Integrate W3AF with Vulnetix via Docker. Use W3AF's extensible plugin architecture to detect SQL injection, XSS, CSRF, and 200+ other vulnerability classes. Export XML reports for ingestion.
Install & scan
$ # Recommended: Docker image (avoids Python 2.7 dependency issues) docker pull andresriancho/w3af # Note: W3AF requires Python 2.7 (EOL). Docker is the recommended approach. $ # Run via Docker with a profile file docker run --rm -v "$(pwd)/reports:/root/w3af-shared" andresriancho/w3af ./w3af_console -s /root/w3af-shared/scan.w3af # Create scan.w3af profile: # plugins output xml_file # output config xml_file # set output_file /root/w3af-shared/report.xml # back # target # set target https://example.com/ # back # start
Run W3AF in CI
Scan on every push and upload the report as a workflow artifact:
- name: Create W3AF profile
run: |
mkdir -p reports
cat > scan.w3af << 'EOF'
plugins output xml_file
output config xml_file
set output_file /root/w3af-shared/report.xml
back
target
set target ${{ secrets.TARGET_URL }}
back
start
EOF
- name: Run W3AF scan
run: |
docker run --rm -v "$(pwd)/reports:/root/w3af-shared" -v "$(pwd)/scan.w3af:/root/scan.w3af" andresriancho/w3af ./w3af_console -s /root/scan.w3af
- name: Upload report
run: vulnetix upload --file reports/report.xml
How Vulnetix compares: better together
Vulnetix does not replace W3AF. Keep running it. Vulnetix sits on top of W3AF (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
W3AF is strongest at its core category and also carries features in Pentest, Bug Bounty & Vulnerability Disclosure, just as Vulnetix spans categories.
| Capability | Vulnetix | W3AF |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✓ Core: Python web app attack-and-audit framework detecting 200+ vuln types via discovery/audit/output plugin phases. |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ~ Goes beyond scanning into exploitation and Metasploit-integrated payload execution for manual pen-test workflows. |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What W3AF does well
- Highly modular plugin architecture cleanly separating discovery (crawl), audit (attack) and output (reporting), making scans very configurable
- Broad coverage, 200+ web vulnerability detectors across injection, XSS, misconfiguration and disclosure classes
- Exploitation capabilities and Metasploit integration that bridge from scanning into hands-on penetration testing / payload execution
- REST API with OpenAPI-driven scanning and Docker deployment for automation, plus rich auth support (basic, NTLM, form, cookies, headers)
Where Vulnetix adds to it: Vulnetix ingests and orchestrates W3AF's dynamic findings, it does not run dynamic web scans or exploitation itself. W3AF outputs raw web vulns with no dependency, prioritisation or remediation context; Vulnetix layers cross-scanner dedup into one queue, EPSS/KEV/LEV exploit-intel prioritisation, reachability, versioned VEX and autofix on top so W3AF's results land in an actionable, tracked queue rather than a standalone report.
No migration, no rip-and-replace. W3AF keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise W3AF results in Vulnetix
Upload W3AF XML, HTML, CSV output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.