Workflow library

Blackhat Collection

9 workflows

Black Hat USA Arsenal, runnable in Trickest — dangling DNS, CI/CD and browser extension surface, PQ crypto, Bedrock IAM, MCP trust boundaries, web AI agents, coding-agent policy, and HTTP/3 race evidence you can point at your own targets.

Enter the Collection

KEV Collection

21 workflows

Fingerprint, flag by version, then confirm with a sleep, public-file read, or unauthenticated GET.

Enter the Collection

114 items

Sort

CVE
Confluence access ctrl privesc (CVE-2023-22515)
Flag Atlassian Confluence hosts for CVE-2023-22515 by reading ajs-version-number on /login.action. Floors 8.3.3 / 8.4.3 / 8.5.2. No admin-create.
Sep 10, 2026
CVE
CVE-2026-82329 Artifactory auth bypass check
Find self-managed JFrog Artifactory below CVE-2026-82329 CNA floors. Version fingerprint, confirm path, no token mint. Cloud *.jfrog.io marked patched.
Sep 10, 2026
CVE
Grafana snapshot auth bypass (CVE-2021-39226)
Flag Grafana hosts for CVE-2021-39226 by reading version from GET /api/health. Floors 7.5.11 / 8.1.6. No snapshot GET, delete, or data disclosure.
Sep 10, 2026
CVE
Exchange ProxyNotShell SSRF (CVE-2022-41040)
Flag Microsoft Exchange hosts for CVE-2022-41040 by reading the OWA version path on GET /owa/auth/logon.aspx. 15.0/15.1/15.2 floors. No SSRF.
Sep 10, 2026
CVE
ManageEngine DC auth bypass (CVE-2021-44515)
Flag ManageEngine Desktop Central for CVE-2021-44515 by reading 10.1.x builds on GET /configurations.do. Floors 10.1.2127.18 / 10.1.2137.3.
Sep 10, 2026
CVE
Tomcat Ghostcat AJP (CVE-2020-1938)
Flag Apache Tomcat hosts for CVE-2020-1938 by reading Apache Tomcat/x.y.z from a GET 404 probe. Floors 7.0.100 / 8.5.51 / 9.0.31. No AJP.
Sep 10, 2026
CVE
vCenter file upload RCE (CVE-2021-22005)
Flag VMware vCenter hosts for CVE-2021-22005 by reading version and build from GET /sdk. 6.5 N/A; 6.7 build 18485166; 7.0.2 build 18356314.
Sep 10, 2026
CVE
Metabase GeoJSON LFI (CVE-2021-41277)
Flag Metabase hosts for CVE-2021-41277 by reading version.tag from /api/session/properties. Only x.40.0-x.40.4. No GeoJSON fetch.
Sep 10, 2026
CVE
Jenkins Stapler RCE (CVE-2018-1000861)
Flag Jenkins hosts for CVE-2018-1000861 by reading the X-Jenkins header on GET /login. Floors 2.154 / LTS 2.138.4 / 2.150.1. No Stapler invoke.
Sep 10, 2026
CVE
Jenkins Fingerprints disclosure (CVE-2015-5317)
Flag Jenkins hosts for CVE-2015-5317 by reading the version from the default response. Floors 1.638 / 1.625.2. No Fingerprints browse.
Sep 10, 2026
CVE
SharePoint XML RCE (CVE-2019-0604)
Flag SharePoint hosts for CVE-2019-0604 by reading MicrosoftSharePointTeamServices on GET /. Floor is 16.0.10340.12101. No XML deserialize POST.
Sep 10, 2026
CVE
OMI OMIGOD privilege esc (CVE-2021-38648)
Flag Microsoft OMI hosts for CVE-2021-38648 by reading ProductVersion from GET /wsman. Floor 1.6.8-1. No SOAP Identify POST and no PrivEsc.
Sep 10, 2026
CVE
Jenkins CLI arbitrary file read CVE-2024-23897 (CISA KEV)
CVE-2024-23897 Jenkins CLI @-file / arbitrary file read (CISA KEV). Workflow flags by version and checks that /cli answers — does not expand @-files.
Sep 10, 2026
CVE
Exchange ProxyNotShell RCE (CVE-2022-41082)
