Discovery
404checker
Headless check for URLs that return 200 but render not-found.
Tools
Every tool you can run in a Trickest workflow, 419 in total. Each page covers what the tool does, its real inputs and outputs, the skills it belongs to, and a runnable example.
A tool is one step. A workflow is a graph of them: the output of one node becomes the input of the next, and every node keeps its results for you to read after the run. Start from a tool when you know the command you want. Start from a workflow when you know the answer you want.
- Scanners
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
- Static Code Analysis
actionlint-check
actionlint-check is a static GitHub Actions workflow checking node powered by actionlint.
- Utilities
adr-graph
Generate a DOT relationship graph from numbered Markdown architecture decision records.
- Vulnerabilities
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
- Recon
aiodnsbrute
Async DNS brute force for subdomains that passive sources miss.
- Scanners
airixss
Reflection triage for parameter URLs during recon.
- Utilities
airtable-integration
Map workflow files to Airtable imports or export table rows, with an offline planning mode.
- Utilities
ajv-validate
ajv-validate is a strict JSON Schema draft-7 validation node powered by Ajv CLI.
- Scanners
alterx
Pattern-based subdomain wordlist generator from known names.
- Recon
amass
Multi-source subdomain discovery; hand names to httpx.
- Recon
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
- Recon
amass-json
OWASP Amass enumeration that emits structured JSON.
- Recon
analyticsrelationships
Find related domains via shared Google Analytics IDs.
- Utilities
androguard-manifest
Decode the binary AndroidManifest.xml in one APK into readable XML. Inspect declarations such as the package identifier and permissions without installing or running the application.
- Discovery
anew
Append lines to a file only if they are not already there.
- Utilities
apkeditor-info
Supply an owned APK to inspect package metadata through APKEditor info. This selected operation does not rebuild, merge or execute an app.
- Utilities
apkid-identify
Inspect an owned APK for known compiler, packer and obfuscator signatures. APKiD identifies matching patterns; its results are not a vulnerability scan, malware verdict or guarantee that an app is safe.
- Utilities
apksigner-verify
Check APK signature integrity and save native signer-certificate fingerprints.
- Utilities
apktool-decode
Decode Android APK files into smali sources and resources.
- Discovery
apkurlgrep
Extract URLs and endpoints from Android APK files.
- Discovery
aquatone
Visual inspection of websites across many hosts.
- Network
asnmap
Map an organization's network ranges from ASN data.
- Utilities
assert-tool
Check a file's values against conditions and exit with a matching code.
- Recon
assetfinder
Find domains and subdomains potentially related to a given domain.
- Utilities
aws-route53-zones
Authenticated Route53 hosted-zone inventory.
- Discovery
aws-s3-data-finder
List and flag sensitive keys across many S3 buckets.
- Utilities
baksmali-disassemble
Supply a raw DEX file to obtain a native smali class tree. The adapter selects API level 28 and one native worker; it does not execute the code.
- Static Code Analysis
bandit
Python source in, JSON security findings out.
- Network
bass
Merge the target's DNS servers with public resolvers into one pool.
- Utilities
batch-output
Extract file or folder lines by START_LINE,END_LINE batch range.
- Utilities
batch-output-v2
Extract a START,END batch from file lines or folder files.
- Recon
bbot
Modular OSINT recon that chains modules from a seed target.
- Scanners
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
- Utilities
bedtools-intervals
Supply local interval files and choose intersect, intersect-unique, subtract, merge or sort. Receive the native text for that operation.
- Recon
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
- Discovery
bfac
Checks live URLs for backup files and exposed version-control paths.
- Utilities
bibtex-format
Clean, normalize and deduplicate a BibTeX file with K-Dense's citation-management formatter (canonical field order and alignment, page-range fixes, DOI duplicate removal, optional sort and citation-key rewrite). Offline.
- Utilities
bicep-build
Compile one self-contained local Bicep source file into an ARM JSON template. Module restoration is disabled; no deployment or Azure credentials are used.
- Recon
bigip-scanner
Fingerprint the software version of a remote F5 BIG-IP management interface.
- Utilities
black-format
Read one Python source file and return a separate file formatted by Black with stable default style and an AST safety check.
- Scanners
bomber
Scan software bills of materials for known-vulnerable dependencies.
- Scanners
broken-link-checker
Find broken links, missing images, and other dead HTML references.
- Utilities
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
- Utilities
bundletool-dump-manifest
Turn a supplied AAB base manifest into a readable native XML file.
- Utilities
bundletool-validate
Check a local AAB with bundletool before a separate packaging step. This job returns the native validation summary; it does not generate APK sets, sign an app or contact Google Play.
- Vulnerabilities
bypass-403
A focused Go script that probes 403 Forbidden responses for known bypasses.
- Discovery
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
- Discovery
carlospolop-hakoriginfinder
Discover the origin host behind a reverse proxy, useful when a cloud WAF hides the backend.
- Recon
ccpy
Extract URLs for a specific target from commoncrawl.org indexes.
