Finding vulnerabilities with Wapiti

Wapiti is another terminal-based Web vulnerability scanner, which sends GET and POST requests to target sites looking for the following vulnerabilities (http://wapiti.sourceforge.net/):

  • File disclosure
  • Database injection
  • XSS (cross-site scripting)
  • Command execution detection
  • CRLF injection
  • XXE (XML eXternal Entity) injection
  • Use of known potentially dangerous files
  • Weak .htaccess configurations that can be bypassed
  • Presence of backup files that give sensitive information (source code disclosure)

In this recipe, we will use Wapiti to discover vulnerabilities in one of our test applications and generate a report of the scan.

How to do it...

  1. We can call Wapiti from a terminal window, as shown:
    wapiti http://192.168.56.102/peruggia/ ...

Get Kali Linux Web Penetration Testing Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial