DiscoveryTool
404checker
Headless check for URLs that return 200 but render not-found.
Tools
Every tool you can run in a Trickest workflow, 318 in total. Each page covers what the tool does, its real inputs and outputs, the skills it belongs to, and a runnable example.
A tool is one step. A workflow is a graph of them: the output of one node becomes the input of the next, and every node keeps its results for you to read after the run. Start from a tool when you know the command you want. Start from a workflow when you know the answer you want.
318 items
- ScannersTool
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
- VulnerabilitiesTool
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
- ReconTool
aiodnsbrute
Async DNS brute force for subdomains that passive sources miss.
- ScannersTool
airixss
Reflection triage for parameter URLs during recon.
- UtilitiesTool
airtable-integration
Import, export, and upsert workflow data against an Airtable base.
- ScannersTool
alterx
Pattern-based subdomain wordlist generator from known names.
- ReconTool
amass
Multi-source subdomain discovery; hand names to httpx.
- ReconTool
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
- ReconTool
amass-json
OWASP Amass enumeration that emits structured JSON.
- ReconTool
analyticsrelationships
Find related domains via shared Google Analytics IDs.
- DiscoveryTool
anew
Append lines to a file only if they are not already there.
- UtilitiesTool
apktool-decode
Decode Android APK files into smali sources and resources.
- DiscoveryTool
apkurlgrep
Extract URLs and endpoints from Android APK files.
- DiscoveryTool
aquatone
Visual inspection of websites across many hosts.
- NetworkTool
asnmap
Map an organization's network ranges from ASN data.
- UtilitiesTool
assert-tool
Check a file's values against conditions and exit with a matching code.
- ReconTool
assetfinder
Find domains and subdomains potentially related to a given domain.
- UtilitiesTool
aws-route53-zones
Authenticated Route53 hosted-zone inventory.
- DiscoveryTool
aws-s3-data-finder
List and flag sensitive keys across many S3 buckets.
- Static Code AnalysisTool
bandit
AST-based security checks for Python source.
- NetworkTool
bass
Merge the target's DNS servers with public resolvers into one pool.
- UtilitiesTool
batch-output
Extract file or folder lines by START_LINE,END_LINE batch range.
- UtilitiesTool
batch-output-v2
Extract a START,END batch from file lines or folder files.
- ReconTool
bbot
Modular OSINT recon that chains modules from a seed target.
- ScannersTool
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
- ReconTool
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
- DiscoveryTool
bfac
Checks live URLs for backup files and exposed version-control paths.
- ReconTool
bigip-scanner
Fingerprint the software version of a remote F5 BIG-IP management interface.
- ScannersTool
bomber
Scan software bills of materials for known-vulnerable dependencies.
- ScannersTool
broken-link-checker
Find broken links, missing images, and other dead HTML references.
- VulnerabilitiesTool
bypass-403
A focused Go script that probes 403 Forbidden responses for known bypasses.
- DiscoveryTool
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
- DiscoveryTool
carlospolop-hakoriginfinder
Discover the origin host behind a reverse proxy, useful when a cloud WAF hides the backend.
- ReconTool
ccpy
Extract URLs for a specific target from commoncrawl.org indexes.
- ReconTool
cdncheck
Detect CDN, WAF, and cloud technology for a given IP or hostname.
- UtilitiesTool
cent
Organize community Nuclei templates from across the ecosystem in one place.
- ReconTool
cero
Scrape domain names from SSL certificates of arbitrary hosts.
- ReconTool
certsh-subdomains
Pull a domain's subdomains from the crt.sh certificate transparency database.
- UtilitiesTool
cewl
Spider a URL and return a wordlist for password crackers.
- ReconTool
chaos-client
Go client for ProjectDiscovery Chaos DB subdomain lookups.
- ScannersTool
chopchop
Signature scanner for exposed files, folders, and services on web roots.
- ReconTool
chronos
Module-driven extractor for Wayback Machine page history.
- UtilitiesTool
clean-wordlist
Regex-clean a wordlist before the slow stage reads it.
- ReconTool
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
- ReconTool
cloudlist
List assets from multiple cloud providers in one inventory.