- Recon
cdncheck
Detect CDN, WAF, and cloud technology for a given IP or hostname.
- Utilities
cent
Organize community Nuclei templates from across the ecosystem in one place.
- Recon
cero
Scrape domain names from SSL certificates of arbitrary hosts.
- Recon
certsh-subdomains
Pull a domain's subdomains from the crt.sh certificate transparency database.
- Utilities
cewl
Spider a URL and return a wordlist for password crackers.
- Recon
chaos-client
Go client for ProjectDiscovery Chaos DB subdomain lookups.
- Scanners
chopchop
Signature scanner for exposed files, folders, and services on web roots.
- Recon
chronos
Module-driven extractor for Wayback Machine page history.
- Utilities
clean-wordlist
Regex-clean a wordlist before the slow stage reads it.
- Recon
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
- Recon
cloudlist
List assets from multiple cloud providers in one inventory.
- Discovery
cloudscraper
Spider pages and scrape linked cloud resource strings.
- Scanners
cmseek
CMS detection and version fingerprinting.
- Vulnerabilities
commix
Automates OS command injection detection and exploitation.
- Utilities
compose-config
Supply one UTF-8 Compose YAML or JSON file with image-based services.
- Vulnerabilities
cookiemonster
Crack weak signing secrets on stateless session cookies.
- Vulnerabilities
corstest
Find Cross-Origin Resource Sharing misconfigurations on a URL list.
- Discovery
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
- Fuzzing
crithit
Directory and file brute forcing across many hosts.
- Vulnerabilities
crlfmap
Find HTTP response splitting in parameterized URLs.
- Misconfiguration
crlfuzz
Go-based CRLF injection scanner for URLs and URL lists.
- Recon
crosslinked
Passive LinkedIn employee enumeration through search engine results.
- Recon
csprecon
Discover related domains from Content-Security-Policy headers.
- Utilities
csvkit
SQL on one CSV. The table name is the file stem.
- Vulnerabilities
cve-2018-15473
Username enumeration against OpenSSH via CVE-2018-15473.
- Vulnerabilities
cve-2023-3519-inspector
Version-based detection of Citrix builds exposed to CVE-2023-3519.
- Utilities
d8-compile-dex
Compile supplied Java class files into one binary DEX artifact.
- Vulnerabilities
dalfox
Parameter mining and XSS testing with headless verification.
- Static Code Analysis
dawnscanner
Static review of Ruby source for security issues, CVEs, and OWASP risks.
- Network
decant
Expand one CIDR into one IP per line.
- Network
decant-file
Expand many CIDR ranges from one file.
- Utilities
dex2jar-convert
Supply a raw DEX file to convert its bytecode into JVM classes in a JAR. No APK is installed or executed.
- Utilities
diff-trickest-files
Diff this run against a Trickest storage baseline.
- Utilities
diffuse-apk-diff
Compare an earlier and later APK to inspect changes in package size, resources and DEX contents. This is static artifact comparison; neither app is installed or executed.
- Discovery
dirsearch
Web path scanner.
- Recon
dmut
Permute known subdomains, then resolve what lives.
- OSINT
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
- OSINT
dnsdumpster-host-search
Passive DNSDumpster host lookup by domain.
- Utilities
dnsgen
Wordlist and mined-word subdomain permutation.
- Vulnerabilities
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
- Recon
dnsrecon
Active multi-technique DNS enumeration for assessments.
- OSINT
dnstwist
Generate lookalike domains and flag registered typosquats.
- Network
dnsvalidator
Validate public DNS resolvers against trusted baselines.
- Network
dnsvalidator-patch
Keep only IPv4 resolvers that match baseline answers.
- Recon
dnsx
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
- Utilities
docker-exec-sh
Execute a custom shell script inside one or more Docker images.
- Discovery
dora
Regex hunt for exposed API keys with exploitation hints.
- Recon
dorky
Automate GitHub and GitLab dorking from a target list.
- Utilities
dsieve
Filter or extract domains from URLs by subdomain level.
- Vulnerabilities
dsss
Tiny SQLi check for GET and POST parameters on one URL.
- Vulnerabilities
dsxs
Tiny XSS check for GET and POST parameters on one URL.
- Utilities
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
- Static Code Analysis
dumpsterdiver
Entropy and rules scan for hardcoded keys and passwords in large file trees.
- Utilities
duplicut
Deduplicate a wordlist without sorting so probability order stays intact.
- Static Code Analysis
dvcsripper-git
Git ripper that reconstructs repos even when directory browsing is off.
- Utilities
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
- Utilities
elasticsearch-index
Persist attack-surface files in Elasticsearch and query them later.
- Utilities
electron-minidump
Supply dump.dmp and matching Breakpad symbols to receive a native backtrace and provenance report.
- OSINT
enumerepo
List public repositories for each GitHub username you already have.
- Network
evilscan
Node.js TCP connect scanner for a single IP or CIDR.
