Web vulnerability scanners

Probe running web applications and APIs for vulnerabilities from the outside.

Side by side

Web vulnerability scanners
Tool	Stars	Licence	Terms	Self-hosted	Language	Latest	Last push
Nuclei	32k	MIT	Open source	No	Go	v3.11.1	2026-10-06
ZAP	16k	Apache-2.0	Open source	No	Java	v2.17.0	2026-10-06
Nikto	11k	Other	Open core	No	Perl	2.6.1	2026-10-04
Wapiti	1.9k	GPL-2.0	Open source	No	Python	3.3.2	2026-10-05

4 tools

Nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Language: Go
Licence: MIT
Stars: 32k
Latest: v3.11.1
Last push: 2026-10-06

ZAP

The ZAP by Checkmarx Core project

Language: Java
Licence: Apache-2.0
Stars: 16k
Latest: v2.17.0
Last push: 2026-10-06

Nikto

Nikto web server scanner

Language: Perl
Licence: Other
Stars: 11k
Latest: 2.6.1
Last push: 2026-10-04

Wapiti

Web vulnerability scanner written in Python3

Language: Python
Licence: GPL-2.0
Stars: 1.9k
Latest: 3.3.2
Last push: 2026-10-05

What these tools replace

Burp SuiteWeb vulnerability scanners2 →