Flag Microsoft Exchange hosts for CVE-2022-41082 by reading the OWA version path on GET /owa/auth/logon.aspx. Fixed only at 15.2.1118.21. No RCE.
Sep 10, 2026
CVE
Pulse Secure File Read (CVE-2019-11510)
Flag Pulse Connect Secure hosts for CVE-2019-11510 by reading version from GET /dana-na/nc/nc_gina_ver.txt. Floors 8.2R12.1 / 8.3R7.1 / 9.0R3.4.
Sep 10, 2026
CVE
CVE-2026-65643 cPanel & WHM Park API root RCE
CVE-2026-65643 cPanel/WHM domain-parking flaw: authenticated file write → root code execution. Workflow reads cpsrvd build vs branch fix (read-only; no exploit).
Sep 10, 2026
CVE
VMware vCenter plugin SSRF (CVE-2021-21973)
Flag VMware vCenter hosts for CVE-2021-21973 by reading version and build from GET /sdk. Floor is 7.0 U1c build 17327517. No SSRF.
Sep 10, 2026
CVE
Tomcat JMX RCE (CVE-2016-8735)
Flag Apache Tomcat hosts for CVE-2016-8735 by reading Apache Tomcat/x.y.z from GET /nonexistent-404-probe. Floors 6.0.48-9.0.0. No JMX/RMI.
Sep 10, 2026
CVE
Confluence SSTI RCE (CVE-2019-3396)
Flag Atlassian Confluence hosts for CVE-2019-3396 by reading ajs-version-number on /login.action. Floors 6.6.12 / 6.12.3 / 6.13.3 / 6.14.2. No SSTI.
Sep 10, 2026
CVE
ZK AuUploader info disclosure (CVE-2022-36537)
Flag ZK Framework hosts for CVE-2022-36537 by reading the version from the default response. Floors 8.6.4.2-9.6.2. No file read.
Sep 10, 2026
CVE
Pulse Secure Cmd Inject (CVE-2019-11539)
Flag Pulse Connect Secure for CVE-2019-11539 via GET /dana-na/nc/nc_gina_ver.txt. Floors 8.1.15.59747 / 8.2.12.64003 / 8.3.7.65025 / 9.0.3.64053. No cmd inject.
Sep 10, 2026
CVE
SonicWall File Upload (CVE-2021-20022)
Flag SonicWall Email Security hosts for CVE-2021-20022 by reading the version on GET /login.html. Floor band to 10.0.9.6177. No file upload.
Sep 10, 2026
CVE
Roundcube file disclosure (CVE-2017-16651)
Flag Roundcube Webmail hosts for CVE-2017-16651 by reading the version from the default response. Floors 1.1.10-1.3.3. No login.
Sep 10, 2026
CVE
OMI OMIGOD unauth RCE (CVE-2021-38647)
Flag Microsoft OMI hosts for CVE-2021-38647 by reading ProductVersion from GET /wsman. Floor 1.6.8-1. No SOAP Identify POST and no RCE.
Sep 10, 2026
CVE
Roundcube plaintext link XSS (CVE-2020-35730)
Flag Roundcube Webmail hosts for CVE-2020-35730 by reading the version at GET /?_task=login. Floors 1.2.13-1.4.10. No XSS payload.
Sep 10, 2026
CVE
Confluence pre-auth file read (CVE-2021-26085)
Flag Atlassian Confluence hosts for CVE-2021-26085 by reading ajs-version-number on /login.action. Floor is 7.12.3. No /s/ file read.
Sep 10, 2026
CVE
Jira SSTI (CVE-2019-11581)
Flag Atlassian Jira hosts for CVE-2019-11581 by reading version on GET /login.jsp. Floors 7.6.14 / 7.13.5 / 8.0.3 / 8.1.2 / 8.2.3. No SSTI.
Sep 10, 2026
CVE
Pulse Secure Code Inject (CVE-2020-8218)
Flag Pulse Connect Secure hosts for CVE-2020-8218 by reading version from GET /dana-na/nc/nc_gina_ver.txt. FIXED floor 9.1R8 / 9.1.8. No admin code inject.
Sep 10, 2026
CVE
Jenkins CLI Deser RCE (CVE-2017-1000353)
Flag Jenkins hosts for CVE-2017-1000353 by reading the X-Jenkins header on GET /. Floors 2.57 / LTS 2.46.2. No CLI remoting payload.
Sep 10, 2026
CVE
Roundcube SQLi (CVE-2021-44026)
Flag Roundcube Webmail hosts for CVE-2021-44026 by reading the version on /?_task=login. Floors 1.3.17 and 1.4.12. No SQLi payload.