- Network
evilscan-loop
evilscan wrapped to TCP-scan a whole targets file.
- Utilities
execute-nodejs
Run a JavaScript file between workflow stages.
- Utilities
exiftool
Read embedded metadata from hundreds of image, media, and document formats.
- Utilities
export-to-azure-blob
Upload a file or folder to Azure Blob with a SAS token.
- Machine Learning
eyeballer
Label website screenshots so interesting hosts surface first.
- Discovery
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
- Utilities
fastp-qc
Quality-control and trim FASTQ reads (single or paired end) with fastp. Adapters are auto-detected and trimmed, low-quality and N-rich reads filtered; returns trimmed reads, native JSON/HTML reports and a summary.
- Recon
favfreak
Hash favicons across a URL list and match them against a fingerprint dictionary.
- OSINT
favup
Look up the real IP of a host from its favicon via Shodan.
- Vulnerabilities
fdsploit
Automate Local/Remote File Inclusion and directory traversal checks.
- Discovery
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
- Utilities
ffmpeg
Convert one file or a folder of media and write the results next to each other.
- Utilities
ffprobe
A media file in, structured technical metadata out.
- Fuzzing
ffuf
A fast web fuzzer written in Go.
- Fuzzing
ffuf-virtual-hosts
Host-header fuzzing packaged for vhost discovery.
- Utilities
fgrep-by-string
Filter file or folder lines by a fixed string.
- Vulnerabilities
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
- Recon
findmytakeover
Multi-cloud dangling DNS detection via zone-to-inventory diff, not wordlists.
- Vulnerabilities
FinDOM-XSS
Flag potential DOM-based XSS across a URL list.
- Recon
findomain
Passive subdomain enumeration with optional resolve and HTTP checks.
- Network
fingerprintx
Service fingerprinting for open host:port pairs.
- Network
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
- Discovery
fuzzuli
Domain-derived backup-file URL fuzzer.
- Discovery
gau
Passive known-URL fetch from public web archives.
- Discovery
gauplus
Maintained gau fork for passive archive URL collection.
- Utilities
generate-yaml-report
Merge five scanner JSON streams into one host-keyed YAML report.
- Utilities
genomic-contig-check
Identify the genome assembly and contig naming behind BED/GTF/GFF3/VCF/FASTA-index/sizes files and check that they can be joined (chr-prefix and assembly mismatches) with K-Dense's genomic-coordinates check_contigs. JSON report; offline.
- Utilities
genomic-interval-audit
Audit a BED, GTF, GFF3 or VCF file against its own coordinate conventions (off-by-one evidence, end before start, zero-length features, contigs or positions outside a genome) with K-Dense's genomic-coordinates audit. JSON findings; offline.
- Utilities
Get Trickest Files
Pull named files from Trickest file storage into a workflow.
- Recon
get-acq
Pull acquired companies for a parent domain from SecurityTrails.
- Network
get-asn-prefixes
Resolve one ASN to the IP prefixes it announces.
- Utilities
get-trickest-output
Deprecated. Downloaded Trickest workflow node outputs by id.
- Discovery
getJS
Extract JavaScript file URLs from a page or URL list.
- Utilities
gf
Named JSON patterns over grep for recon URL triage.
- Recon
gh-downloader
GitHub Archive URLs in, unique repository and user CSVs out.
- Recon
gh-enhancer
GraphQL enrichment and dedupe for archive repo and user CSVs.
- Recon
gh-investigator
Filter scraped GitHub archive CSVs by star, fork, and watcher floors.
- Recon
gh-scraper
Parse GitHub Archive logs into deduplicated repository and user CSVs.
- Static Code Analysis
git-log4j
Report which GitHub repositories use Log4J, and which files reference it.
- Discovery
git-wild-hunt
Hunt public GitHub code for leaked credential files.
- Recon
github-endpoints
Find endpoints for a domain in public GitHub code.
- Integrations
github-integration
Select a GitHub resource and operation, supply its repository fields, and retain a JSONL result. The explicit dry-run input generates a request plan without calling GitHub. Normal execution uses a token and can create or change repository data.
- Recon
github-subdomains
Find subdomains for a domain in public GitHub code.
- Misconfiguration
gitjacker
Recover source from sites that leaked their .git directory.
- Static Code Analysis
gitleaks
Detect hardcoded secrets in git repos and plain directories.
- Discovery
gittools-dumper
Download exposed .git directories when listing is disabled.
- Discovery
gittools-dumper-extractor
Download an exposed .git and rebuild the working tree in one pass.
- Discovery
gittools-extractor
Reconstruct commits from a dumped .git folder.
- Discovery
gittools-finder
Flag hosts that serve a publicly accessible .git directory.
- Recon
goaltdns
Wordlist-driven subdomain permutations from known hosts.
- Discovery
gobuster-dir
Directory and file brute force against a live web target.
- Recon
gobuster-dns
DNS subdomain brute force with wildcard handling.
