Wapiti Integration with DefectDojo
Wapiti is an open-source web application vulnerability scanner written in Python that performs black-box security audits by crawling deployed web applications, extracting URLs and forms, and injecting payloads to detect vulnerabilities including SQL injection, cross-site scripting (XSS), file inclusion, command execution, XXE injections, CRLF injections, server-side request forgery, and open redirects aligned with OWASP Top 10 and SANS 25. The tool operates as a fuzzer that sends malicious payloads to test scripts for security weaknesses without analyzing source code, supporting session management with sqlite3 databases for scan resumption, multiple authentication methods including Basic, Digest, and NTLM, and generating comprehensive vulnerability reports in HTML, XML, JSON, TXT, and CSV formats for integration into security testing workflows throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Wapiti results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Wapiti",
"engagement": "<engagement-id>",
"file": "results.json"
}