DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Top 20 Wapiti Commands Every Security Professional Should Know

#wapiti #hackingtools #cybersecurity #wapititool

Wapiti is a powerful open-source web application vulnerability scanner written in Python. Unlike many commercial alternatives, Wapiti performs black-box scanning, meaning it analyzes the deployed web application without access to source code. It detects vulnerabilities such as SQL injection, cross-site scripting, file inclusion, command execution, and more. This second entry in our series covers the twenty most practical Wapiti commands, complete with explanations of when and why to use each one.

Top 20 Wapiti Commands

1. Basic Scan Against a URL 

wapiti -u https://example.com/
Enter fullscreen mode Exit fullscreen mode

The -u flag specifies the target URL. This is the simplest invocation and performs a full scan using all default modules against the specified target. Wapiti will crawl the site and test for a broad range of vulnerabilities automatically.

2. Scan with Specific Modules 

wapiti -u https://example.com/ -m sql,xss
Enter fullscreen mode Exit fullscreen mode

The -m flag lets you select specific attack modules to run. In this example, only SQL injection and cross-site scripting tests are performed. This is useful when you want to focus on particular vulnerability classes or reduce scan time.

3. List Available Modules 

wapiti -u https://example.com/ --list-modules
Enter fullscreen mode Exit fullscreen mode

Before running a targeted scan, list all available modules to understand what Wapiti can test for. Modules include sql, xss, file, ssrf, xxe, crlf, exec, and several others. Knowing the module names helps you construct precise scan commands.

4. Scan with Authentication 

wapiti -u https://example.com/ --auth-user admin --auth-password secret
Enter fullscreen mode Exit fullscreen mode

Many web applications require authentication before exposing vulnerable functionality. The --auth-user and --auth-password flags supply credentials for HTTP basic authentication or form-based login depending on the configuration.

5. Use a Cookie for Session-Based Scanning 

wapiti -u https://example.com/ -c "PHPSESSID=abc123; security=low"
Enter fullscreen mode Exit fullscreen mode

The -c flag passes a cookie header with every request. This is essential for scanning authenticated areas of an application when you already have a valid session token. It is commonly used in lab environments like DVWA.

6. Set a Custom User-Agent 

wapiti -u https://example.com/ -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
Enter fullscreen mode Exit fullscreen mode

The -A flag sets a custom User-Agent string. Some applications serve different content or block requests from default scanner User-Agents. Spoofing a browser string can help bypass basic filtering.

7. Limit Scan Scope with Exclude URLs 

wapiti -u https://example.com/ --exclude https://example.com/logout
Enter fullscreen mode Exit fullscreen mode

The --exclude flag prevents Wapiti from scanning specific URLs. This is critical when certain endpoints perform destructive actions such as account deletion or data modification. Always exclude logout and administrative action URLs.

8. Scan Multiple URLs from a File 

wapiti -u https://example.com/ -f urls.txt
Enter fullscreen mode Exit fullscreen mode

The -f flag supplies a file containing a list of URLs to scan. This is useful when you have a predefined set of endpoints rather than letting Wapiti crawl the entire site. Combined with scope restrictions, it keeps scans focused.

9. Control Crawl Depth 

wapiti -u https://example.com/ -d 3
Enter fullscreen mode Exit fullscreen mode

The -d flag sets the maximum crawling depth. A depth of 1 limits the scan to the starting page and its direct links. A depth of 5 or higher explores deeper into the application but takes significantly longer.

10. Set Maximum Number of URLs 

wapiti -u https://example.com/ -m 200
Enter fullscreen mode Exit fullscreen mode

The -m flag here limits the maximum number of URLs to scan (note: this differs from the module selection flag in some versions; check your Wapiti version documentation). This prevents runaway scans on large applications.

11. Adjust Number of Concurrent Tasks 

wapiti -u https://example.com/ -t 10
Enter fullscreen mode Exit fullscreen mode

The -t flag sets the number of concurrent tasks. Higher values speed up scanning but increase load on the target. Lower values are gentler and less likely to trigger rate limiting or WAF blocks.

12. Set Request Timeout 

wapiti -u https://example.com/ --timeout 15
Enter fullscreen mode Exit fullscreen mode

The --timeout flag defines the maximum number of seconds to wait for a response. Increasing the timeout helps with slow applications. Decreasing it speeds up scans against responsive targets.

13. Add Custom HTTP Headers 

wapiti -u https://example.com/ -H "X-Forwarded-For: 127.0.0.1"
Enter fullscreen mode Exit fullscreen mode

The -H flag adds custom headers to every request. This is useful for testing header-based access controls, bypassing IP restrictions, or simulating requests from a reverse proxy.

14. Use a Proxy for Interception 

wapiti -u https://example.com/ --proxy http://127.0.0.1:8080
Enter fullscreen mode Exit fullscreen mode

The --proxy flag routes all Wapiti traffic through a proxy such as Burp Suite or OWASP ZAP. This lets you inspect, modify, and log every request the scanner makes in real time.

15. Scan Behind a Proxy with Authentication 

wapiti -u https://example.com/ --proxy http://127.0.0.1:8080 --proxy-user user --proxy-password pass
Enter fullscreen mode Exit fullscreen mode

When your interception proxy requires authentication, use the --proxy-user and --proxy-password flags. This is common in corporate environments where proxies enforce access control.

16. Save Scan Report in HTML Format 

wapiti -u https://example.com/ -f html -o /path/to/report
Enter fullscreen mode Exit fullscreen mode

The -f flag specifies the report format, and -o sets the output directory. HTML reports are ideal for sharing findings with stakeholders who need a readable summary with severity ratings and remediation advice.

17. Save Scan Report in JSON Format 

wapiti -u https://example.com/ -f json -o /path/to/report
Enter fullscreen mode Exit fullscreen mode

JSON output is machine-readable and integrates well with CI/CD pipelines, custom dashboards, and vulnerability management platforms. Use this format when you need to parse results programmatically.

18. Save Scan Report in Multiple Formats 

wapiti -u https://example.com/ -f html -f json -f txt -o /path/to/report
Enter fullscreen mode Exit fullscreen mode

Wapiti supports generating multiple report formats in a single run. This is efficient when different teams need different formats. The HTML report serves humans while the JSON feeds automation.

19. Resume an Interrupted Scan 

wapiti -u https://example.com/ --resume /path/to/report
Enter fullscreen mode Exit fullscreen mode

The --resume flag restarts a scan from where it left off using a previously saved report directory. This is invaluable for long scans that were interrupted by network issues or system reboots.

20. Verbose Output for Debugging 

wapiti -u https://example.com/ -v 2
Enter fullscreen mode Exit fullscreen mode

The -v flag controls verbosity. Level 1 shows basic progress, level 2 adds detailed request and response information. Use higher verbosity when troubleshooting why certain endpoints are not being scanned or when verifying payload delivery.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)