- Vulnerabilities
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
- Discovery
golinkfinder
Single-URL extractor for endpoints in HTML and embedded scripts.
- Recon
gorks
Repeatable Google dorking through a Custom Search Engine.
- Static Code Analysis
gosec
Go AST security scanner for credentials, crypto, and injection.
- Discovery
gospider
Go web crawler for links, forms, and JS endpoints.
- Recon
gotator
DNS wordlists through subdomain permutations.
- Discovery
gowitness
Headless Chrome screenshots for web target triage.
- Discovery
gowitness-db
Screenshot URLs and store capture metadata in SQLite.
- Discovery
gowitness-nmap
Screenshot web services discovered in an nmap XML scan.
- Utilities
gron
Make JSON greppable.
- Bioinformatics
gtars-stats
Compute native GTARS genomic interval statistics from BED, including region counts, widths, neighbors and chromosome distributions. Uses BED-derived bins, without reference genome annotations.
- Static Code Analysis
guarddog
A package coordinate in, indicator hits out.
- Social Engineering
h8mail
Email OSINT against breach services and local dumps.
- Discovery
hakcheckurl
HTTP status codes for a URL list. Nothing else.
- Discovery
hakrawler
Go crawler for URLs, forms, and JavaScript locations.
- Recon
hakrevdns
Bulk reverse DNS lookups from an IP list.
- Recon
haktrails
CLI client for SecurityTrails subdomain, WHOIS, and DNS modes.
- Utilities
helm-render
Supply a folder with Chart.yaml at its root, templates and optional values.yaml.
- Misconfiguration
hinject
Batch host header injection checks against a URL list.
- Vulnerabilities
honeymcp
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
- Recon
hosthunter
OSINT mapping from IP addresses to virtual hostnames.
- Utilities
htmlq
jq-style extraction for HTML, driven by CSS selectors.
- Vulnerabilities
http-request-smuggling
Timing-based CL.TE and TE.CL desync detection for a URL or URL list.
- Utilities
HTTPie
A human-friendly CLI HTTP client for APIs and servers.
- Network
httprobe
Probe a domain list for working HTTP and HTTPS servers.
- Network
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
- Discovery
httpx-screenshot
Probe hosts with httpx and save a screenshot of each page.
- Discovery
httpx-screenshot-zip
Capture web host screenshots with httpx and export them as a zip.
- Utilities
hugo-build
Build a local Hugo site into a static output folder using the standard Hugo binary. Network fetching and external commands are disabled; source files are preserved.
- Passwords
Hydra
Parallel network login cracker for SSH, FTP, HTTP forms, and related services.
- Utilities
imagemagick
One image in, one resized or converted image out.
- OSINT
Infoga
Email OSINT from public sources, with optional breach checks.
- Network
ipinfo
Official IPinfo CLI for IP geolocation and ASN lookups.
- Utilities
istio-analyze
Analyze local Kubernetes and Istio manifests offline and return native JSON diagnostics. No cluster access or deployment.
- Utilities
jadx-decompile
Reconstruct Java sources and resources from one local APK for static inspection. JADX interprets bytecode; the result may be incomplete and is not the original source.
- Scanners
jaeles
Signature-driven web application scanner.
- Static Code Analysis
javascript-deobfuscator
Batch deobfuscate JavaScript folders into readable source.
- Integrations
jira-integration
Select an issue operation and supply its site and issue fields. Dry-run generates a method, URL and payload plan; it does not create a Jira issue or establish that an account has the required access.
- Recon
jldc-subdomains
Passive subdomain lookup against the jldc.me Anubis API.
- Scanners
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
- Utilities
jq
Turn one JSON document into the exact records the next node needs.
- Discovery
jsluice
Extract URLs, paths, and secrets from JavaScript with a syntax tree.
- Utilities
json2html
Convert JSON into an HTML table for readable reports.
- Vulnerabilities
jwt-tool
Decode, forge, crack, and tamper JWTs for auth checks.
- Utilities
kallisto-quant
Supply transcript FASTA and one sample of FASTQ reads to build a local index and estimate transcript abundance.
- Discovery
katana
A fast crawling and spidering framework.
- Discovery
kiterunner
Schema-aware API route discovery for modern apps.
- Utilities
kubeseal-offline
Supply secret.json and certificate.pem in one folder.
- Vulnerabilities
kxss
Triage reflected special characters on parameterized URLs.
- Static Code Analysis
leakos
Scan GitHub orgs and URL responses for leaked secrets.
- Utilities
libreoffice
Office documents in, converted files out.
- Utilities
linkerd-annotate
Annotate local Kubernetes workloads for later Linkerd admission injection. No sidecar rendering, cluster access or deployment.
- Discovery
linkfinder
Discover endpoints and parameters inside JavaScript files.
- Utilities
liteparse
Parse native text from the first 100 pages of one PDF into LiteParse JSON with page dimensions and text bounding boxes.
- Vulnerabilities
log4j-scan
Remote scanner for Log4Shell RCE, CVE-2021-44228.