- DiscoveryTool
cloudscraper
Spider pages and scrape linked cloud resource strings.
- ScannersTool
cmseek
CMS detection and version fingerprinting.
- VulnerabilitiesTool
commix
Automates OS command injection detection and exploitation.
- VulnerabilitiesTool
cookiemonster
Crack weak signing secrets on stateless session cookies.
- VulnerabilitiesTool
corstest
Find Cross-Origin Resource Sharing misconfigurations on a URL list.
- DiscoveryTool
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
- FuzzingTool
crithit
Directory and file brute forcing across many hosts.
- VulnerabilitiesTool
crlfmap
Find HTTP response splitting in parameterized URLs.
- MisconfigurationTool
crlfuzz
Go-based CRLF injection scanner for URLs and URL lists.
- ReconTool
crosslinked
Passive LinkedIn employee enumeration through search engine results.
- ReconTool
csprecon
Discover related domains from Content-Security-Policy headers.
- VulnerabilitiesTool
cve-2018-15473
Username enumeration against OpenSSH via CVE-2018-15473.
- VulnerabilitiesTool
cve-2023-3519-inspector
Version-based detection of Citrix builds exposed to CVE-2023-3519.
- VulnerabilitiesTool
dalfox
Parameter mining and XSS testing with headless verification.
- Static Code AnalysisTool
dawnscanner
Static review of Ruby source for security issues, CVEs, and OWASP risks.
- NetworkTool
decant
Expand one CIDR into one IP per line.
- NetworkTool
decant-file
Expand many CIDR ranges from one file.
- UtilitiesTool
diff-trickest-files
Diff this run against a Trickest storage baseline.
- DiscoveryTool
dirsearch
Web path scanner.
- ReconTool
dmut
Permute known subdomains, then resolve what lives.
- OSINTTool
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
- OSINTTool
dnsdumpster-host-search
Passive DNSDumpster host lookup by domain.
- UtilitiesTool
dnsgen
Wordlist and mined-word subdomain permutation.
- VulnerabilitiesTool
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
- ReconTool
dnsrecon
Active multi-technique DNS enumeration for assessments.
- OSINTTool
dnstwist
Generate lookalike domains and flag registered typosquats.
- NetworkTool
dnsvalidator
Validate public DNS resolvers against trusted baselines.
- NetworkTool
dnsvalidator-patch
Keep only IPv4 resolvers that match baseline answers.
- ReconTool
dnsx
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
- UtilitiesTool
docker-exec-sh
Execute a custom shell script inside one or more Docker images.
- DiscoveryTool
dora
Regex hunt for exposed API keys with exploitation hints.
- ReconTool
dorky
Automate GitHub and GitLab dorking from a target list.
- UtilitiesTool
dsieve
Filter or extract domains from URLs by subdomain level.
- VulnerabilitiesTool
dsss
Tiny SQLi check for GET and POST parameters on one URL.
- VulnerabilitiesTool
dsxs
Tiny XSS check for GET and POST parameters on one URL.
- Static Code AnalysisTool
dumpsterdiver
Entropy and rules scan for hardcoded keys and passwords in large file trees.
- UtilitiesTool
duplicut
Deduplicate a wordlist without sorting so probability order stays intact.
- Static Code AnalysisTool
dvcsripper-git
Git ripper that reconstructs repos even when directory browsing is off.
- UtilitiesTool
elasticsearch-index
Persist attack-surface files in Elasticsearch and query them later.
- OSINTTool
enumerepo
List public repositories for each GitHub username you already have.
- NetworkTool
evilscan
Node.js TCP connect scanner for a single IP or CIDR.
- NetworkTool
evilscan-loop
evilscan wrapped to TCP-scan a whole targets file.
- UtilitiesTool
execute-nodejs
Run a JavaScript file between workflow stages.
- UtilitiesTool
export-to-azure-blob
Upload a file or folder to Azure Blob with a SAS token.
- Machine LearningTool
eyeballer
Label website screenshots so interesting hosts surface first.
- DiscoveryTool
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
- ReconTool
favfreak
Hash favicons across a URL list and match them against a fingerprint dictionary.
- OSINTTool
favup
Look up the real IP of a host from its favicon via Shodan.
