# andresriancho/w3af

w3af: web application attack and audit framework, the open source web vulnerability scanner.

Repository: https://github.com/andresriancho/w3af
Canonical: https://ross.abutalabs.com/products/w3af
Homepage: http://w3af.org/
Language: Python
License Family: other
Topics: scanner, security, appsec, cross-site-scripting, sql-injection
Last push: 2023-02-22T06:05:59+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 5481, "days_push": 1288, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4900, forks 1238 (observed 2026-08-28T04:09:02.095586+00:00)

## What it is
w3af is an open source web application attack and audit framework that scans web applications for over 200 vulnerability types, including XSS, SQL injection, and OS commanding. It is written in Python and used by developers and penetration testers to identify and exploit web vulnerabilities.

## Use cases
- scan a web application for sql injection
- find cross-site scripting vulnerabilities in my site
- audit web app security before a pentest
- automated web vulnerability assessment
- detect os commanding flaws in web apps

## When to choose
- you need a scriptable, plugin-based open source web vulnerability scanner
- you want to identify and exploit common web app flaws like XSS and SQLi
- you prefer a Python-based tool you can extend

## When to avoid
- you need actively maintained tooling with recent updates and support
- you want a modern GUI-driven DAST product
- you need API or microservices security testing rather than classic web app scanning

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: penetration-testing, vulnerability-scanning, security
- domain: security, penetration-testing, web-development
- platform: python, cli
- tags: web-application-scanner, appsec, xss, sql-injection, exploit-framework, linux, macos

## Member repositories
- andresriancho/w3af (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:02.095586+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:18:09.174082+00:00, confidence not recorded.
  - readme: https://github.com/andresriancho/w3af (fetched 2026-08-28T04:09:02.095586+00:00, sha 3640b251a329)
- Data as of 2026-08-30T08:39:29.467469+00:00.