- Utilities
mafft-align
Supply unaligned nucleotide or protein FASTA and receive aligned FASTA plus the native MAFFT log.
- OSINT
maigret
Username search that collects accounts and profile data into one dossier.
- Static Code Analysis
malcontent-scan
A package coordinate in, behavior findings out.
- Network
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
- Discovery
mass-gitfinder
Sweep a host list for publicly accessible .git directories.
- Discovery
mass-linkfinder
LinkFinder over a file of JavaScript URLs, with -r filter and -c cookies.
- Cloud Storage
mass3
DNS existence check for a pre-compiled S3 bucket wordlist.
- Network
masscan
Asynchronous SYN port scanner for wide IP ranges; bound runs with --rate and --excludefile.
- Network
masscan-json
Asynchronous masscan port sweep with structured JSON output.
- Recon
massdns
DNS stub resolver for large domain lists.
- Vulnerabilities
mcparasite
Black Hat Arsenal MCP context-worm testing: channel inventory by default, a gated kill chain on request.
- Fuzzing
medusa
Recursive HTTP directory and file fuzzer.
- Discovery
meg
Fetch many paths across many hosts while staying polite per host.
- Utilities
mgwls
Cartesian join of two wordlists for fuzzing candidates.
- Utilities
miller
Named verbs for filtering, reshaping, sorting, and converting record streams.
- Utilities
minimap2-align
Align long or short reads (or assemblies) to a reference with minimap2 using a named preset (map-ont, map-pb, map-hifi, sr, splice, asm5/10/20). Returns native PAF with CIGAR, or SAM.
- Utilities
mitmproxy-export
Convert an existing HTTP flow capture to a native HAR file.
- Utilities
mkpath
URL path lists from a wordlist for content discovery.
- Recon
mksub
Subdomain candidates from a wordlist for DNS resolution.
- Utilities
mobsfscan-source
Review supplied Android Java, Kotlin and XML source with local mobsfscan rules. The input is a source folder, not an APK, installed application or connected device.
- Scanners
mongobleed
CVE-2025-14847 MongoDB memory disclosure scanner.
- Utilities
multiqc-report
Supply a folder of existing quality-control logs and receive a MultiQC HTML report with native parsed data.
- Network
naabu
A fast and reliable port scanner that enumerates open ports for hosts.
- Network
netexec
Authenticated network assessment across SMB, LDAP, WinRM, and more.
- Network
netscan
Simple IP or CIDR sweep for open ports.
- Scanners
nikto
Bundled web server checks for dangerous files and outdated software.
- Scanners
nikto-list
Deprecated host-list wrapper for nikto. Prefer the nikto node.
- Utilities
nm-symbols
Inspect an ELF object, executable or shared library without launching it.
- Scanners
nomore403
Bypass 403/40X restrictions through smart request manipulation.
- Static Code Analysis
noseyparker
Rule-based secret scanning across text and full Git history.
- Vulnerabilities
nosqli
MongoDB-focused NoSQL injection scanner and injector.
- Utilities
notify
Publish tool output to chat and alerting providers.
- Integrations
notion-integration
Supply the selected resource, operation and page/database fields. Dry-run returns a planned API request without calling Notion. Normal execution may read, create, update or archive data depending on the operation.
- Recon
nrich
Passive Shodan enrichment for IP lists: ports and known CVEs.
- Network
nscan
Raw-socket SYN scanner for internet-wide port discovery, with optional banners and scripts.
- Scanners
nuclei
YAML template scanner for live hosts; scope runs with tags and severity.
- Scanners
nuclei-markdown
Nuclei vulnerability scan with Markdown export for readable findings.
- Utilities
ocrmypdf
A scanned PDF in, a searchable PDF out.
- Recon
oneforall
Subdomain recon with passive sources, optional brute force, and alive filtering.
- Network
onesixtyone
SNMP community-string scanner for host lists.
- Utilities
openai-file
OpenAI chat responses from a file and a prompt.
- Vulnerabilities
openredirex
Async open-redirect fuzzer for parameterized URLs.
- Vulnerabilities
oralyzer
Python open-redirect and CRLF fuzzer for URLs and URL lists.
- Static Code Analysis
osv-malicious
A package coordinate in, malware advisory rows out.
- Static Code Analysis
osv-scanner
A lockfile in, advisory rows out.
- Utilities
oxfmt-format
Format one JavaScript, JSX, TypeScript or TSX file on stdin with Oxfmt.
- Utilities
p7zip
An archive in, its extracted files out.
- Utilities
pandoc
One document in, a different document format out.
- Fuzzing
paramspider
Passive archive miner for parameterized URLs on a domain.
- OSINT
pastos
OSINT paste-site search for credentials and brand terms.
- Scanners
patator
Modular multi-protocol credential brute forcer with response filtering.
- Utilities
pdf-images
Extract embedded raster images from selected PDF pages as numbered PNG files at their original pixel dimensions.