- VulnerabilitiesTool
fdsploit
Automate Local/Remote File Inclusion and directory traversal checks.
- DiscoveryTool
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
- FuzzingTool
ffuf
A fast web fuzzer written in Go.
- FuzzingTool
ffuf-virtual-hosts
Host-header fuzzing packaged for vhost discovery.
- UtilitiesTool
fgrep-by-string
Filter file or folder lines by a fixed string.
- VulnerabilitiesTool
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
- ReconTool
findmytakeover
Multi-cloud dangling DNS detection via zone-to-inventory diff, not wordlists.
- VulnerabilitiesTool
FinDOM-XSS
Flag potential DOM-based XSS across a URL list.
- ReconTool
findomain
Passive subdomain enumeration with optional resolve and HTTP checks.
- NetworkTool
fingerprintx
Service fingerprinting for open host:port pairs.
- NetworkTool
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
- DiscoveryTool
fuzzuli
Domain-derived backup-file URL fuzzer.
- DiscoveryTool
gau
Passive known-URL fetch from public web archives.
- DiscoveryTool
gauplus
Maintained gau fork for passive archive URL collection.
- UtilitiesTool
generate-yaml-report
Merge five scanner JSON streams into one host-keyed YAML report.
- UtilitiesTool
Get Trickest Files
Pull named files from Trickest file storage into a workflow.
- ReconTool
get-acq
Pull acquired companies for a parent domain from SecurityTrails.
- NetworkTool
get-asn-prefixes
Resolve one ASN to the IP prefixes it announces.
- UtilitiesTool
get-trickest-output
Deprecated. Downloaded Trickest workflow node outputs by id.
- DiscoveryTool
getJS
Extract JavaScript file URLs from a page or URL list.
- UtilitiesTool
gf
Named JSON patterns over grep for recon URL triage.
- ReconTool
gh-downloader
GitHub Archive URLs in, unique repository and user CSVs out.
- ReconTool
gh-enhancer
GraphQL enrichment and dedupe for archive repo and user CSVs.
- ReconTool
gh-investigator
Filter scraped GitHub archive CSVs by star, fork, and watcher floors.
- ReconTool
gh-scraper
Parse GitHub Archive logs into deduplicated repository and user CSVs.
- Static Code AnalysisTool
git-log4j
Report which GitHub repositories use Log4J, and which files reference it.
- DiscoveryTool
git-wild-hunt
Hunt public GitHub code for leaked credential files.
- ReconTool
github-endpoints
Find endpoints for a domain in public GitHub code.
- ReconTool
github-subdomains
Find subdomains for a domain in public GitHub code.
- MisconfigurationTool
gitjacker
Recover source from sites that leaked their .git directory.
- Static Code AnalysisTool
gitleaks
Detect hardcoded secrets in git repos and plain directories.
- DiscoveryTool
gittools-dumper
Download exposed .git directories when listing is disabled.
- DiscoveryTool
gittools-dumper-extractor
Download an exposed .git and rebuild the working tree in one pass.
- DiscoveryTool
gittools-extractor
Reconstruct commits from a dumped .git folder.
- DiscoveryTool
gittools-finder
Flag hosts that serve a publicly accessible .git directory.
- ReconTool
goaltdns
Wordlist-driven subdomain permutations from known hosts.
- DiscoveryTool
gobuster-dir
Directory and file brute force against a live web target.
- ReconTool
gobuster-dns
DNS subdomain brute force with wildcard handling.
- VulnerabilitiesTool
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
- DiscoveryTool
golinkfinder
Single-URL extractor for endpoints in HTML and embedded scripts.
- ReconTool
gorks
Repeatable Google dorking through a Custom Search Engine.
- Static Code AnalysisTool
gosec
Go AST security scanner for credentials, crypto, and injection.
- DiscoveryTool
gospider
Go web crawler for links, forms, and JS endpoints.
- ReconTool
gotator
DNS wordlists through subdomain permutations.
- DiscoveryTool
gowitness
Headless Chrome screenshots for web target triage.
- DiscoveryTool
gowitness-db
Screenshot URLs and store capture metadata in SQLite.
- DiscoveryTool
gowitness-nmap
Screenshot web services discovered in an nmap XML scan.
