Scanners
Apply one twa checklist across a domains file
Opinionated twa web audits, one pass over a domain list.
Shell · MIT license
overview
What twa-loop does
twa-loop takes a file of domain hostnames and runs the same twa checklist on each one: security headers, cookie attributes, common development ports, and TLS posture. One run gives a hygiene read across an estate instead of a single site.
Flags match twa and apply per host. Enable -s for testssl certificate and cipher review, -w to also audit the www variant, and -d to skip development-port probes. Verbose mode (-v) writes detail to stderr.
Trickest runs twa-loop as a managed scanner node that reads a domains file and emits a file plus a results folder. Place it after subdomain enumeration or a live-host filter when you want one baseline for every host.
source github.com/trailofbits/twa
use cases
Where twa-loop fits
Baseline-audit a whole subdomain list
Feed twa-loop the output of subdomain discovery so every host gets the same header, cookie, and TLS checklist in one pass.
Find the odd host out
Run a consistent audit across the estate to surface the one host with a missing header or weak cipher while every other host is clean.
Include TLS review at scale
Enable -s so testssl runs against each domain, extending the audit to certificate validity and protocol versions for the whole list.
Cover apex and www everywhere
Turn on -w so both the apex and www host of every domain in the file are audited, catching per-host redirect and header drift.
reference
twa-loop inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | File of domain hostnames to scan. |
| test-ssl | BOOLEAN | -s | Audit each site and include testssl for a deeper TLS review. |
| check-www | BOOLEAN | -w | Audit each site and its www subdomain. |
| no-ports | BOOLEAN | -d | Audit each site without scanning common development ports. |
| verbose | BOOLEAN | -v | Audit each site and be verbose on stderr. |
Showing key inputs. twa-loop exposes 5 inputs in total.
example
Run twa-loop
# audit each domain in the list; skip dev ports; include www
# twa-loop wraps: twa -d -w <domain>
while read -r d; do twa -d -w "$d"; done < domains.txtwww.example.com PASS headers
api.example.com FAIL missing CSP
app.example.com PASS cookies
staging.example.com FAIL open port 3000
dev.example.com PASS tls
mail.example.com FAIL missing HSTS
cdn.example.com PASS headersguidance
Choosing twa-loop
Use twa-loop when you have a host list and want the same opinionated baseline on every domain. For a single host, use twa. For WAF fingerprinting or template CVE coverage, chain wafw00f or nuclei after it.
twa
Same checklist for one domain instead of a file.
nikto-list
Broader nikto checks over a host list. twa-loop stays a tighter, fixed audit.
wafw00f
Fingerprints the WAF in front of each host. Complements the twa-loop baseline.
faq
twa-loop questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run twa-loop yourself
A file of domains feeds twa-loop, which runs the opinionated twa checklist against each host and writes the per-host audits as a queryable output.
Facts on this page come from the live Trickest tool library.