Until now I managed to look into Webscarab, Webscarab-NG, IronWASP & Burp extender.

Unfortunately, except IronWASP, that refused to compile from the GIT source, none of the projects matched my criteria (Webscarab lacked the scanner, so does Webscarab-NG & Burp extender is indeed very nice, but not open source).

Do you know about any other open source projects that might work?

  • Shopping or product recommendation questions are not a good fit. Closing.
    – Rory Alsop
    Commented Jun 1, 2012 at 7:19
  • I guess I have a slightly different perspective. I think this is a fine question, and the fact that it got some good useful answers is evidence that it is an OK fit for this site. I advocate re-opening it.
    – D.W.
    Commented Jun 4, 2012 at 5:58

2 Answers 2


Wapiti (python) and Skipfish (C/C++) are both good open source scanners that are not bad. My biggest complaint is that they are overly simplistic, for instance Skipfish doesn't actually have an html parser, instead it uses a system of overly simplistic regular expressions. Wapiti uses Python's html parser, which is better, however Wapiti isn't actively maintained. Skipfish's biggest problem is that it will DoS web application with the traffic it produces, so I wouldn't run it on a production system.

I studied both of these projects when building my scanner Sitewatch, we provide a free service and its better than any open source web application scanner I am aware of.


SecToolAddict has a very in-depth review of many commercial, free, open, and closed source scanners. You will find many high quality options there. His new round of tests are starting soon.

From my personal experience, I can vouch for w3af and arachni as having spiders and being effective scanners. Both of them are open-source, under active development, and rank highly in the sectooladdict tests.

Not the answer you're looking for? Browse other questions tagged .