Web Application

Wapiti

Web application vulnerability scanner (black-box).

beginner

Linux

Scanning

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Automated web vuln pass complementary to ZAP/Nuclei.

Run against URL; review generated report.

Another perspective reduces blind spots.

Commands & usage

wapiti -u https://example.com -f html -o report

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

ffuf

Fast web fuzzer for directories, vhosts, parameters, and more.

Gobuster

Directory/DNS/vhost brute-forcing tool written in Go.

Feroxbuster

Recursive content discovery tool with smart filtering.

dirsearch

Feature-rich web path scanner in Python.

Wfuzz

Flexible web application fuzzer for params, headers, auth, etc.

Nuclei

Template-based vulnerability scanner with huge community template set.