- UtilitiesTool
gron
Make JSON greppable.
- Social EngineeringTool
h8mail
Email OSINT against breach services and local dumps.
- DiscoveryTool
hakcheckurl
HTTP status codes for a URL list. Nothing else.
- DiscoveryTool
hakrawler
Go crawler for URLs, forms, and JavaScript locations.
- ReconTool
hakrevdns
Bulk reverse DNS lookups from an IP list.
- ReconTool
haktrails
CLI client for SecurityTrails subdomain, WHOIS, and DNS modes.
- MisconfigurationTool
hinject
Batch host header injection checks against a URL list.
- VulnerabilitiesTool
honeymcp
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
- ReconTool
hosthunter
OSINT mapping from IP addresses to virtual hostnames.
- VulnerabilitiesTool
http-request-smuggling
Timing-based CL.TE and TE.CL desync detection for a URL or URL list.
- UtilitiesTool
HTTPie
A human-friendly CLI HTTP client for APIs and servers.
- NetworkTool
httprobe
Probe a domain list for working HTTP and HTTPS servers.
- NetworkTool
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
- DiscoveryTool
httpx-screenshot
Probe hosts with httpx and save a screenshot of each page.
- DiscoveryTool
httpx-screenshot-zip
Capture web host screenshots with httpx and export them as a zip.
- PasswordsTool
Hydra
Parallel network login cracker for SSH, FTP, HTTP forms, and related services.
- OSINTTool
Infoga
Email OSINT from public sources, with optional breach checks.
- NetworkTool
ipinfo
Official IPinfo CLI for IP geolocation and ASN lookups.
- ScannersTool
jaeles
Signature-driven web application scanner.
- Static Code AnalysisTool
javascript-deobfuscator
Batch deobfuscate JavaScript folders into readable source.
- ReconTool
jldc-subdomains
Passive subdomain lookup against the jldc.me Anubis API.
- ScannersTool
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
- DiscoveryTool
jsluice
Extract URLs, paths, and secrets from JavaScript with a syntax tree.
- UtilitiesTool
json2html
Convert JSON into an HTML table for readable reports.
- VulnerabilitiesTool
jwt-tool
Decode, forge, crack, and tamper JWTs for auth checks.
- DiscoveryTool
katana
A fast crawling and spidering framework.
- DiscoveryTool
kiterunner
Schema-aware API route discovery for modern apps.
- VulnerabilitiesTool
kxss
Triage reflected special characters on parameterized URLs.
- Static Code AnalysisTool
leakos
Scan GitHub orgs and URL responses for leaked secrets.
- DiscoveryTool
linkfinder
Discover endpoints and parameters inside JavaScript files.
- VulnerabilitiesTool
log4j-scan
Remote scanner for Log4Shell RCE, CVE-2021-44228.
- OSINTTool
maigret
Username search that collects accounts and profile data into one dossier.
- NetworkTool
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
- DiscoveryTool
mass-gitfinder
Sweep a host list for publicly accessible .git directories.
- DiscoveryTool
mass-linkfinder
LinkFinder over a file of JavaScript URLs, with -r filter and -c cookies.
- Cloud StorageTool
mass3
DNS existence check for a pre-compiled S3 bucket wordlist.
- NetworkTool
masscan
Asynchronous SYN port scanner for wide IP ranges; bound runs with --rate and --excludefile.
- NetworkTool
masscan-json
Asynchronous masscan port sweep with structured JSON output.
- ReconTool
massdns
DNS stub resolver for large domain lists.
- VulnerabilitiesTool
mcparasite
Black Hat Arsenal MCP context-worm testing: channel inventory by default, a gated kill chain on request.
- FuzzingTool
medusa
Recursive HTTP directory and file fuzzer.
- DiscoveryTool
meg
Fetch many paths across many hosts while staying polite per host.
- UtilitiesTool
mgwls
Cartesian join of two wordlists for fuzzing candidates.
- UtilitiesTool
mkpath
URL path lists from a wordlist for content discovery.
- ReconTool
mksub
Subdomain candidates from a wordlist for DNS resolution.
- ScannersTool
mongobleed
CVE-2025-14847 MongoDB memory disclosure scanner.