- Utilities
pdftk-merge
Supply 2 to 10 top-level PDF files.
- Utilities
pdftotext
Plain text from one PDF. Distribute the node to convert many.
- Utilities
perfetto-slice-summary
Group completed slices from a supplied trace by name and save native CSV counts and summed durations.
- Utilities
perfetto-trace-json
Convert a supplied local trace into native Chrome trace-event JSON with Perfetto traceconv.
- Passwords
phpmyadmin-auth-bruteforce
Password wordlist attacks against phpMyAdmin login forms.
- Discovery
playwright
Screenshot, HAR trace, or a user script after the page actually renders.
- Utilities
portboozle
Lightweight TCP port scanner for massdns-resolved hosts.
- Static Code Analysis
poutine-scan
Scan CI/CD pipeline definitions (GitHub Actions, GitLab CI, Azure Pipelines, Tekton) for build-pipeline supply-chain vulnerabilities with BoostSecurity poutine analyze_local. Native JSON findings and rule catalog; offline, nothing runs.
- Utilities
prefix-file-lines
Prepend one string to each line in a file or folder.
- Static Code Analysis
prek-check
Check copied data files through Prek built-in check-json, check-yaml, check-toml and check-xml hooks.
- Network
prips
Print every IP in a range or CIDR, one per line.
- Network
prips-sh
Portable shell expansion of IP ranges into host lists.
- Utilities
pup
CSS selectors over HTML, the jq counterpart for markup.
- Recon
puredns
A fast domain resolver and subdomain bruteforcing tool that filters out wildcards and poisoned entries.
- Utilities
put-trickest-files
Write workflow results into Trickest file storage.
- Passwords
pydictor
Rule-driven wordlist builder for brute-force pipelines.
- OSINT
pymeta
Find a domain's public files via search engines and extract their metadata.
- Static Code Analysis
pyrefly-check
Type-check Python source with Meta's Pyrefly and emit its native JSON error report. Fixed configuration with a selectable preset; project configs are ignored and no code is executed.
- Utilities
qpdf
Rewrite PDF structure without rendering pages or changing their visible content.
- Utilities
qsreplace
Replace every query-string value across a URL list.
- Scanners
quicdraw
Black Hat Arsenal HTTP/3 client for Quic-Fin-Sync race testing and fuzzing over QUIC.
- Vulnerabilities
react2shell-scanner
Confirm the RSC and Next.js RCE CVEs on a URL or host list.
- Static Code Analysis
reposcanner
Entropy-based secret scan across a Git repository's commit history.
- Static Code Analysis
retire-js
Detects JavaScript and Node library versions with published vulnerabilities.
- Utilities
retrace-stacktrace
Translate an obfuscated Java stack trace using the mapping from its build.
- Static Code Analysis
rex
Regex ruleset scanner for directories and GitHub repositories; matches saved as JSON.
- Utilities
ripgrep-search
Search a copied folder with a case-sensitive Rust regular expression.
- Utilities
rss-read
Public RSS or Atom items, plus enclosure URLs, as JSONL.
- Static Code Analysis
ruff-check
ruff-check is a Python source linting node powered by Ruff.
- Network
rustscan
Port discovery that lists open ports for downstream service detection.
- Network
rustscan-loop
RustScan over a target file, with optional scripting on each open-port hit.
- Cloud Storage
s3reverse
Normalize mixed S3 bucket references into one address format.
- Cloud Storage
s3scanner
Checks candidate S3 buckets for open permissions and can dump readable contents.
- Utilities
sarif-to-csv
Connect one SARIF report and convert its findings with the native Microsoft SARIF Tools csv command.
- Discovery
scanless
Routes port checks through public websites so probes do not leave your host.
- Cloud Storage
scant3r
Sweeps a URL list with module-based checks across multiple HTTP methods.
- Vulnerabilities
searchsploit
Offline CLI search across the local Exploit-DB archive of exploits and shellcodes.
- Recon
second-order
Crawler that collects second-order subdomain references for takeover review.
- Static Code Analysis
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
- Discovery
securitytrails-sql
Scroll SecurityTrails with an embedded query and api-key.
- Recon
securitytrails-subdomains
Passive SecurityTrails subdomain list for one root domain.
- Static Code Analysis
semgrep-scan
Static analysis with rules that look like the code they match.
- Utilities
shadcn-add-local
Supply component source in a registry:file JSON item and receive the generated source files plus a provenance report.
- Social Engineering
sherlock
Username checks across social networks with optional CSV export.
- OSINT
shodan-download
Bulk-export Shodan banner matches as json.gz.
- OSINT
shodan-python
Search and inspect internet-facing hosts through the Shodan CLI.
- Fuzzing
shortscan
Enumerate IIS 8.3 short filenames to recover hidden paths.
- Recon
shuffledns
massdns wrapper for active subdomain brute force and resolution with wildcard filtering.
- Static Code Analysis
sigma-cli
Sigma YAML in, a SIEM query out.