Sep 10, 2026
CVE
SharePoint code-injection RCE (CVE-2023-24955)
Flag SharePoint hosts for CVE-2023-24955 by reading MicrosoftSharePointTeamServices on /_layouts/15/start.aspx. Unauth May 2023 floors only.
Sep 10, 2026
CVE
Exchange deserialization RCE (CVE-2023-21529)
Flag Microsoft Exchange hosts for CVE-2023-21529 by reading the OWA version path on GET /owa/auth/logon.aspx. 15.0/15.1/15.2 floors. No deser RCE.
Sep 10, 2026
CVE
Confluence OGNL RCE (CVE-2021-26084)
Flag Atlassian Confluence hosts for CVE-2021-26084 by reading ajs-version-number on /login.action. Per-branch floors only. No OGNL.
Sep 10, 2026
CVE
Roundcube XML attachment XSS (CVE-2020-13965)
Flag Roundcube Webmail hosts for CVE-2020-13965 by reading the version at GET /?_task=login. Floors 1.3.12 / 1.4.5. No XSS payload.
Sep 10, 2026
CVE
Grafana path traversal CVE-2021-43798 (plugin file read)
CVE-2021-43798 Grafana directory traversal / local file read via /public/plugins. Workflow flags in-range hosts and confirms with a public plugin-file read. CISA KEV.
Sep 10, 2026
CVE
Exchange privilege escalation (CVE-2022-41080)
Flag Microsoft Exchange hosts for CVE-2022-41080 by reading the OWA version path on GET /owa/auth/logon.aspx. 15.0/15.1/15.2 floors. No PrivEsc.
Sep 10, 2026
CVE
vCenter plugin RCE (CVE-2021-21972)
Flag VMware vCenter hosts for CVE-2021-21972 by reading version and build from GET /sdk. Floors 6.5 U3n / 6.7 U3l / 7.0 U1c. No plugin upload.
Sep 10, 2026
CVE
Roundcube ImageMagick RCE (CVE-2020-12641)
Flag Roundcube Webmail hosts for CVE-2020-12641 by reading the version from GET /CHANGELOG. Floor 1.4.4. No ImageMagick write and no RCE.
Sep 10, 2026
CVE
NetScaler SD-WAN RCE (CVE-2017-6316)
Flag Citrix NetScaler SD-WAN hosts for CVE-2017-6316 by parsing /rN-N-N-N-N/ from GET /. FIXED floor 9.1.2.26.561202. No cookie cmd inject.
Sep 10, 2026
CVE
Confluence OGNL RCE (CVE-2022-26134)
Flag Atlassian Confluence hosts for CVE-2022-26134 by reading ajs-version-number on /login.action. Per-branch floors only. No OGNL.
Sep 10, 2026
CVE
Laravel Ignition RCE (CVE-2021-3129)
Flag Laravel apps for CVE-2021-3129 by reading laravel_version from a GET debug-surface probe. Floor 8.4.2. Needs debug markers. No file-write RCE.
Sep 10, 2026
CVE
vCenter vSAN Health RCE (CVE-2021-21985)
Flag VMware vCenter hosts for CVE-2021-21985 by reading version and build from GET /sdk. Fixed only at 7.0 U2b build 17958471. No vSAN RCE.
Sep 10, 2026
CVE
Confluence path traversal (CVE-2019-3398)
Flag Atlassian Confluence hosts for CVE-2019-3398 by reading ajs-version-number on /login.action. Floors 6.6.13 through 6.15.2. No traversal.
Sep 10, 2026
CVE
Tomcat PUT JSP RCE (CVE-2017-12617)
Flag Apache Tomcat hosts for CVE-2017-12617 by reading Apache Tomcat/x.y.z from GET /nonexistent-4041c2b7f. Floors 7.0.82 / 8.0.47 / 8.5.23 / 9.0.1. No PUT.
Sep 10, 2026
CVE
SMA1000 SSRF Check (CVE-2026-83548)
Point hosts at SonicWall SMA 1000 and flag CVE-2026-83548 by hotfix, then confirm with a GET of /wsproxy. No destination URL.
Sep 3, 2026
CVE
FortiOS Info Disclosure (CVE-2025-68686)
Point hosts at FortiOS and flag CVE-2025-68686 (info disclosure) by version, then confirm with a public /remote/fcnfg GET. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
