Wapiti Web Vulnerability Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Wapiti is an open source web-application vulnerability scanner, a dynamic application security testing (DAST) tool. Given the URL of a web application you own or are authorised to test, Wapiti crawls the application and actively injects payloads to surface real, exploitable vulnerabilities, then produces a report you can act on. This AMI delivers Wapiti fully installed in an isolated virtualenv and ready to scan within minutes of launch, eliminating the manual Python environment setup, dependency pinning and service configuration a bare install requires.

## Black-Box Web Vulnerability Scanning

Wapiti works as a black box: it does not read your source code. It fuzzes the forms, URLs and parameters it discovers by crawling and reports the vulnerability classes it can prove, including cross-site scripting (XSS), SQL and NoSQL injection, command injection, path traversal, XML external entity (XXE), server-side request forgery (SSRF), open redirects, and exposed backup or configuration files. Point the bundled command-line tool at a target, choose the attack modules to run, and Wapiti writes a full report in HTML, JSON, XML or plain text.

## Use It Responsibly

A vulnerability scanner is an offensive security tool. This appliance ships with no default target and never scans anything on its own except a deliberately vulnerable loopback page it stands up to self-verify its detection engine. The optional daily scheduled scan reads a targets file that ships empty, so nothing is ever scanned until you add a URL you own or have written authorisation to test. Only scan systems you are authorised to test.

## Proven Detection Engine

Every instance self-verifies on first boot, and the image is validated at build time by a real detection round-trip: Wapiti scans a deliberately vulnerable reflected-XSS page over loopback and must report the finding, then scans an escaped clean page and must report nothing. Detection is a gate, not an assumption.

## Secure By Default

Wapiti binds no listening socket and runs no daemon: it is a client-side scanner that only makes outbound requests to the targets you choose. The instance security group opens only the SSH port, and there is no login, no web console and no bootstrap password anywhere on the image, which is the strongest possible posture. Administration is over SSH with your own key.

## Scheduled Scanning

A systemd timer can run Wapiti daily against a list of authorised targets you configure and write an HTML report for each, with a fail-closed design that refuses to run if first-boot verification did not complete. Wire the reports into your own review workflow to track a web application's security posture over time.

## Ready To Use

Connect over SSH and Wapiti is already installed and self-verified. Read the welcome notes, run a scan against a web application you own, and review the report. Compared to installing and pinning Wapiti and its Python dependencies by hand, this AMI eliminates the setup effort entirely.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers help with running scans, choosing and tuning attack modules, interpreting reports, configuring the scheduled scan against authorised targets, integrating Wapiti into CI/CD security gates, and upgrade planning.

## Use Cases

• Actively testing web applications you own for XSS, injection and other vulnerability classes before release
• Adding an open source DAST stage to a CI/CD pipeline with no vendor lock-in
• Running scheduled, authorised scans of your own staging and production web applications and tracking findings over time

## Getting Started

1. Launch the AMI in your preferred AWS region

2. SSH into the instance and read the welcome notes

3. Run your first scan against a web application you are authorised to test

4. Review the report and, optionally, configure the daily scheduled scan