- NetworkTool
naabu
A fast and reliable port scanner that enumerates open ports for hosts.
- NetworkTool
netexec
Authenticated network assessment across SMB, LDAP, WinRM, and more.
- NetworkTool
netscan
Simple IP or CIDR sweep for open ports.
- ScannersTool
nikto
Bundled web server checks for dangerous files and outdated software.
- ScannersTool
nikto-list
Deprecated host-list wrapper for nikto. Prefer the nikto node.
- ScannersTool
nomore403
Bypass 403/40X restrictions through smart request manipulation.
- Static Code AnalysisTool
noseyparker
Rule-based secret scanning across text and full Git history.
- VulnerabilitiesTool
nosqli
MongoDB-focused NoSQL injection scanner and injector.
- UtilitiesTool
notify
Publish tool output to chat and alerting providers.
- ReconTool
nrich
Passive Shodan enrichment for IP lists: ports and known CVEs.
- NetworkTool
nscan
Raw-socket SYN scanner for internet-wide port discovery, with optional banners and scripts.
- ScannersTool
nuclei
YAML template scanner for live hosts; scope runs with tags and severity.
- ScannersTool
nuclei-markdown
Nuclei vulnerability scan with Markdown export for readable findings.
- ReconTool
oneforall
Subdomain recon with passive sources, optional brute force, and alive filtering.
- NetworkTool
onesixtyone
SNMP community-string scanner for host lists.
- UtilitiesTool
openai-file
OpenAI chat responses from a file and a prompt.
- VulnerabilitiesTool
openredirex
Async open-redirect fuzzer for parameterized URLs.
- VulnerabilitiesTool
oralyzer
Python open-redirect and CRLF fuzzer for URLs and URL lists.
- FuzzingTool
paramspider
Passive archive miner for parameterized URLs on a domain.
- OSINTTool
pastos
OSINT paste-site search for credentials and brand terms.
- ScannersTool
patator
Modular multi-protocol credential brute forcer with response filtering.
- PasswordsTool
phpmyadmin-auth-bruteforce
Password wordlist attacks against phpMyAdmin login forms.
- UtilitiesTool
portboozle
Lightweight TCP port scanner for massdns-resolved hosts.
- UtilitiesTool
prefix-file-lines
Prepend one string to each line in a file or folder.
- NetworkTool
prips
Print every IP in a range or CIDR, one per line.
- NetworkTool
prips-sh
Portable shell expansion of IP ranges into host lists.
- UtilitiesTool
pup
CSS selectors over HTML, the jq counterpart for markup.
- ReconTool
puredns
A fast domain resolver and subdomain bruteforcing tool that filters out wildcards and poisoned entries.
- UtilitiesTool
put-trickest-files
Write workflow results into Trickest file storage.
- PasswordsTool
pydictor
Rule-driven wordlist builder for brute-force pipelines.
- OSINTTool
pymeta
Find a domain's public files via search engines and extract their metadata.
- UtilitiesTool
qsreplace
Replace every query-string value across a URL list.
- ScannersTool
quicdraw
Black Hat Arsenal HTTP/3 client for Quic-Fin-Sync race testing and fuzzing over QUIC.
- VulnerabilitiesTool
react2shell-scanner
Confirm the RSC and Next.js RCE CVEs on a URL or host list.
- Static Code AnalysisTool
reposcanner
Entropy-based secret scan across a Git repository's commit history.
- Static Code AnalysisTool
retire-js
Detects JavaScript and Node library versions with published vulnerabilities.
- Static Code AnalysisTool
rex
Regex ruleset scanner for directories and GitHub repositories; matches saved as JSON.
- NetworkTool
rustscan
Port discovery that lists open ports for downstream service detection.
- NetworkTool
rustscan-loop
RustScan over a target file, with optional scripting on each open-port hit.
- Cloud StorageTool
s3reverse
Normalize mixed S3 bucket references into one address format.
- Cloud StorageTool
s3scanner
Checks candidate S3 buckets for open permissions and can dump readable contents.
- DiscoveryTool
scanless
Routes port checks through public websites so probes do not leave your host.
- Cloud StorageTool
scant3r
Sweeps a URL list with module-based checks across multiple HTTP methods.