SharePoint ToolShell (CVE-2025-53770)
Point hosts at SharePoint and flag CVE-2025-53770 by version, then confirm with a ToolPane GET and a SignOut referer. No ViewState gadget. CISA KEV.
Sep 3, 2026
CVE
Metabase SQLi (CVE-2026-72898)
Point hosts at Metabase and flag CVE-2026-72898 (SQL injection) by version, then confirm with a sleep-only probe. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
Roundcube RCE (CVE-2025-49113)
Point hosts at Roundcube and flag CVE-2025-49113 by version. No confirm: the _from gadget needs a login and deserializes PHP. Version flag only. CISA KEV.
Sep 3, 2026
CVE
Openfire Path Traversal (CVE-2023-32315)
Point hosts at Openfire and flag CVE-2023-32315 (path traversal) by version, then confirm by opening a restricted page. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
Langflow RCE (CVE-2026-33017)
Point hosts at Langflow and flag CVE-2026-33017 (code injection) from a version compare, then sleep on the unauthenticated build path. Non-destructive.
Sep 3, 2026
CVE
SmarterMail Auth Bypass (CVE-2026-23760)
Point hosts at SmarterMail and flag CVE-2026-23760 (auth bypass) by version, then confirm via the password-reset API. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
LiteLLM SQLi (CVE-2026-42208)
Point hosts at LiteLLM and flag CVE-2026-42208 (SQL injection) by version, then confirm with a sleep-only probe. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
PAN-OS GlobalProtect (CVE-2024-3400)
Point hosts at PAN-OS and flag CVE-2024-3400 by version. No confirm: the public probe creates a file on the portal. Version flag only. CISA KEV.
Sep 3, 2026
CVE
TeamCity Auth Bypass (CVE-2024-27198)
Point hosts at TeamCity and flag CVE-2024-27198 by version, then confirm with a GET of /app/rest/server through the ?jsp= bypass. No token write. CISA KEV.
Sep 3, 2026
CVE
PHP CGI RCE (CVE-2024-4577)
Point hosts at PHP and flag CVE-2024-4577 by version. No confirm: a Best-Fit probe would execute PHP. Version and banner only. CISA KEV.
Sep 3, 2026
CVE
MOVEit Transfer SQLi (CVE-2023-34362)
Point hosts at Progress MOVEit Transfer and flag CVE-2023-34362 (SQL injection) from a version compare, then a sleep-only confirm. Non-destructive.
Sep 3, 2026
CVE
Confluence Authz (CVE-2023-22518)
Point hosts at Confluence and flag CVE-2023-22518 by version, then confirm with an unauthenticated GET of /json/setup-restore.action. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
PAN-OS GP Auth Bypass (CVE-2026-0257)
Point hosts at PAN-OS GlobalProtect and flag CVE-2026-0257 (auth bypass) by version, then confirm with an unauthenticated GET. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
ScreenConnect Path Traversal (CVE-2024-1708)
Point hosts at ConnectWise ScreenConnect and flag CVE-2024-1708 (path traversal) from a version compare, then a public-file confirm. Non-destructive.
Sep 3, 2026
CVE
Superset Default Key (CVE-2023-27524)
Point hosts at Superset and flag CVE-2023-27524 by version, then confirm with a local HMAC of the issued session cookie. It never forges a cookie. CISA KEV.
Sep 3, 2026
CVE
UniFi OS Path Traversal (CVE-2026-34909)
Point hosts at Ubiquiti UniFi OS and flag CVE-2026-34909 (path traversal) from a version compare, then confirm by reading a public file. Non-destructive.
