Can WAScan scan pages behind a login?

Yes. Pass Basic Auth with -a, a session cookie with -c, and custom headers with -H. Switch to POST with -m and send body data with -d to fuzz login and form submissions.

What kinds of flaws does it surface?

It fuzzes for common web issues such as SQL injection, XSS, file inclusion, and information disclosure. It flags reflected and error-based signals from HTTP responses, not DOM-only bugs that never hit the server.

Does WAScan read application source?

No. It is black-box only. It sees what the deployed app returns over HTTP after crawling pages and sending payloads.

When should I pick Wapiti or nuclei instead?

Use Wapiti when you want a larger, actively maintained black-box module set. Use nuclei when the job is known CVE or misconfiguration templates rather than generic form fuzzing.

Updated Jul 14, 2026

Scanners

Black-box crawl and fuzz for web app flaws

Black-box web app crawler and parameter fuzzer.

Fuzz forms on a deployed app Pick the right scan depth Test authenticated areas

overview

What wascan does

WAScan takes a target URL (-u) and writes FOLDER and FILE findings. It crawls the live app, harvests links and forms, then fuzzes parameters and watches responses for error-based signals.

Pick scan depth with -s: fingerprint (0), attacks (1), audit (2), bruteforce (3), disclosure (4), or full (5). Add -a, -c, -H for authenticated areas; -m and -d for POST bodies; -p for a proxy.

Trickest runs WAScan as a managed Scanners node after a prober confirms the host. Prefer Wapiti for a maintained module set; nuclei for template CVEs; wfuzz when you own the FUZZ point.

source github.com/R3dFruitRollUp/WAScan

use cases

Where wascan fits

Fuzz forms on a deployed app

Crawl the target, extract its forms, and send payloads to each parameter to surface injection, XSS, and disclosure flaws through black-box probing.

Pick the right scan depth

Set the scan-option flag to run a fast fingerprint, a focused attack pass, an audit, a brute-force sweep, a disclosure check, or a full scan as the engagement requires.

Test authenticated areas

Supply Basic Auth credentials, a cookie, and custom headers so the scanner reaches forms that sit behind a login instead of stopping at the front door.

Route traffic through a proxy

Send every request through an intercepting proxy to log payloads, debug findings, or keep the scan inside an approved egress path.

reference

wascan inputs and flags

16 inputs

Name	Type	Flag	Description
target-url	STRING	-u	Target URL to crawl and scan.
scan-option	STRING	-s	0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.
http-method	STRING	-m	HTTP method to use, GET or POST.
data	STRING	-d	Body data to send with a POST request.
auth	STRING	-a	HTTP Basic Authentication, user:pass.
cookie	STRING	-c	HTTP Cookie header value for authenticated scans.
proxy	STRING	-p	Route requests through a proxy, host:port.
headers	STRING	-H	Extra request headers (e.g. "Host:site.com").

Showing key inputs. wascan exposes 16 inputs in total.

Full flag reference (16 inputs)

Name	Type	Flag	Description
auth	STRING	-a	HTTP Basic Authentication (user:pass).
data	STRING	-d	Data to be sent via POST method.
host	STRING	-h	HTTP Host header value.
proxy	STRING	-p	Use a proxy (host:port).
cookie	STRING	-c	HTTP Cookie header value.
headers	STRING	-H	Extra headers (e.g. "Host:site.com").
referer	STRING	-R	HTTP Referer header value.
timeout	STRING	-t	Seconds to wait before the connection times out.
redirect	STRING	-n	Set redirect target URL to False (default True).
bruteforce	BOOLEAN	-b	Bruteforce hidden parameters.
proxy-auth	STRING	-P	Proxy authentication (user:pass).
target-url	STRING	-u	Target URL to crawl and scan.
user-agent	STRING	-A	HTTP User-agent header value.
http-method	STRING	-m	HTTP method, GET or POST.
scan-option	STRING	-s	Scan option: 0 Fingerprint, 1 Attacks, 2 Audit, 3 Bruteforce, 4 Disclosure, 5 Full scan.
random-agent	BOOLEAN	-r	Use a random User-agent header value.

example

Run wascan

wascan · command

# full black-box scan of a single target, routed through a local proxywascan -u https://example.com -s 5 -c 'session=abc123' -p 127.0.0.1:8080

sample output

[*] Target : https://example.com/[*] Scan   : 5 - Full scan[*] Crawling target, extracting links and forms... [!] SQL Injection       GET   param=id   payload=id=1'   /product.php?id=1'[!] Cross-Site Scripting  POST  param=q    payload=<script>alert(1)</script>  /search.php[+] Fingerprint  Server: nginx  |  X-Powered-By: PHP/8.2[+] Disclosure   Verbose SQL error exposed on /product.php[*] Done. 2 vulnerabilities, report saved to output/example.com/

guidance

Choosing wascan

Reach for WAScan when you want a quick black-box fuzz of one app's forms and parameters with a single -s depth. Prefer Wapiti for broader, maintained modules; nuclei for template CVE checks; wfuzz when you need raw FUZZ control.

wapiti

Black-box scanner with a larger, better-maintained module set. Fuller alternative when WAScan's options are too thin.

nuclei

Template-driven scanner for known CVEs and misconfigurations, not generic form fuzzing.

wfuzz

Raw fuzzing engine when you want to place the FUZZ point and filters yourself.

faq

wascan questions

Set -s from 0 to 5: 0 fingerprints, 1 attacks, 2 audit, 3 bruteforces hidden parameters, 4 checks disclosure, 5 runs a full scan. Start at 0, then escalate once the host is in scope.

Run wascan yourself

A target is probed live by httpx, then WAScan crawls and fuzzes its forms before the findings land as a queryable output.

Open wascan in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Black-box crawl and fuzz for web app flaws

What wascan does

Where wascan fits

Fuzz forms on a deployed app

Pick the right scan depth

Test authenticated areas

Route traffic through a proxy

wascan inputs and flags

Run wascan

Choosing wascan

wapiti

nuclei

wfuzz

wascan questions

More Scanners tools

ac-scanner

airixss

bedrock-keys-security

cmseek

jaeles

joomscan

Run wascan yourself