Wapiti

Black-box web vulnerability scanner.

KaliParrothigh

pkg: wapiti

Wapiti crawls a web app and fuzzes parameters for SQLi, XSS, file inclusion, command injection and more.

Syntax

wapiti -u {url}

Example

wapiti -u https://example.com

Crawls and audits the app, producing a vulnerability report.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

`-u` <https://target.tld>	Target URL.
`-m` <sql,xss>	Modules to run (sql,xss,exec…).
`--scope` <folder>	Crawl scope (page/folder/domain).
`-o` <report>	Report output path.
`-f` <html>	Report format (html,json,txt).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

wapiti

Usage examples

wapiti -u https://target.tld

Crawl and audit the web app.

wapiti -u https://t -m xss,sql -f html -o report

Run specific modules with an HTML report.

Advantages

Good automated web coverage
Multiple report formats

Disadvantages

Active fuzzing — intrusive
False positives

Related commands

Frequently asked questions

What is Wapiti used for?

Wapiti crawls a web app and fuzzes parameters for SQLi, XSS, file inclusion, command injection and more.

What is an example Wapiti command?

A common example is: wapiti -u https://example.com — Crawls and audits the app, producing a vulnerability report.

Is Wapiti part of Kali Linux?

Yes. Wapiti ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install wapiti.

What category of security tool is Wapiti?

Wapiti is a Vulnerability Analysis tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →