This is a software that scans and identifies vulnerabilities in web applications. It assists in identifying and reducing security gaps in applications, helping to prevent cyber attacks.
If you're looking for a web application security tool, Wapiti is worth considering. Developed using Python programming language, it allows you to audit the security of your web applications. Wapiti performs "black-box" scans which means it scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data, rather than studying the source code.
With Wapiti, you'll have access to a range of useful security features such as file handling error detection (local and remote include/require, fopen, readfile...), database injection (PHP/JSP/ASP SQL Injections and XPath Injections), cross-site scripting (XSS) injection, LDAP injection, command execution detection (eval(), system(), passtru()...), and HTTP response splitting, session fixation (CRLF injection) detection.
Wapiti can also differentiate between punctual and permanent XSS vulnerabilities, and it prints a warning whenever it finds a script allowing HTTP uploads. A warning is also issued when an HTTP 500 code is returned (useful for ASP/IIS).
Unlike other vulnerability tools like Nikto, Wapiti does not rely on a vulnerability database. Instead, it aims to discover unknown vulnerabilities in web applications. As of now, Wapiti does not provide a GUI, so you need to use it through a terminal.
With Wapiti, you'll have access to a range of useful security features such as file handling error detection (local and remote include/require, fopen, readfile...), database injection (PHP/JSP/ASP SQL Injections and XPath Injections), cross-site scripting (XSS) injection, LDAP injection, command execution detection (eval(), system(), passtru()...), and HTTP response splitting, session fixation (CRLF injection) detection.
Wapiti can also differentiate between punctual and permanent XSS vulnerabilities, and it prints a warning whenever it finds a script allowing HTTP uploads. A warning is also issued when an HTTP 500 code is returned (useful for ASP/IIS).
Unlike other vulnerability tools like Nikto, Wapiti does not rely on a vulnerability database. Instead, it aims to discover unknown vulnerabilities in web applications. As of now, Wapiti does not provide a GUI, so you need to use it through a terminal.
What's New
Version 2.1.0: N/A