loading
Loading content
loading
Scanners
Opinionated web audit for headers, ports, and TLS.
overview
twa audits a single domain against a fixed checklist: security headers a browser would honor, cookie attributes, common development ports that should not face the internet, and basic TLS posture.
Optional switches deepen the pass. -s folds testssl into the report for certificate and cipher detail, -w audits both the apex and its www host, and -d skips the development-port scan when you only want HTTP checks.
Use it as a first-pass hygiene check on one host. For many domains, switch to twa-loop. Trickest runs it as a managed Scanners node that writes a file and folder of results.
source github.com/trailofbits/twa
use cases
Point twa at a domain to get a fast read on security headers, cookie flags, and TLS without configuring a heavier scanner.
Let twa scan for common dev ports that should never face the public internet, and disable that pass with -d when you only want the web checks.
Enable -s to fold testssl into the audit so the report covers certificate validity, protocol versions, and weak ciphers alongside the header checks.
Turn on -w so both example.com and www.example.com get audited, catching a header or redirect that is right on one and wrong on the other.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain hostname to scan. |
| verbose | BOOLEAN | -v | Audit a site, and be verbose (on stderr). |
| no-ports | BOOLEAN | -d | Audit a site without scanning common development ports. |
| test-ssl | BOOLEAN | -s | Audit a site and include testssl. |
| check-www | BOOLEAN | -w | Audit a site and its www subdomain. |
Showing key inputs. twa exposes 5 inputs in total.
example
# twa: audit example.com with testssl and www, skip dev-port scantwa -s -w -d example.comexample.comwww.example.comapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comguidance
Use for a fast, opinionated first-pass audit of a single web host before a heavier scanner. It trades configurability for sane defaults. For many domains at once, use twa-loop; for WAF or vulnerability testing, pair with wafw00f and a template scanner downstream.
Same checklist driven over a file of domains instead of one host.
Broader, noisier web server scanner. twa stays a tighter, opinionated audit.
Identifies the WAF in front of a site. Complements twa header and TLS checks.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
A domain feeds twa, which runs its opinionated header, port, and TLS checklist and writes the audit as a queryable output.
Facts on this page come from the live Trickest tool library.