Wapiti DAST Web Vulnerability Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Wapiti Web Vulnerability Scanner - Ready-to-Use DAST Appliance

Wapiti is an open source web-application vulnerability scanner (DAST) that crawls your web applications, actively injects payloads to surface real exploitable vulnerabilities, and produces actionable reports. This AMI delivers Wapiti fully installed in an isolated virtualenv and ready to scan within minutes of launch - eliminating manual Python environment setup, dependency pinning, and service configuration.

## Why Choose This AMI Over Alternatives?

Unlike commercial DAST tools that require annual licenses and vendor lock-in, or other open-source scanner AMIs that ship without verification, this appliance includes:

• Build-time detection guarantee - Every image is validated by a real detection round-trip before publication. Wapiti scans a deliberately vulnerable reflected-XSS page and must report the finding, then scans a clean page and must report nothing. No other Marketplace DAST AMI gates release on proven detection.
• Zero-credential attack surface - No login, no web console, no daemon, no listening port, no bootstrap password. Many competing scanner AMIs expose web UIs or default credentials. This image binds only SSH with your own key.
• Fail-closed scheduled scanning - The optional daily scan refuses to run if first-boot verification did not complete, preventing silent false-negative sweeps.
• No dependency maintenance - Manual Wapiti installs require ongoing Python version management and dependency pinning. This AMI eliminates that burden entirely.

## Black-Box Vulnerability Coverage

Wapiti works as a black box - it does not read source code. It fuzzes forms, URLs, and parameters it discovers by crawling and reports vulnerability classes it can prove, including:

• Cross-site scripting (XSS)
• SQL and NoSQL injection
• Command injection
• Path traversal
• XML external entity (XXE)
• Server-side request forgery (SSRF)
• Open redirects
• Exposed backup and configuration files

Reports are generated in HTML, JSON, XML, or plain text for integration into your existing workflows.

## Secure By Default

Wapiti binds no listening socket and runs no daemon. It is a client-side scanner that only makes outbound requests to targets you choose. The instance security group opens only SSH. Administration is over SSH with your own key - the strongest possible posture for a security tool.

## Scheduled Scanning for Continuous Security

A systemd timer can run Wapiti daily against a list of authorised targets you configure, writing an HTML report for each run. Wire the reports into your review workflow to track your web applications' security posture over time. The fail-closed design refuses to run if first-boot verification did not complete.

## Use It Responsibly

This appliance ships with no default target and never scans anything on its own except a deliberately vulnerable loopback page for self-verification. The targets file ships empty - nothing is scanned until you add a URL you own or have written authorisation to test.

## Use Cases

• Actively testing web applications you own for XSS, injection, and other vulnerability classes before release
• Adding an open source DAST stage to a CI/CD pipeline with no vendor lock-in
• Running scheduled authorised scans of staging and production web applications and tracking findings over time
• Replacing manual Wapiti installs across multiple environments with a consistent, verified AMI

## Getting Started

1. Launch the AMI in your preferred AWS region

2. SSH into the instance and read the welcome notes

3. Run your first scan against a web application you are authorised to test

4. Review the generated report

5. Optionally, configure the daily scheduled scan against your authorised targets

## Next Step - Book a Guided First-Scan Session

Not sure where to start? Contact cloudimg support to schedule a guided first-scan walkthrough where our engineers help you configure attack modules for your application stack and interpret the results.

## About cloudimg

cloudimg provides 24/7 technical support for this AMI. Our engineers help with running scans, choosing and tuning attack modules, interpreting reports, configuring scheduled scans, integrating Wapiti into CI/CD security gates, and upgrade planning.