Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Discovery

Find exposed API and debug surfaces

Enumerate a domain and confirm exposed OpenAPI specs, Spring Actuator endpoints, and debug paths from response content, not from a bare HTTP 200.

Run this workflow
AuthorTrickest
100%

Notes on this workflow

Results

findings.jsonl. One row per confirmed exposure, plus a summary.

Target

Put a domain on subfinder. The probe checks at most 80 hosts.

How it works

subfinder lists hosts. httpx probes them. openapi, actuator, and metrics request known paths. A hit requires the body to match.

Overview

A URL that returns HTTP 200 is not an API spec. Single-page apps answer 200 for almost every path. This workflow enumerates hosts, fetches known spec and actuator paths, and keeps a hit only when the body is actually that document. OpenAPI and Swagger must contain a paths object. Spring Actuator must contain the actuator link map or property sources. Heapdump and env paths are recorded as exposed debug surfaces, not downloaded as a trophy. Point it at a domain you are authorised to test, and file confirmed hits under exposure management.

Pipeline

  1. subfinder enumerates hosts for the domain you set.
  2. httpx probes those hosts.
  3. openapi, actuator, and metrics each request their own paths, on at most 80 hosts. A hit requires the body to match.
  4. report writes findings.jsonl, one row per confirmed exposure, plus a summary.

Inputs

  • Domain. Set on the subfinder node. Hosts come from that enumeration.

Outputs

  • findings.jsonl. One JSON line per content-confirmed exposure, plus a summary.

Integrations

  • Subfinder. Host enumeration.
  • httpx. HTTP probe of the enumerated hosts.

Sample output

The row below is from a completed run on brokencrystals.com on 2026-09-24. The run confirmed two OpenAPI specs. This is one of them.

urltypeseveritydetailscanned_at
https://qa.brokencrystals.com/swagger-jsonopenapi-specmedium63 paths2026-09-24T10:12:37Z

FAQ

Why not treat every HTTP 200 as a hit?

Single-page apps return 200 for unknown paths. A hit here requires the body to be an API spec or an actuator document.

Does this download a heap dump?

It records that a debug path answered with the expected content. It does not treat the body as a file to keep.

How many hosts are checked?

At most 80 hosts from the subfinder output.

Where should I run it?

On a domain you are authorised to test.

Run this workflow
Back to LibraryAll workflows

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demoExplore the platform