Scanners
Audit a web host for headers, ports, and TLS
Opinionated web audit for headers, ports, and TLS.
overview
What twa does
twa audits a single domain against a fixed checklist: security headers a browser would honor, cookie attributes, common development ports that should not face the internet, and basic TLS posture.
Optional switches deepen the pass. -s folds testssl into the report for certificate and cipher detail, -w audits both the apex and its www host, and -d skips the development-port scan when you only want HTTP checks.
Use it as a first-pass hygiene check on one host. For many domains, switch to twa-loop. Trickest runs it as a managed Scanners node that writes a file and folder of results.
source github.com/trailofbits/twa
use cases
Where twa fits
Quick hygiene audit of a single host
Point twa at a domain to get a fast read on security headers, cookie flags, and TLS without configuring a heavier scanner.
Catch exposed development ports
Let twa scan for common dev ports that should never face the public internet, and disable that pass with -d when you only want the web checks.
Include a deeper TLS review
Enable -s to fold testssl into the audit so the report covers certificate validity, protocol versions, and weak ciphers alongside the header checks.
Audit the apex and its www host
Turn on -w so both example.com and www.example.com get audited, catching a header or redirect that is right on one and wrong on the other.
reference
twa inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain hostname to scan. |
| verbose | BOOLEAN | -v | Audit a site, and be verbose (on stderr). |
| no-ports | BOOLEAN | -d | Audit a site without scanning common development ports. |
| test-ssl | BOOLEAN | -s | Audit a site and include testssl. |
| check-www | BOOLEAN | -w | Audit a site and its www subdomain. |
Showing key inputs. twa exposes 5 inputs in total.
example
Run twa
# twa: audit example.com with testssl and www, skip dev-port scantwa -s -w -d example.comexample.comwww.example.comapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comguidance
Choosing twa
Use for a fast, opinionated first-pass audit of a single web host before a heavier scanner. It trades configurability for sane defaults. For many domains at once, use twa-loop; for WAF or vulnerability testing, pair with wafw00f and a template scanner downstream.
twa-loop
Same checklist driven over a file of domains instead of one host.
nikto
Broader, noisier web server scanner. twa stays a tighter, opinionated audit.
wafw00f
Identifies the WAF in front of a site. Complements twa header and TLS checks.
faq
twa questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run twa yourself
A domain feeds twa, which runs its opinionated header, port, and TLS checklist and writes the audit as a queryable output.
Facts on this page come from the live Trickest tool library.