⚠️ Overview

wapiti is an open-source web application vulnerability scanner written in Python, first released in 2009 by Nicolas Surribas (also known as devloop) and currently maintained under the project name "wapiti-scanner" on GitHub. The tool is designed to perform black-box security testing of web applications by automatically discovering and exploiting vulnerabilities such as SQL injection, XSS, file inclusion, command injection, and CRLF injection. It is publicly available at https://github.com/wapiti-scanner/wapiti and is distributed under the GNU General Public License v3.

🔧 Technical Capabilities

wapiti operates using a modular architecture with separate attack plugins for each vulnerability class, including SQL injection (both error-based and blind), reflected and stored cross-site scripting (XSS), local and remote file inclusion (LFI/RFI), command injection, LDAP injection, path traversal, CRLF injection, and server-side request forgery (SSRF). The scanner first crawls the target web application to discover all accessible endpoints, then performs active payload injection using a built-in dictionary of attack strings. It supports both GET and POST parameter fuzzing, cookie and header injection, and can handle authentication through session cookies. Wapiti also features an user-agent configuration that defaults to "Mozilla/5.0 (compatible; Wapiti/3.2.2)" or similar versions, making it identifiable. It can output reports in HTML, JSON, XML, or text formats, and includes a proxy mode for manual testing. The tool is designed to be used both as a command-line utility and via a GUI front-end called "wapiti-gui".

📜 History & Notable Incidents

Wapiti was initially released in 2009 and has seen continuous development, with version 3.2.0 released in February 2023 and subsequent bug fix releases. While wapiti itself is a legitimate security tool used by penetration testers, it is also frequently employed by malicious actors to automate vulnerability discovery against web applications without authorization. No specific CVEs are associated with the scanner itself, but its use has been documented in multiple breach analyses where attackers used wapiti to identify and exploit SQL injection vulnerabilities in outdated CMS installations. The tool's ability to quickly identify numerous vulnerability types makes it a common component in attack toolkits observed by threat intelligence feeds such as AlienVault OTX and CrowdStrike.

🔍 Detection Indicators

Wapiti's default User-Agent string follows the pattern "Wapiti/<version>" (e.g., "Wapiti/3.2.2"). However, advanced users can modify the User-Agent via the --user-agent switch, so behavioral detection is crucial. Wapiti generates a high volume of requests with injected payloads such as single quotes ('), <script> tags, and directory traversal patterns like ../../../etc/passwd. It also sends requests with custom headers like X-Forwarded-For used in SSRF attacks. On the network level, wapiti performs rapid sequential requests to many different endpoints (crawl followed by attack phase), often with distinct timing patterns. Web servers may log repeated 404 errors for crafted paths during the crawling phase.

☠️ Risk & Impact

When used maliciously, wapiti can automatically expose severe vulnerabilities such as SQL injection that leads to database extraction, XSS that enables session hijacking, and file inclusion that may allow remote code execution. The scanner's ability to probe for multiple vulnerability types in a single scan makes it highly efficient for attackers aiming to find the weakest entry point. Successful exploitation can result in complete compromise of the web application, including data theft, defacement, or use as a pivot point for internal network attacks.

🛡️ Mitigation

Wapiti is blocked immediately on detection because its automated scanning activity is a clear precursor to exploitation, posing unacceptable risk to application integrity and data confidentiality. Mitigation involves blocking requests containing the default User-Agent string and implementing rate limiting and Web Application Firewall (WAF) rules that detect SQL injection payload patterns and excessive crawl requests. Additionally, regular security patching and input validation are the ultimate defenses against the vulnerabilities wapiti exploits.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.