Sep 3, 2026
CVE
Ivanti Auth Bypass (CVE-2023-46805)
Point hosts at Ivanti Connect Secure and flag CVE-2023-46805 by version, then confirm with an unauthenticated GET of system-information. CISA KEV.
Sep 3, 2026
CVE
Jira Path Traversal (CVE-2021-26086)
Point hosts at Jira Server/DC and flag CVE-2021-26086 (path traversal) by version, then confirm with a public web.xml read. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
LoadMaster RCE (CVE-2026-8037)
Point hosts at Progress LoadMaster and flag CVE-2026-8037 (command injection) from a version compare, then echo a short token on /accessv2. Non-destructive.
Sep 3, 2026
CVE
N-central Auth Bypass (CVE-2026-18577)
Point hosts at N-central and flag CVE-2026-18577 (auth bypass) by version, then confirm on a DWR path without credentials. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
Quantum Gateway Leak (CVE-2024-24919)
Point hosts at Check Point Quantum and flag CVE-2024-24919 (info disclosure) by version, then confirm with a public MyCRL GET. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
Confluence OGNL RCE (CVE-2023-22527)
Point hosts at Confluence and flag CVE-2023-22527 by version, then confirm with a GET of /template/aui/text-inline.vm. No OGNL. CISA KEV.
Sep 3, 2026
CVE
Citrix NetScaler RCE (CVE-2026-8452)
CVE-2026-8452 is a heap overflow in Citrix NetScaler ADC and Gateway. Version flag only. No confirm: a probe would crash the box or be RCE.
Sep 3, 2026
CVE
FortiAnalyzer Auth Bypass (CVE-2026-24858)
Point hosts at FortiAnalyzer and flag CVE-2026-24858 (auth bypass) by version, then confirm on a protected REST path. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
NetWeaver Path Traversal (CVE-2017-12637)
Point hosts at SAP NetWeaver and flag CVE-2017-12637 (path traversal) from a version compare, then confirm with a public static file read. Non-destructive.
Sep 3, 2026
CVE
Tomcat Partial PUT (CVE-2025-24813)
Point hosts at Tomcat and flag CVE-2025-24813 by version, then confirm with OPTIONS if PUT is advertised. No file write. CISA KEV.
Sep 3, 2026
CVE
vCenter Info Disclosure (CVE-2022-22948)
Point hosts at vCenter and flag CVE-2022-22948 (info disclosure) by version, then confirm with a public metadata GET. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
TeamCity Auth Bypass (CVE-2024-27199)
Point hosts at TeamCity and flag CVE-2024-27199 (auth bypass) by version, then confirm by opening the REST path unauthenticated. Non-destructive. CISA KEV.
Sep 3, 2026
CVE
BeyondTrust RS RCE (CVE-2026-1731)
Point hosts at BeyondTrust Remote Support and PRA and flag CVE-2026-1731 (OS command injection) from a version compare plus sleep-only confirm. Non-destructive.
Sep 3, 2026
Discovery
Find Origin IPs Behind Cloudflare
Find the origin server behind Cloudflare or another WAF by resolving subdomains, filtering CDN ranges, and confirming which IP serves the site.
Sep 3, 2026
CVE
Ivanti Command Injection (CVE-2024-21887)
Point hosts at Ivanti Connect Secure and flag CVE-2024-21887 by version. Confirm is the 46805 bypass GET only. No command injection. CISA KEV.
Sep 3, 2026
CVE
NetScaler SAML Auth Bypass (CVE-2026-19490)
