loading
Loading content
loading
Scanners
Opinionated web audit for headers, ports, and TLS.
overview
twa audits a single domain against a fixed checklist: security headers a browser would honor, cookie attributes, common development ports that should not face the internet, and basic TLS posture.
Optional switches deepen the pass. -s folds testssl into the report for certificate and cipher detail, -w audits both the apex and its www host, and -d skips the development-port scan when you only want HTTP checks.
Use it as a first-pass hygiene check on one host. For many domains, switch to twa-loop. Trickest runs it as a managed Scanners node that writes a file and folder of results.
source github.com/trailofbits/twa
use cases
Point twa at a domain to get a fast read on security headers, cookie flags, and TLS without configuring a heavier scanner.
Let twa scan for common dev ports that should never face the public internet, and disable that pass with -d when you only want the web checks.
Enable -s to fold testssl into the audit so the report covers certificate validity, protocol versions, and weak ciphers alongside the header checks.
Turn on -w so both example.com and www.example.com get audited, catching a header or redirect that is right on one and wrong on the other.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain hostname to scan. |
| verbose | BOOLEAN | -v | Audit a site, and be verbose (on stderr). |
| no-ports | BOOLEAN | -d | Audit a site without scanning common development ports. |
| test-ssl | BOOLEAN | -s | Audit a site and include testssl. |
| check-www | BOOLEAN | -w | Audit a site and its www subdomain. |
Showing key inputs. twa exposes 5 inputs in total.
example
# twa: audit example.com with testssl and www, skip dev-port scantwa -s -w -d example.comexample.comwww.example.comapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comguidance
Use for a fast, opinionated first-pass audit of a single web host before a heavier scanner. It trades configurability for sane defaults. For many domains at once, use twa-loop; for WAF or vulnerability testing, pair with wafw00f and a template scanner downstream.
Same checklist driven over a file of domains instead of one host.
Broader, noisier web server scanner. twa stays a tighter, opinionated audit.
Identifies the WAF in front of a site. Complements twa header and TLS checks.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A domain feeds twa, which runs its opinionated header, port, and TLS checklist and writes the audit as a queryable output.
Facts on this page come from the live Trickest tool library.