- Integrations
slack-integration
Choose the Slack resource and operation, then supply message or lookup fields. Dry-run reports a message plan without contacting Slack. It does not verify a webhook, workspace membership, delivery or media content.
- Utilities
smali-assemble
Supply a folder containing only .smali files to assemble a classes.dex artifact. The adapter selects API level 28 and one native worker.
- Vulnerabilities
smuggler
HTTP request smuggling and desync tester for a single endpoint.
- Misconfiguration
snallygaster
Find files on web servers that should not be public.
- Scanners
socialhunter
Crawl pages for broken social links that can be hijacked.
- OSINT
socialscan
Check whether emails and usernames are available, taken, or invalid.
- Discovery
sourcemapper
Reconstruct JavaScript source trees from Sourcemap files.
- Recon
spiderfoot
Automated OSINT modules for attack surface mapping.
- Utilities
sqlite3
A SQLite file and query in, structured rows out.
- Vulnerabilities
sqlmap
Detect and exploit SQL injection on authorized web targets.
- Passwords
ssb
SSH password brute-forcing from a host, user, and wordlist.
- Utilities
ssh-key-fingerprint
Supply public key lines from .pub or authorized_keys-style text.
- Scanners
sslyze
Python SSL/TLS scanner for protocols, certs, and named weaknesses.
- Vulnerabilities
ssrfuzz
SSRF and CRLF fuzzer for parameterized URL lists.
- Utilities
string-to-file
Workflow utility that writes a string to a file artifact.
- Recon
subbrute
DNS subdomain brute force routed through open resolvers.
- Recon
subdomainizer
Mine JavaScript and GitHub for subdomains, cloud URLs, and secrets.
- Recon
subfinder
A subdomain discovery tool that finds valid subdomains using passive online sources.
- Misconfiguration
subjack
Concurrent subdomain takeover checks against dangling CNAMEs.
- Recon
sublist3r
OSINT subdomain enumeration across search engines, with optional SubBrute.
- Vulnerabilities
subzy
Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.
- Recon
sudomy
Subdomain enumeration with optional probing, takeover checks, and HTML reports.
- Utilities
suffix-file-lines
Append one string to each line in a folder of files.
- Discovery
swagger-jacker
Audit endpoints declared in exposed Swagger and OpenAPI specs.
- Utilities
tcpdump-filter
Filter a local packet capture with a BPF expression and return a PCAP file. Reads saved packets only; no live capture, commands or post-processing hooks are exposed.
- Integrations
telegram-integration
Select message.sendMessage, message.sendPhoto or message.sendDocument and provide the intended chat and input fields. Explicit dry-run emits a plan without calling Telegram. Normal-mode media operations upload the supplied FILE using multipart requests.
- Utilities
tesseract
Optical character recognition from one image. Distribute the node for many.
- Static Code Analysis
tflint
Lint one Terraform root module with bundled Terraform recommended rules and emit native TFLint JSON. No provider plugins, init, plan, apply or module downloads.
- Recon
theharvester
Passive OSINT for emails, names, and subdomains on a domain.
- Scanners
threatxtension
Black Hat Arsenal Chrome extension analysis: static rules, permission review, and optional enrichment.
- Vulnerabilities
tko-subs
Detect dangling DNS records and optionally claim them.
- Recon
tlsx
TLS grabber for certificates, SANs, and JARM or JA3 fingerprints.
- Vulnerabilities
tplmap
Detect and exploit server-side template injection on live parameters.
- Utilities
trafilatura
Article body text plus title, author, date, and language from a URL list.
- Scanners
trajan
Black Hat Arsenal CI/CD pipeline scanner for GitHub, GitLab, and Azure DevOps, offline or API driven.
- Utilities
trickest-execute
Start a Trickest workflow run from the command line.
- Utilities
trickest-output
Download outputs from finished Trickest workflow runs.
- Containers
trivy-ecr-scan
Trivy CVE scanning for container images stored in Amazon ECR.
- Containers
trivy-image-scan
Trivy against container images for CVEs, secrets, and misconfigs.
- Static Code Analysis
trufflehog
Hunt leaked credentials and verify which still work.
- Static Code Analysis
tsc-check
Check a copied TypeScript project and return file, line, column, TS code and diagnostic message.
- Scanners
twa
Opinionated web audit for headers, ports, and TLS.
- Scanners
twa-loop
Opinionated twa web audits, one pass over a domain list.
- Static Code Analysis
ty-check
Type-check Python source with Astral ty and emit diagnostics as GitLab Code Quality JSON. Static analysis only; no code is executed and no packages are installed.
- Network
uncover
Passive host discovery across multiple search-engine indexes.
- Utilities
unfurl
Extract chosen URL parts from stdin into clean line lists.
- Utilities
ungrep-by-string
Inverse file filter: keep files that lack a given string.
- Static Code Analysis
unit-uncertainty-audit
Statically audit Python source for silent unit and measurement-uncertainty mistakes (stripped units, offset temperatures, population vs sample standard deviation, broken propagation, hard-coded CODATA constants) with K-Dense's audit_units. JSON findings; code is parsed, never run.
