A community post published on dev.to gathers twenty command-line invocations for Wapiti, an open-source web application vulnerability scanner written in Python, into a single reference list. The author, writing under the handle abhinavsingwal, frames the piece as the second entry in a series and describes each command with a short note on when it would be used. The post is a usage guide rather than a release announcement: it introduces no new Wapiti version, no benchmark and no independent evaluation of the tool's detection accuracy.
According to the author, Wapiti operates as a black-box scanner, meaning it probes a deployed application without access to its source code. The post lists the vulnerability classes the tool is said to detect, including SQL injection, cross-site scripting, file inclusion and command execution. These are the author's characterizations of the tool's scope; the evidence contains no vendor documentation, changelog or third-party test confirming them.
The first commands in the list are the simplest. A bare invocation with the -u flag against a target URL is described as running a full scan with all default modules, with the scanner crawling the site and testing automatically. The author then narrows the scope with the -m flag, which selects specific attack modules — the example given runs only SQL injection and cross-site scripting tests, which the author says is useful for focusing on particular vulnerability classes or cutting scan time.
A separate command lists the available modules before a targeted run. The author names sql, xss, file, ssrf, xxe, crlf and exec among the module identifiers, and argues that knowing the names helps construct precise commands. This is the kind of detail that matters most to someone writing repeatable scan scripts, because module identifiers are the part of the interface most likely to change between versions.
For applications that hide functionality behind a login, the post documents two approaches. One supplies credentials through --auth-user and --auth-password, which the author says cover HTTP basic authentication or form-based login depending on configuration. The other passes a session cookie with the -c flag, illustrated with a PHPSESSID value and a security parameter, which the author ties to lab environments such as DVWA. The distinction is practical: credential flags handle the login step, while a cookie flag assumes a session has already been obtained.
How the scanner identifies itself to the target is covered by several commands. A custom User-Agent string is set with the -A flag; per the author, this can be helpful when an application blocks default scanner agents or serves them different content. With the -H flag, arbitrary headers are added to every request; an X-Forwarded-For example is framed as handy for simulating a reverse proxy, bypassing IP restrictions, or testing header-based access controls. These are presented by the author as techniques for reaching functionality, not as guarantees that filtering will be evaded.
Scope control gets its own cluster of commands. The --exclude flag keeps the scanner away from specified URLs, and the author advises excluding logout and administrative action endpoints because they can perform destructive operations such as account deletion or data modification. A separate -f flag supplies a file of URLs to scan instead of letting the scanner crawl the whole site. Crawl depth is bounded with -d, where the author notes that a depth of one limits the scan to the starting page and its direct links while deeper values take substantially longer.
The post also covers resource limits. One command caps the number of URLs scanned, though the author flags a version caveat: the flag used in that example differs from the module-selection flag in some versions, and readers are told to check their own version's documentation. Concurrency is set with -t, which the author says speeds up scanning at the cost of heavier load on the target and a greater chance of triggering rate limiting or a WAF block. Request timeout is adjusted with --timeout, with longer values suggested for slow applications and shorter ones for responsive targets.
Proxy support is documented in two forms. The --proxy flag routes scanner traffic through an interception proxy such as Burp Suite or OWASP ZAP so requests can be inspected, modified and logged in real time. When that proxy itself requires credentials, --proxy-user and --proxy-password are added, which the author associates with corporate environments that enforce proxy access control.
Reporting commands close out the list. The author shows HTML output for sharing findings with stakeholders, JSON output for machine-readable integration with CI/CD pipelines, dashboards and vulnerability management platforms, and a single run that emits HTML, JSON and text reports together. The post also documents --resume, which restarts an interrupted scan from a previously saved report directory, and -v for verbosity, where level one shows basic progress and level two adds request and response detail for troubleshooting.
For freelancers and developers who run security checks as part of client work, the value here is operational rather than analytical. The list is a starting point for assembling a repeatable scan command — target, modules, authentication, scope exclusions, concurrency and output format — rather than a methodology for interpreting results. The author's own advice to exclude destructive endpoints and to check version-specific flag behavior are the two items most likely to prevent an incident during a live engagement.
The limitations of the source are significant and should shape how the post is used. It is a community tutorial, so every command and flag description is an author claim rather than independently verified documentation. No Wapiti version number is given, and the author explicitly notes at least one flag whose meaning varies by version, which means commands copied from the post may not behave as described on a current install. There is no information about licensing, pricing or support, and no measurement of detection rates, false positives or scan duration.
The post also contains no evidence that any of the commands were executed against a real target, and no results are reported. Claims about bypassing filtering or IP restrictions are presented as possible uses, not demonstrated outcomes. Readers should treat the list as a set of hypotheses to validate against their own Wapiti version and their own authorized test environment, and should confirm flag semantics with the tool's own help output before relying on them.
The closing section of the post points readers to the author's GitHub repository of hacking tools and cheat sheets and to a link-aggregation page. Those links are promotional pointers from the author and are not corroboration of any technical claim made in the command list.
Taken together, the post is best read as one practitioner's condensed notes on driving a scanner from the command line. It is useful for discovering which knobs exist — authentication, cookies, headers, proxies, scope limits, report formats and resumption — but it does not establish that any particular configuration is correct, current or effective. The practical next step for a working developer is to run the tool's own module listing and help output on the installed version, then build the command from there.
The most durable takeaway is structural: the commands map onto a workflow of defining a target, authenticating, constraining scope, controlling load and choosing an output format. That workflow transfers even if individual flags change. The specific flag letters and their meanings, however, should be treated as version-dependent until confirmed locally.