CVE-2026-19490 is an unauthenticated SAML authentication bypass in Citrix NetScaler ADC and Gateway. Version flag plus a non-intrusive safe-oracle confirm.
Sep 3, 2026
CVE
TeamCity Token RCE (CVE-2023-42793)
Point hosts at TeamCity and flag CVE-2023-42793 by version, then confirm with a GET of /app/rest/users/id:1/tokens/RPC2. No token write. CISA KEV.
Sep 3, 2026
CVE
Next.js Security Scanner
Fingerprint Next.js hosts and run CVE-2026-75604, GHSA-2xp9-vwfh-vxw4, CVE-2025-29927, and CVE-2025-55182 as separate checks.
Sep 3, 2026
CVE
BIG-IP iControl SQLi (CVE-2023-46748)
Point hosts at F5 BIG-IP Configuration Utility and flag CVE-2023-46748 (SQL injection) from a version compare plus time-based sleep confirm. Non-destructive.
Sep 3, 2026
CVE
PaperCut NG/MF RCE (CVE-2026-81578)
Point hosts at PaperCut NG/MF and flag CVE-2026-81578 by build, then confirm with a read-only admin-page GET. No config write. CISA KEV.
Sep 2, 2026
Discovery
SPA Endpoint & Parameter Map
Map the route, API and parameter attack surface of a modern JS app (Next, Nuxt, React) from its JS bundles. No browser, no auth.
Aug 21, 2026
Vulnerability scanning
Web AI Agent Audit
Probe embedded web chat agents for injection, prompt leak, jailbreak, and role confusion with WebAgentAudit.
Aug 21, 2026
Cloud
AWS Bedrock Phantom IAM
Scan Bedrock phantom IAM, decode leaked ABSK keys offline, emit SCP and detection packs, and a dry-run cleanup plan.
Aug 21, 2026
Secrets
Scan GitHub for Leaked Secrets
Enumerate an organization's public GitHub repos and scan full commit history with TruffleHog for leaked keys and credentials.
Aug 21, 2026
Discovery
Typosquat & Look-alike Domain Scanner
Generate typo, homoglyph, TLD-swap and combosquat variants of a brand domain, probe every candidate, and score the live ones for phishing readiness.
Aug 21, 2026
CI/CD
CICD Attack Surface Scanner
Seed GitHub Actions YAML into Trajan and a coding-agent CI scan, then correlate inventory, findings, and a retest delta.
Aug 21, 2026
Discovery
PQ Crypto Surface Scanner
Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.
Aug 21, 2026
Vulnerability scanning
HTTP/3 Race Fuzzer
Compare QuicDraw baseline GET vs concurrent HTTP/3 race traffic, then correlate race evidence you can retest.
Aug 21, 2026
Vulnerability scanning
MCP Trust Boundary Suite
Inventory HoneyMCP ghost tools and MCParasite channels, then correlate MCP trust-boundary findings you can retest.
Aug 21, 2026
Discovery
Sitemap URL & Metadata Extractor
Read a site's sitemap, fetch every page it lists, and inventory each URL's title, description, page type and metadata gaps in one table.
Aug 21, 2026
Vulnerability scanning
Coding Agent Policy Gate
Decide allow, alert, or block on coding-agent file, shell, and network actions with AgentsLeak rules and a GolemHalt Cedar/YARA corpus.
Aug 21, 2026
Vulnerability scanning
OpenAPI IDOR & BOLA Scanner
Read a target's OpenAPI spec, enumerate every GET that takes an object id, and probe each with altered ids and stripped auth.
Aug 21, 2026
Vulnerability scanning
Browser Extension Threat Scanner
Seed a Chrome MV3 zip into ThreatXtension, then correlate permission and threat findings you can retest.
Aug 21, 2026
CVE
WordPress Pre-Auth RCE (CVE-2026-63030)