- Utilities
urldedupe
Deduplicate URLs by path and query-string shape.
- Discovery
urlfinder
Passive URL collection from public discovery sources.
- Discovery
urlhunter
Search archives of URLs exposed via shortener services.
- Utilities
veritas-verify
Supply a JSON passport receipt and an explicit 64-character hexadecimal Ed25519 public key.
- Recon
vhostscan
Virtual host scanner with Host-header sweeps and catch-all detection.
- Recon
vita
Passive subdomain gathering from certificate logs, DNS aggregators, and archives.
- Scanners
wafw00f
Fingerprint the WAF in front of a site before active scanning.
- Scanners
wapiti
Black-box crawler and fuzzer for web app injection classes.
- Discovery
wappalyzer
Identify CMS, frameworks, analytics, and servers on a website.
- Scanners
wascan
Black-box web app crawler and parameter fuzzer.
- Discovery
waybackrobots
Passive historic robots.txt path enumeration from Wayback.
- Recon
waymore
Multi-archive URL harvest with optional response download.
- Utilities
weasyprint
HTML and CSS in, a paginated PDF out.
- Scanners
webagentaudit
Black Hat Arsenal auditing for web-facing AI agents through browser automation, with no provider token.
- Discovery
webanalyze
Go Wappalyzer port for bulk technology fingerprinting.
- Utilities
webp-encode
Encode one 8-bit RGB or RGBA PNG with native cwebp.
- Discovery
webscreenshot
Browser-driven screenshots for visual host triage.
- Utilities
wget
Non-interactive downloader for HTTP, HTTPS, FTP, and FTPS transfers.
- Recon
whatwaf
Fingerprint web application firewalls and test tamper bypasses.
- Recon
whatweb
Plugin-based fingerprinting for CMS, servers, libraries, and devices.
- Utilities
whisper
Speech to txt, vtt, srt, and json from an audio file or folder.
- Utilities
whois-verify-targets
Confirm target-org owns the ranges in a whois-file.
- Recon
whois-with-ripe
Forward WHOIS for a hostname through RIPE.net.
- Recon
whoisninja
Pivot one registrant detail into registered domains.
- Discovery
witnessme-grab
WitnessMe grab mode for links and XPath field extraction.
- Discovery
witnessme-screenshot
WitnessMe screenshot mode for visual web inventory.
- Scanners
wpscan
WordPress scanner for plugins, themes, users, and known vulns.
- Scanners
wpscan-loop
WPScan across a file of WordPress URLs.
- Fuzzing
x8
Hidden parameter discovery by response comparison.
- Vulnerabilities
xforwardy
Host header injection and CORS checks on URL lists.
- Utilities
xmllint-check
Check XML files for well-formedness, and optionally validate them against an XSD schema, with libxml2 xmllint. Returns one JSON line per file with native error messages. No network access and no entity expansion.
- Discovery
xnlinkfinder
Endpoints and parameters from crawls and saved traffic.
- Vulnerabilities
xspear
Parameter XSS analysis with optional blind callbacks.
- Recon
xsubfind3r
Passive subdomain discovery from curated OSINT sources.
- Utilities
xurl
Extract one URL component per run.
- Discovery
xurlfind3r
Passive known-URL discovery from archive feeds.
- Static Code Analysis
yara-x
Files in, YARA match rows out.
- Utilities
youtube-transcript
Public caption tracks to transcript.txt and results.jsonl.
- Utilities
yq
Use one expression language across YAML, JSON, XML, TOML, and properties.
- Utilities
yt-dlp
One URL or a URL list into a folder of media files.
- Scanners
zap-api-scan
OWASP ZAP against an API contract, not a crawlable site.
- Scanners
zap-automation-framework
Ordered ZAP jobs from one YAML plan.
- Scanners
zap-full-scan
Full OWASP ZAP active scan against a target URL.
- Recon
zdns
CLI DNS lookup for bulk name lists.
- Recon
zgrab2-http
zgrab2 HTTP module for structured banner grabs.
- Recon
zgrab2-http-simple
Parsed zgrab2 HTTP output: title, status, content length.
- Recon
zgrab2-jarm
Active JARM TLS fingerprinting via zgrab2.
- Recon
zgrab2-multiple
Multi-protocol zgrab2 grabs driven by one config file.
- Recon
zgrab2-tls
TLS handshake and certificate grabs for host lists.
- Utilities
zipalign-check
Check stored APK entry offsets and save the native alignment report.
- Static Code Analysis
zircolite
Event logs and Sigma rules in, detection rows out.
- Static Code Analysis
zizmor-audit
Audit GitHub Actions workflows and composite actions for security issues (template injection, dangerous triggers, excessive permissions, unpinned actions, credential persistence) with zizmor in offline mode. Native JSON findings; nothing runs.
- Network
zmap
Stateless single-packet scanner for large port surveys.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.