- VulnerabilitiesTool
searchsploit
Offline CLI search across the local Exploit-DB archive of exploits and shellcodes.
- ReconTool
second-order
Crawler that collects second-order subdomain references for takeover review.
- Static Code AnalysisTool
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
- DiscoveryTool
securitytrails-sql
Scroll SecurityTrails with an embedded query and api-key.
- ReconTool
securitytrails-subdomains
Passive SecurityTrails subdomain list for one root domain.
- Static Code AnalysisTool
semgrep-scan
Static analysis with rules that look like the code they match.
- Social EngineeringTool
sherlock
Username checks across social networks with optional CSV export.
- OSINTTool
shodan-download
Bulk-export Shodan banner matches as json.gz.
- OSINTTool
shodan-python
Search and inspect internet-facing hosts through the Shodan CLI.
- FuzzingTool
shortscan
Enumerate IIS 8.3 short filenames to recover hidden paths.
- ReconTool
shuffledns
massdns wrapper for active subdomain brute force and resolution with wildcard filtering.
- VulnerabilitiesTool
smuggler
HTTP request smuggling and desync tester for a single endpoint.
- MisconfigurationTool
snallygaster
Find files on web servers that should not be public.
- ScannersTool
socialhunter
Crawl pages for broken social links that can be hijacked.
- OSINTTool
socialscan
Check whether emails and usernames are available, taken, or invalid.
- DiscoveryTool
sourcemapper
Reconstruct JavaScript source trees from Sourcemap files.
- ReconTool
spiderfoot
Automated OSINT modules for attack surface mapping.
- VulnerabilitiesTool
sqlmap
Detect and exploit SQL injection on authorized web targets.
- PasswordsTool
ssb
SSH password brute-forcing from a host, user, and wordlist.
- ScannersTool
sslyze
Python SSL/TLS scanner for protocols, certs, and named weaknesses.
- VulnerabilitiesTool
ssrfuzz
SSRF and CRLF fuzzer for parameterized URL lists.
- UtilitiesTool
string-to-file
Workflow utility that writes a string to a file artifact.
- ReconTool
subbrute
DNS subdomain brute force routed through open resolvers.
- ReconTool
subdomainizer
Mine JavaScript and GitHub for subdomains, cloud URLs, and secrets.
- ReconTool
subfinder
A subdomain discovery tool that finds valid subdomains using passive online sources.
- MisconfigurationTool
subjack
Concurrent subdomain takeover checks against dangling CNAMEs.
- ReconTool
sublist3r
OSINT subdomain enumeration across search engines, with optional SubBrute.
- VulnerabilitiesTool
subzy
Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.
- ReconTool
sudomy
Subdomain enumeration with optional probing, takeover checks, and HTML reports.
- UtilitiesTool
suffix-file-lines
Append one string to each line in a folder of files.
- DiscoveryTool
swagger-jacker
Audit endpoints declared in exposed Swagger and OpenAPI specs.
- ReconTool
theharvester
Passive OSINT for emails, names, and subdomains on a domain.
- ScannersTool
threatxtension
Black Hat Arsenal Chrome extension analysis: static rules, permission review, and optional enrichment.
- VulnerabilitiesTool
tko-subs
Detect dangling DNS records and optionally claim them.
- ReconTool
tlsx
TLS grabber for certificates, SANs, and JARM or JA3 fingerprints.
- VulnerabilitiesTool
tplmap
Detect and exploit server-side template injection on live parameters.
- ScannersTool
trajan
Black Hat Arsenal CI/CD pipeline scanner for GitHub, GitLab, and Azure DevOps, offline or API driven.
- UtilitiesTool
trickest-execute
Start a Trickest workflow run from the command line.
- UtilitiesTool
trickest-output
Download outputs from finished Trickest workflow runs.
- ContainersTool
trivy-ecr-scan
Trivy CVE scanning for container images stored in Amazon ECR.
- ContainersTool
trivy-image-scan
Trivy against container images for CVEs, secrets, and misconfigs.
- Static Code AnalysisTool
trufflehog
Hunt leaked credentials and verify which still work.
- ScannersTool
twa
Opinionated web audit for headers, ports, and TLS.