Check a list of WordPress hosts for the wp2shell pre-auth RCE chain, CVE-2026-63030, by confirming the batch route-confusion SQLi on each one.
Aug 21, 2026
Discovery
Full Network Port & Service Assessment
Point one domain, ASN or CIDR at it and get a graded report of every open port and exposed service, distributed and token-free.
Aug 21, 2026
Discovery
Find Secrets in Wayback Responses
Pull a domain's archived URLs from web archives, fetch the stored response bodies, and scan them for leaked secrets without touching the live site.
Aug 21, 2026
Discovery
Multi-Cloud Dangling DNS
Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.
Aug 21, 2026
Discovery
Cloud Bucket Finder (S3, GCS, Azure)
Permute a keyword into candidate bucket names and check each anonymously across Amazon S3, Google Cloud, Azure Blob and DigitalOcean.
Aug 12, 2026
Discovery
Passive Port & CVE Scan (Shodan)
Read a target's open ports, product versions and matching CVEs out of Shodan's own data, so nothing you run reaches the target.
Aug 10, 2026
Vulnerability scanning
Find SSRF in HTTP Parameters
Crawl a target and mine its archived URLs, then test every parameter that takes a URL for server-side request forgery using out-of-band detection.
Aug 3, 2026
Vulnerability scanning
Find Reflected XSS on a Domain
Collect a domain's archived URLs, keep parameters that reflect input, and fuzz each one for reflected and DOM cross-site scripting.
Aug 3, 2026
Discovery
Attack Surface Discovery by Company Name
Start from a company's registered name and find the domains it has certified, the networks those resolve into, and the hosts that answer.
Aug 3, 2026
Discovery
Domain OSINT & Footprinting
Profile a domain without sending it a packet: subdomains, DNS, WHOIS and certificate history, plus which hosts are live and what they run.
Aug 3, 2026
Discovery
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
Aug 3, 2026
Discovery
Directory & Content Discovery
Confirm which hosts are live, then brute-force paths against each one from a wordlist fetched at run time, and report what answered.
Aug 3, 2026
Vulnerability scanning
Scan WordPress for Known CVEs
Fingerprint a WordPress site's core, plugins and themes while scanning for known CVEs next to the component and version they hit.
Aug 3, 2026
Discovery
Check Email Spoofing (DMARC SPF DKIM)
Check whether an attacker can send mail as your domain by querying SPF, DKIM, DMARC, MTA-STS and BIMI across every subdomain.
Aug 3, 2026
Vulnerability scanning
Find Open Redirects on a Domain
Mine a domain's archived URLs for redirect parameters, then confirm which ones send a browser to an attacker-controlled host.
Aug 3, 2026
Vulnerability scanning
ASN-Wide Vulnerability Scan
Turn an ASN into its live hosts, then scan the raw ports and the web surface for CVEs, misconfigurations, and exposures. Findings land in one report.
Jul 31, 2026
Discovery
Website Screenshot & Visual Recon
Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.
Jul 31, 2026
Vulnerability scanning
Find Exposed Databases
Port-scan a range for eight database engines and check every open service for unauthenticated access, from MongoDB and Redis to PostgreSQL.
Jul 31, 2026
Vulnerability scanning
Find Subdomain Takeovers
Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.
Jul 31, 2026

