Wapiti Files

What's Changed

• Added more paths to the Buster module dictionary by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/700
• Updated headless Firefox by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/701
• Updated CMS fingerprint files by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/705
• Fixed consistency between wp_enum and cms/wp_enum versions by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/702
• Marked "Directory Traversal File Include" vulnerability as false positive by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/703
• Fixed Angular detection by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/706
• Added Python 3.14 support by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/709
• Added SPIP plugin detection by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/707
• Added devcontainer environment by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/711
• Upgraded PHP version in the endpoint container by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/712
• Forced aiosqlite version lower than 0.22.0 by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/713
• Fixed cookie-based detection and added tests by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/708
• Deprecated the wp_enum module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/716
• Added a JWT option by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/717
• Fixed non-working --side-file option by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/718
• Marked "Backup Files" vulnerabilities as false positives by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/720
• Added WordPress WPML Multilingual CMS plugin detection to the CMS module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/722
• Added Drupal plugin detection by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/723
• Added a Printer module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/721
• Removed version field from docker-compose files by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/726
• Fixed .gitignore for integration tests by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/727
• Updated PHP version by @MathisFranel in https://github.com/wapiti-scanner/wapiti/pull/729
• Improved mod_exec by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/719
• Updated gitlab-ci.yml by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/730
• Added detection for CVE-2024-55591 by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/704
• Added Ivanti detection module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/731
• Added Palo Alto detection and version fingerprinting module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/732
• Added Magento and TYPO3 CMS detection by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/724
• Improved Dockerfiles by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/734
• Fixed regression affecting webpages in reports by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/735
• Fixed core-js detection issue in mod_wapp by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/733
• Fixed and standardized Ivanti and Palo Alto modules by @bretfourbe in https://github.com/wapiti-scanner/wapiti/pull/737
• Fixed Palo Alto ETag detection by @bretfourbe in https://github.com/wapiti-scanner/wapiti/pull/738
• Fixed regex in the information_disclosure module by @bretfourbe in https://github.com/wapiti-scanner/wapiti/pull/739
• Installed Playwright Firefox in /opt for multi-user access by @Qwarctick in https://github.com/wapiti-scanner/wapiti/pull/740
• Removed body and headers from responses when detail_report_level = 1 by @bretfourbe in https://github.com/wapiti-scanner/wapiti/pull/741
• Fixed Forti error and TYPO3 false positive by @bretfourbe in https://github.com/wapiti-scanner/wapiti/pull/744
• Added detection patterns for modern DBMS by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/752
• Fixed [FF] placeholder not being replaced in XSS payloads by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/753
• Added detection patterns for modern frameworks and ORMs by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/754
• Added missing indexes on frequently filtered database columns by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/756
• Added support for XHTML and XML content types in XSS detection by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/755
• Optimized XSS module by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/747
• perf(explorer): use sets for O(n) → O(1) request lookups by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/758
• perf(mod_takeover): reuse a shared httpx.AsyncClient by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/760
• perf(attack): switched attacked_get / attacked_post from lists to sets by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/761
• perf(stickycookie): removed artificial delays in MITM proxy by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/762
• Speeded up mod_backup using concurrent requests by @hbenazha in https://github.com/wapiti-scanner/wapiti/pull/757
• Modernized Firefox user-agent by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/763
• perf(intercepting_explorer): optimized browser waits and clicks by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/764
• Added Python 3.14 support in TOML configuration by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/767
• Added SQLite PRAGMAs to improve I/O performance by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/766
• Fixed triple N+1 query issue in _get_paths() by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/765
• Allowed running both crawlers sequentially by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/768
• Grouped transactions in add_payload, save_request, and save_requests by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/769
• Fixed N+1 query issue in get_payloads() by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/749
• perf(persister): avoided unnecessary deep copies during serialization by @fwininger in https://github.com/wapiti-scanner/wapiti/pull/750
• Improved scanning of URLs with uppercase hostnames by @ArseneCBW in https://github.com/wapiti-scanner/wapiti/pull/743
• Fixed Tomcat image used in tests by @Qwarctick in https://github.com/wapiti-scanner/wapiti/pull/773
• Code review fixes — batch 2026-05 by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/777
• Fixed bugs based on May 2026 crash reports and updated documentation by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/778
• Updated changelog and copyright date by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/779
• Bumped version to 3.3.0 and updated manpages by @devl00p in https://github.com/wapiti-scanner/wapiti/pull/780

New Contributors

• @MathisFranel made their first contribution in https://github.com/wapiti-scanner/wapiti/pull/729
• @hbenazha made their first contribution in https://github.com/wapiti-scanner/wapiti/pull/757
• @ArseneCBW made their first contribution in https://github.com/wapiti-scanner/wapiti/pull/743

Full Changelog: [wapiti 3.2.10...3.3.0 comparison](https://github.com/wapiti-scanner/wapiti/compare/3.2.10...3.3.0?utm_source=chatgpt.com)