan depth Test authenticated areas

overview

What wascan does

WAScan tests a web application without reading its source. It crawls the deployed app, pulls out every link and form, then fuzzes each parameter with payloads and watches the responses for the error messages and disclosures that mark an exploitable input.

One scan-option flag sets the depth, from a quick fingerprint to an attack pass, an audit, brute force, disclosure checks, or a full run. You can route it through a proxy, set custom headers, cookies, and Basic Auth, and switch between GET and POST so it reaches forms behind a login.

On Trickest, WAScan runs as a Scanners node that takes a target URL and writes a folder and a file of findings. Reach for it once a prober confirms the host answers, then pick the scan option that matches how deep the assessment needs to go.

source github.com/R3dFruitRollUp/WAScan

use cases

Where wascan fits

Fuzz forms on a deployed app

Crawl the target, extract its forms, and send payloads to each parameter to surface injection, XSS, and disclosure flaws through black-box probing.

Pick the right scan depth

Set the scan-option flag to run a fast fingerprint, a focused attack pass, an audit, a brute-force sweep, a disclosure check, or a full scan as the engagement requires.

Test authenticated areas

Supply Basic Auth credentials, a cookie, and custom headers so the scanner reaches forms that sit behind a login instead of stopping at the front door.

Route traffic through a proxy

Send every request through an intercepting proxy to log payloads, debug findings, or keep the scan inside an approved egress path.

reference

wascan inputs and flags

16 inputs

Name	Type	Flag	Description
target-url	STRING	-u	Target URL to crawl and scan.
scan-option	STRING	-s	0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.
http-method	STRING	-m	HTTP method to use, GET or POST.
data	STRING	-d	Body data to send with a POST request.
auth	STRING	-a	HTTP Basic Authentication, user:pass.
cookie	STRING	-c	HTTP Cookie header value for authenticated scans.
proxy	STRING	-p	Route requests through a proxy, host:port.
headers	STRING	-H	Extra request headers (e.g. "Host:site.com").

Showing key inputs. wascan exposes 16 inputs in total.

Full flag reference (16 inputs)

Name	Type	Flag	Description
auth	STRING	-a	HTTP Basic Authentication (user:pass).
data	STRING	-d	Data to be sent via POST method.
host	STRING	-h	HTTP Host header value.
proxy	STRING	-p	Use a proxy (host:port).
cookie	STRING	-c	HTTP Cookie header value.
headers	STRING	-H	Extra headers (e.g. "Host:site.com").
referer	STRING	-R	HTTP Referer header value.
timeout	STRING	-t	Seconds to wait before the connection times out.
redirect	STRING	-n	Set redirect target URL to False (default True).
bruteforce	BOOLEAN	-b	Bruteforce hidden parameters.
proxy-auth	STRING	-P	Proxy authentication (user:pass).
target-url	STRING	-u	Target URL to crawl and scan.
user-agent	STRING	-A	HTTP User-agent header value.
http-method	STRING	-m	HTTP method, GET or POST.
scan-option	STRING	-s	Scan option: 0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.
random-agent	BOOLEAN	-r	Use a random User-agent header value.

example

Run wascan

wascan · command

# full black-box scan of a single target, routed through a local proxywascan -u https://example.com -s 5 -c 'session=abc123' -p 127.0.0.1:8080

sample output

[*] Target : https://example.com/[*] Scan   : 5 - Full scan[*] Crawling target, extracting links and forms... [!] SQL Injection       GET   param=id   payload=id=1'   /product.php?id=1'[!] Cross-Site Scripting  POST  param=q    payload=<script>alert(1)</script>  /search.php[+] Fingerprint  Server: nginx  |  X-Powered-By: PHP/8.2[+] Disclosure   Verbose SQL error exposed on /product.php[*] Done. 2 vulnerabilities, report saved to output/example.com/

guidance

Choosing wascan

Use WAScan for a quick black-box fuzz of a single web app's forms and parameters. It is lightweight and option-driven. For broader module coverage and active maintenance, prefer Wapiti; for template-based CVE checks, use nuclei.

wapiti

Black-box scanner with a larger, better-maintained module set. The fuller alternative to WAScan.

nuclei

Template-driven scanner for known CVEs and misconfigurations rather than generic fuzzing.

wfuzz

A raw fuzzing engine when you want to control the FUZZ point and filtering yourself.

faq

wascan questions

Yes. WAScan automates the black-box loop of crawling a web app, extracting its links and forms, and fuzzing every parameter with payloads, then reports the responses that signal a vulnerability. On Trickest it runs as a node, so a schedule or an upstream prober can trigger the scan without manual steps.

Run wascan yourself

A target is probed live by httpx, then WAScan crawls and fuzzes its forms before the findings land as a queryable output.

Run wascan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target-url

STRING

-u

Target URL to crawl and scan.

scan-option

STRING

-s

0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.

http-method

STRING

-m

HTTP method to use, GET or POST.

data

STRING

-d

Body data to send with a POST request.

auth

STRING

-a

HTTP Basic Authentication, user:pass.

STRING

-c

HTTP Cookie header value for authenticated scans.

proxy

STRING

-p

Route requests through a proxy, host:port.

headers

STRING

-H

Extra request headers (e.g. "Host:site.com").

Name

Type

Flag

Description

auth

STRING

-a

HTTP Basic Authentication (user:pass).

data

STRING

-d

Data to be sent via POST method.

host

STRING

-h

HTTP Host header value.

proxy

STRING

-p

Use a proxy (host:port).

STRING

-c

HTTP Cookie header value.

headers

STRING

-H

Extra headers (e.g. "Host:site.com").

referer

STRING

-R

HTTP Referer header value.

timeout

STRING

-t

Seconds to wait before the connection times out.

redirect

STRING

-n

Set redirect target URL to False (default True).

bruteforce

BOOLEAN

-b

Bruteforce hidden parameters.

proxy-auth

STRING

-P

Proxy authentication (user:pass).

target-url

STRING

-u

Target URL to crawl and scan.

user-agent

STRING

-A

HTTP User-agent header value.

http-method

STRING

-m

HTTP method, GET or POST.

scan-option

STRING

-s

Scan option: 0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.

random-agent

BOOLEAN

-r

Use a random User-agent header value.

[*] Target : https://example.com/[*] Scan : 5 - Full scan[*] Crawling target, extracting links and forms... [!] SQL Injection GET param=id payload=id=1' /product.php?id=1'[!] Cross-Site Scripting POST param=q payload=<script>alert(1)</script> /search.php[+] Fingerprint Server: nginx | X-Powered-By: PHP/8.2[+] Disclosure Verbose SQL error exposed on /product.php[*] Done. 2 vulnerabilities, report saved to output/example.com/

Crawl and fuzz a web app to find vulnerabilities

What wascan does

Where wascan fits

Fuzz forms on a deployed app

Pick the right scan depth

Test authenticated areas

Route traffic through a proxy

wascan inputs and flags

Run wascan

Choosing wascan

wapiti

nuclei

wfuzz

wascan questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run wascan yourself

Crawl and fuzz a web app to find vulnerabilities

What wascan does

Where wascan fits

Fuzz forms on a deployed app

Pick the right scan depth

Test authenticated areas

Route traffic through a proxy

wascan inputs and flags

Run wascan

Choosing wascan

wapiti

nuclei

wfuzz

wascan questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run wascan yourself