- ScannersTool
twa-loop
Opinionated twa web audits, one pass over a domain list.
- NetworkTool
uncover
Passive host discovery across multiple search-engine indexes.
- UtilitiesTool
unfurl
Extract chosen URL parts from stdin into clean line lists.
- UtilitiesTool
ungrep-by-string
Inverse file filter: keep files that lack a given string.
- UtilitiesTool
urldedupe
Deduplicate URLs by path and query-string shape.
- DiscoveryTool
urlfinder
Passive URL collection from public discovery sources.
- DiscoveryTool
urlhunter
Search archives of URLs exposed via shortener services.
- ReconTool
vhostscan
Virtual host scanner with Host-header sweeps and catch-all detection.
- ReconTool
vita
Passive subdomain gathering from certificate logs, DNS aggregators, and archives.
- ScannersTool
wafw00f
Fingerprint the WAF in front of a site before active scanning.
- ScannersTool
wapiti
Black-box crawler and fuzzer for web app injection classes.
- DiscoveryTool
wappalyzer
Identify CMS, frameworks, analytics, and servers on a website.
- ScannersTool
wascan
Black-box web app crawler and parameter fuzzer.
- DiscoveryTool
waybackrobots
Passive historic robots.txt path enumeration from Wayback.
- ReconTool
waymore
Multi-archive URL harvest with optional response download.
- ScannersTool
webagentaudit
Black Hat Arsenal auditing for web-facing AI agents through browser automation, with no provider token.
- DiscoveryTool
webanalyze
Go Wappalyzer port for bulk technology fingerprinting.
- DiscoveryTool
webscreenshot
Browser-driven screenshots for visual host triage.
- UtilitiesTool
wget
Non-interactive downloader for HTTP, HTTPS, FTP, and FTPS transfers.
- ReconTool
whatwaf
Fingerprint web application firewalls and test tamper bypasses.
- ReconTool
whatweb
Plugin-based fingerprinting for CMS, servers, libraries, and devices.
- UtilitiesTool
whois-verify-targets
Confirm target-org owns the ranges in a whois-file.
- ReconTool
whois-with-ripe
Forward WHOIS for a hostname through RIPE.net.
- ReconTool
whoisninja
Pivot one registrant detail into registered domains.
- DiscoveryTool
witnessme-grab
WitnessMe grab mode for links and XPath field extraction.
- DiscoveryTool
witnessme-screenshot
WitnessMe screenshot mode for visual web inventory.
- ScannersTool
wpscan
WordPress scanner for plugins, themes, users, and known vulns.
- ScannersTool
wpscan-loop
WPScan across a file of WordPress URLs.
- FuzzingTool
x8
Hidden parameter discovery by response comparison.
- VulnerabilitiesTool
xforwardy
Host header injection and CORS checks on URL lists.
- DiscoveryTool
xnlinkfinder
Endpoints and parameters from crawls and saved traffic.
- VulnerabilitiesTool
xspear
Parameter XSS analysis with optional blind callbacks.
- ReconTool
xsubfind3r
Passive subdomain discovery from curated OSINT sources.
- UtilitiesTool
xurl
Extract one URL component per run.
- DiscoveryTool
xurlfind3r
Passive known-URL discovery from archive feeds.
- ScannersTool
zap-api-scan
OWASP ZAP against an API contract, not a crawlable site.
- ScannersTool
zap-automation-framework
Ordered ZAP jobs from one YAML plan.
- ScannersTool
zap-full-scan
Full OWASP ZAP active scan against a target URL.
- ReconTool
zdns
CLI DNS lookup for bulk name lists.
- ReconTool
zgrab2-http
zgrab2 HTTP module for structured banner grabs.
- ReconTool
zgrab2-http-simple
Parsed zgrab2 HTTP output: title, status, content length.
- ReconTool
zgrab2-jarm
Active JARM TLS fingerprinting via zgrab2.
- ReconTool
zgrab2-multiple
Multi-protocol zgrab2 grabs driven by one config file.
- ReconTool
zgrab2-tls
TLS handshake and certificate grabs for host lists.
- NetworkTool
zmap
Stateless single-packet scanner for large port surveys.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.