https://cybertoolchain.io/tools/wapiti New releases and features in Wapiti, tracked by The Cyber Toolchain. en Mon, 27 Jul 2026 14:47:00 GMT https://github.com/wapiti-scanner/wapiti/releases/tag/3.3.1 https://github.com/wapiti-scanner/wapiti/releases/tag/3.3.1 Mon, 27 Jul 2026 14:47:00 GMT Wapiti 3.3.1 adds stacktrace disclosure detection, stronger SQL boolean-based detection, improved CSP analysis, and per-host passive reporting. • Adds passive detection of server-side stacktrace disclosures in HTTP responses. • Improves boolean-based SQL injection detection to remain robust against dynamic/randomized pages. • Enhances the passive CSP module to flag unknown directives and missing `frame-ancestors` and `form-action` directives. • Reports distinct passive security postures per host, enabling per-target analysis across multi-host scans. • Surfaces previously suppressed passive alerts in scan reports so no passive finding is silently dropped. • Improves passive report readability with a colored suppression summary and per-page deduplication of cleartext-password findings. • Reports timeout and HTTP 500 anomalies detected by the SSRF module. • Improves Log4Shell DNS verification performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.3.0 https://github.com/wapiti-scanner/wapiti/releases/tag/3.3.0 Wed, 13 May 2026 19:31:36 GMT Wapiti 3.3.0 adds JWT auth option, Printer module, sequential crawlers, and modern CMS detection • Introduces the `Printer` module to Wapiti's attack surface • Enables running both crawlers sequentially via new configuration • Adds detection patterns for modern frameworks and ORMs in the CMS module • Adds support for XHTML and XML content types in XSS detection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.9 https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.9 Fri, 07 Nov 2025 21:11:09 GMT Wapiti 3.2.9 switches rendering to Playwright and adds a utility for installing Firefox headless. • Uses `playwright` instead of the legacy `wapiti-arsenic` module for browser rendering • Adds an installer utility script for deploying Firefox headless Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.7 https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.7 Mon, 13 Oct 2025 18:53:23 GMT Wapiti 3.2.7 passes headers from swagger files to generated requests • Pass headers specified by swagger files to generated requests Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.6 https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.6 Tue, 07 Oct 2025 16:30:51 GMT Wapiti 3.2.6 adds NS takeover checking via mod_takeover module • `mod_takeover` now checks for Name Server (NS) takeover vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.0 https://github.com/wapiti-scanner/wapiti/releases/tag/3.2.0 Tue, 13 Aug 2024 09:29:56 GMT Wapiti 3.2.0 adds LDAP injection detection, Swagger scanning, JSON payload injection, and cookie flag. • Add `--cookie-value` option to easily pass cookies to the crawler • Add a `mod_ldap` module for error-based and boolean-based LDAP injection • Scan APIs given a Swagger (OpenAPI) file • Add capabilities to inject payloads inside JSON bodies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.8 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.8 Thu, 16 May 2024 19:22:37 GMT Wapiti 3.1.8 adds four new scan modules for Spring4Shell, file uploads, HTTPS redirects, and method inspection • `mod_spring4shell`: New module to detect the Spring4Shell vulnerability • `mod_upload`: New module to detect unrestricted file uploads (attempt to upload PHP code) • `mod_https_redirect`: New module to detect lack of redirect-to-https behavior • `mod_methods`: In-depth check of methods allowed by a web server Breaking changes: • CLI authentication options have been renamed; existing scripts using old option names will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.5 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.5 Mon, 16 Jan 2023 21:04:33 GMT Adds `loknop` LFI payload technique and fixes core proxy/cred bugs • Adds `loknop` technique payload for Local File Inclusion (LFI) testing via chained PHP filters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.4 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.4 Mon, 24 Oct 2022 18:16:45 GMT Wapiti 3.1.4 adds Firefox headless crawler support and combines HTTP auth with form login • Crawler: Adds support for Firefox headless (using the new `--headless` option) • Core: improve authentication. You can now pass HTTP auth (basic, ntml, etc) AND login by sending creds to an HTML form Breaking changes: • Authentication related options have changed, check the manual page for information Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.3 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.3 Sat, 09 Jul 2022 15:42:52 GMT Wapiti 3.1.3 adds detailed report output and mitm-proxy crawler mode • Adds the `--detailed-report` option to include HTTP responses in reports • Adds the `--mitm-port <PORT>` option to replace the crawler with an intercepting proxy Breaking changes: • Dropped support of Python 3.7 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.1 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.1 Wed, 23 Feb 2022 13:40:55 GMT Wapiti 3.1.1 adds --data for single POST attacks and per-module updates via --update • `--data` allows launching attacks on a single POST request with a url-encoded string. • `--update` option now supports updating only chosen modules instead of all. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.0 https://github.com/wapiti-scanner/wapiti/releases/tag/3.1.0 Sun, 06 Feb 2022 18:36:05 GMT Wapiti 3.1.0 adds HashThePlanet module for tech detection via file hashes and improves Log4Shell attack surface. • Adds `HashThePlanet` module to detect technologies and software versions based on the hashes of files • Expands Log4Shell attack module to include POST parameters, VMware vSphere, Apache Struts, Druid, and Solr • Adds Django anti-CSRF token to the whitelist for CSRF modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wapiti