Wapiti

No entries match these filters. Clear filters

1. 3.3.1 Jul 27, 2026 · issue 027

   Wapiti 3.3.1 adds stacktrace disclosure detection, stronger SQL boolean-based detection, improved CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. analysis, and per-host passive reporting.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.3.1 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.3.1

   └──▷ TRY IT
   Run passive modules (including the new stacktrace and CSP checks) against a target to surface disclosure issues without active fuzzing.
   copy

   $ wapiti -u https://example.com -m csp,http_headers,cookieflags

   Run boolean-based SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection (now robust to dynamic pages) alongside time-based SQL for comprehensive coverage.
   copy

   $ wapiti -u https://example.com -m sql,timesql

   • Adds passive detection of server-side stacktrace disclosures in HTTP responses.
   • Improves boolean-based SQL injection detection to remain robust against dynamic/randomized pages.
   • Enhances the passive CSP module to flag unknown directives and missing frame-ancestors and form-action directives.
   • Reports distinct passive security postures per host, enabling per-target analysis across multi-host scans.
   • Surfaces previously suppressed passive alerts in scan reports so no passive finding is silently dropped.

   +3 more show less

   • Improves passive report readability with a colored suppression summary and per-page deduplication of cleartext-password findings.
   • Reports timeout and HTTP 500 anomalies detected by the SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. module.
   • Improves Log4Shell DNS verification performance.

   8 details in Everything

2. 3.3.0 May 13, 2026 · release notes

   Wapiti 3.3.0 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth option, Printer module, sequential crawlers, and modern CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. detection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.3.0 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.3.0

   • Introduces the Printer module to Wapiti's attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources.
   • Enables running both crawlers sequentially via new configuration
   • Adds detection patterns for modern frameworks and ORMs in the CMS module
   • Adds support for XHTML and XML content types in XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection

   4 details in Everything

3. 3.2.9 Nov 7, 2025 · release notes

   Wapiti 3.2.9 switches rendering to Playwright and adds a utility for installing Firefox headless.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.9 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.2.9

   • Uses playwright instead of the legacy wapiti-arsenic module for browser rendering
   • Adds an installer utility script for deploying Firefox headless

   2 details in Everything

4. 3.2.7 Oct 13, 2025 · release notes

   Wapiti 3.2.7 passes headers from swagger files to generated requests

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.7 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.2.7

5. 3.2.6 Oct 7, 2025 · release notes

   Wapiti 3.2.6 adds NS takeover checking via mod_takeover module

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.6 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.2.6

   • mod_takeover now checks for Name Server (NS) takeover vulnerabilities

   1 detail in Everything

6. 3.2.0 Aug 13, 2024 · release notes

   Wapiti 3.2.0 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. injection detection, Swagger scanning, JSON payload injection, and cookie flag.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.0 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.2.0

   └──▷ USE IT
   Pass specific session cookies during a crawl without manual injection.
   shell copy

   wapiti --url https://target.com --cookie-value "sessionid=abc123"

   Detect LDAP injection vulnerabilities using the new module.
   shell copy

   wapiti --url https://target.com -m ldap

   Scan an API by providing its Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. definition file.
   shell copy

   wapiti --url https://api.target.com/swagger.yaml -m swagger

   • Add --cookie-value option to easily pass cookies to the crawler
   • Add a mod_ldap module for error-based and boolean-based LDAP injection
   • Scan APIs given a Swagger (OpenAPI) file
   • Add capabilities to inject payloads inside JSON bodies

   4 details in Everything

7. 3.1.8 May 16, 2024 · release notes

   Wapiti 3.1.8 adds four new scan modules for Spring4Shell, file uploads, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirects, and method inspection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.8 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.1.8

   └──▷ USE IT
   Scan for Spring4Shell vulnerabilities on a target URL
   shell copy

   wapiti --url http://target.com -m mod_spring4shell

   Detect unrestricted file upload vectors
   shell copy

   wapiti --url http://target.com -m mod_upload

   • mod_spring4shell: New module to detect the Spring4Shell vulnerability
   • mod_upload: New module to detect unrestricted file uploads (attempt to upload PHP code)
   • mod_https_redirect: New module to detect lack of redirect-to-https behavior
   • mod_methods: In-depth check of methods allowed by a web server

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !CLI authentication options have been renamed; existing scripts using old option names will fail.
8. 3.1.5 Jan 16, 2023 · release notes

   Adds loknop LFI payload technique and fixes core proxy/cred bugs

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.5 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.1.5

   • Adds loknop technique payload for Local File Inclusion (LFI) testing via chained PHP filters.

   1 detail in Everything

9. 3.1.4 Oct 24, 2022 · release notes

   Wapiti 3.1.4 adds Firefox headless crawler support and combines HTTP auth with form login

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.4 https://github.com/wapiti-scanner/wapiti.git
   # already have the repo? check out this version:
   $ git checkout 3.1.4

   • Crawler: Adds support for Firefox headless (using the new --headless option)
   • Core: improve authentication. You can now pass HTTP auth (basic, ntml, etc) AND login by sending creds to an HTML form

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Authentication related options have changed, check the manual page for information
10. 3.1.3 Jul 9, 2022 · release notes

    Wapiti 3.1.3 adds detailed report output and mitm-proxy crawler mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.3 https://github.com/wapiti-scanner/wapiti.git
    # already have the repo? check out this version:
    $ git checkout 3.1.3

    └──▷ USE IT
    Scan a target and generate a report containing full HTTP request/response bodies for deep analysis
    shell copy

    wapiti --url https://example.com/ --output detailed_report.html --detailed-report

    Run Wapiti's crawler mode using a local man-in-the-middle proxy on port 8080 for complex authentication flows
    shell copy

    wapiti --url https://example.com/ --mitm-port 8080

    • Adds the --detailed-report option to include HTTP responses in reports
    • Adds the --mitm-port <PORT> option to replace the crawler with an intercepting proxy

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dropped support of Python 3.7
11. 3.1.1 Feb 23, 2022 · release notes

    Wapiti 3.1.1 adds --data for single POST attacks and per-module updates via --update

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.1 https://github.com/wapiti-scanner/wapiti.git
    # already have the repo? check out this version:
    $ git checkout 3.1.1

    └──▷ USE IT
    Send a specific POST payload without scanning the whole site structure.
    shell copy

    wapiti --url https://example.com --data "username=admin&password=test"

    • --data allows launching attacks on a single POST request with a url-encoded string.
    • --update option now supports updating only chosen modules instead of all.

    2 details in Everything

12. 3.1.0 Feb 6, 2022 · release notes

    Wapiti 3.1.0 adds HashThePlanet module for tech detection via file hashes and improves Log4Shell attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/wapiti-scanner/wapiti.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    • Adds HashThePlanet module to detect technologies and software versions based on the hashes of files
    • Expands Log4Shell attack module to include POST parameters, VMware vSphere, Apache Struts, Druid, and Solr
    • Adds Django anti-CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. token to the whitelist for CSRF modules

    3 details in Everything