Wapiti
Black-box scanner that audits your site by injecting real payloads.
What it does
Wapiti crawls your pages and then fuzzes every form and URL parameter it finds, injecting test payloads to detect SQL injection, cross-site scripting, file disclosure, command execution, and other injection flaws in your own code.
What data you get
A per-vulnerability report listing the affected URL, the parameter and payload that triggered it, and the request needed to reproduce it — exportable as HTML, JSON or XML.
Why it matters to your site
It gives you an independent, code-focused second opinion alongside a scanner like ZAP, and its targeted injection tests catch input-handling bugs that lead to data leaks or takeover.
More in this category
Other general-purpose tools
OWASP ZAP
★ FeaturedThe most widely used open-source web application scanner.
Skipfish
High-speed active reconnaissance and security probe.
Vega
GUI-driven scanner and intercepting proxy in one.