Wepawet

Wepawet: Web Vulnerability Analyzer

Detects potential vulnerabilities and malicious code in web pages, scans for common attacks like cross-site scripting and SQL injections

What is Wepawet?

Wepawet is an online automated web analysis service that detects and analyzes potential security vulnerabilities or malicious code in web pages. It was developed by researchers at the University of California, Santa Barbara to identify common web-based attacks.

When a web page URL is submitted to Wepawet, it visits the page and scans the code for signs of attacks like cross-site scripting (XSS), SQL injection vulnerabilities, or obfuscated JavaScript that may contain malware. It also detects redirects, iframes, and other potential vectors for attacks.

One of the key features of Wepawet is its specialized detection of drive-by download attacks. It analyzes sites for URLs or code that may automatically download malware without the user's consent when visiting a webpage. The service also checks for URL shortener links that attempt to hide malicious destinations.

Beyond scanning for threats, Wepawet also gives technical analysis on the inner workings of JavaScript code. It outlines potential vulnerabilities in detail and highlights relevant code snippets. The findings allow developers and security professionals to understand and remediate issues.

While not a complete web security solution, Wepawet provides a useful free service for assessing pages and applications for common threats. The data it provides can help identify weak points to improve security.

Wepawet Features

Official Links