Base
Hardened build
minimal ports, security patches applied at build time
Wapiti on Ubuntu 24.04 LTS
Azure
Security
Wapiti, the open source web vulnerability scanner that crawls a running application you own and actively probes it for injection, cross site scripting and other flaws.
Overview
Wapiti is a dynamic application security testing scanner, a black box tool that tests a live web application from the outside the way an attacker would. Point it at the URL of an application you own or are authorised to test and it crawls the pages and forms, then injects crafted payloads to surface real vulnerabilities: SQL injection, cross site scripting, command and code injection, path traversal, XML external entity, server side request forgery, open redirects, exposed backup files and more. It reports each finding with the request that triggered it, so a team can confirm and fix the flaw rather than guess at it. It runs as a single command with no server, no database and no login: give it a target and a set of attack modules and it writes a report in HTML, JSON or several other formats. Because it drives the application over HTTP it complements static code scanning, catching issues that only appear in the deployed, running system.
It suits application security teams testing their own web apps, engineers adding a scan step to a release pipeline against a staging environment they control, and anyone who wants a self hosted scanner they own inside their own cloud account.
Why the cloudimg image
Wapiti has no login and no network service of its own, so what matters is that it is shipped ready to run, honest about having no credential, and safe by default, and cloudimg ships it exactly that way. The pinned Wapiti release is installed into an isolated virtualenv with a simple wapiti command on the path, a first boot service self verifies the scanner on your own instance and records the instance details to a root only note, and a daily timer scans only the targets you explicitly add and are authorised to test. It ships with no target configured, nothing listens on the network, the only remote surface is SSH with your own key, and the image is scanned clean of fixable vulnerabilities before it is sealed. Every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Scan a running web application you own for injection, cross site scripting and other flaws
- Add a dynamic security scan against a staging environment to a release pipeline
- A self hosted web vulnerability scanner you own inside your own cloud account
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.