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demo Explore the platform

Blackhat Collection

KEV Collection

Confluence access ctrl privesc (CVE-2023-22515)

CVE-2026-82329 Artifactory auth bypass check

Grafana snapshot auth bypass (CVE-2021-39226)

Exchange ProxyNotShell SSRF (CVE-2022-41040)

ManageEngine DC auth bypass (CVE-2021-44515)

Tomcat Ghostcat AJP (CVE-2020-1938)

vCenter file upload RCE (CVE-2021-22005)

Metabase GeoJSON LFI (CVE-2021-41277)

Jenkins Stapler RCE (CVE-2018-1000861)

Jenkins Fingerprints disclosure (CVE-2015-5317)

SharePoint XML RCE (CVE-2019-0604)

OMI OMIGOD privilege esc (CVE-2021-38648)

Jenkins CLI arbitrary file read CVE-2024-23897 (CISA KEV)

Exchange ProxyNotShell RCE (CVE-2022-41082)

Pulse Secure File Read (CVE-2019-11510)

CVE-2026-65643 cPanel & WHM Park API root RCE

VMware vCenter plugin SSRF (CVE-2021-21973)

Tomcat JMX RCE (CVE-2016-8735)

Confluence SSTI RCE (CVE-2019-3396)

ZK AuUploader info disclosure (CVE-2022-36537)

Pulse Secure Cmd Inject (CVE-2019-11539)

SonicWall File Upload (CVE-2021-20022)

Roundcube file disclosure (CVE-2017-16651)

OMI OMIGOD unauth RCE (CVE-2021-38647)

Roundcube plaintext link XSS (CVE-2020-35730)

Confluence pre-auth file read (CVE-2021-26085)

Jira SSTI (CVE-2019-11581)

Pulse Secure Code Inject (CVE-2020-8218)

Jenkins CLI Deser RCE (CVE-2017-1000353)

Roundcube SQLi (CVE-2021-44026)

SharePoint code-injection RCE (CVE-2023-24955)

Exchange deserialization RCE (CVE-2023-21529)

Confluence OGNL RCE (CVE-2021-26084)

Roundcube XML attachment XSS (CVE-2020-13965)

Grafana path traversal CVE-2021-43798 (plugin file read)

Exchange privilege escalation (CVE-2022-41080)

vCenter plugin RCE (CVE-2021-21972)

Roundcube ImageMagick RCE (CVE-2020-12641)

NetScaler SD-WAN RCE (CVE-2017-6316)

Confluence OGNL RCE (CVE-2022-26134)

Laravel Ignition RCE (CVE-2021-3129)

vCenter vSAN Health RCE (CVE-2021-21985)

Confluence path traversal (CVE-2019-3398)

Tomcat PUT JSP RCE (CVE-2017-12617)

SMA1000 SSRF Check (CVE-2026-83548)

FortiOS Info Disclosure (CVE-2025-68686)

SharePoint ToolShell (CVE-2025-53770)

Metabase SQLi (CVE-2026-72898)

Roundcube RCE (CVE-2025-49113)

Openfire Path Traversal (CVE-2023-32315)

Langflow RCE (CVE-2026-33017)

SmarterMail Auth Bypass (CVE-2026-23760)

LiteLLM SQLi (CVE-2026-42208)

PAN-OS GlobalProtect (CVE-2024-3400)

TeamCity Auth Bypass (CVE-2024-27198)

PHP CGI RCE (CVE-2024-4577)

MOVEit Transfer SQLi (CVE-2023-34362)

Confluence Authz (CVE-2023-22518)

PAN-OS GP Auth Bypass (CVE-2026-0257)

ScreenConnect Path Traversal (CVE-2024-1708)

Superset Default Key (CVE-2023-27524)

UniFi OS Path Traversal (CVE-2026-34909)

Ivanti Auth Bypass (CVE-2023-46805)

Jira Path Traversal (CVE-2021-26086)

LoadMaster RCE (CVE-2026-8037)

N-central Auth Bypass (CVE-2026-18577)

Quantum Gateway Leak (CVE-2024-24919)

Confluence OGNL RCE (CVE-2023-22527)

Citrix NetScaler RCE (CVE-2026-8452)

FortiAnalyzer Auth Bypass (CVE-2026-24858)

NetWeaver Path Traversal (CVE-2017-12637)

Tomcat Partial PUT (CVE-2025-24813)

vCenter Info Disclosure (CVE-2022-22948)

TeamCity Auth Bypass (CVE-2024-27199)

BeyondTrust RS RCE (CVE-2026-1731)

Find Origin IPs Behind Cloudflare

Ivanti Command Injection (CVE-2024-21887)

NetScaler SAML Auth Bypass (CVE-2026-19490)