```
A missing or invalid token returns `403 Forbidden`.
## Endpoint
### GET /api/database-tables/\{table\_id}/data
Fetch rows from a Live Table. The `table_id` is unique to each table and is pre-filled in the code examples on your database page.
#### Query Parameters
| Parameter | Type | Required | Description |
| ---------- | ------- | -------- | ------------------------------------------------------- |
| `offset` | integer | No | Number of rows to skip. Default: `0` |
| `limit` | integer | No | Maximum rows to return. Default: `20` |
| `select` | string | No | Comma-separated column names to include in the response |
| `order_by` | string | No | Comma-separated column names to sort by |
| `q` | string | No | TQL filter expression |
#### Response
```json theme={null}
{
"total_count": 1500,
"result_count": 20,
"offset": 0,
"limit": 20,
"results": [
{ "url": "https://example.com", "status_code": 200, "webserver": "nginx" }
]
}
```
| Field | Type | Description |
| -------------- | ------- | --------------------------------------- |
| `total_count` | integer | Total number of rows matching the query |
| `result_count` | integer | Number of rows returned in this page |
| `offset` | integer | Offset used for this page |
| `limit` | integer | Limit used for this page |
| `results` | array | Array of row objects |
#### Status Codes
| Code | Meaning |
| ----- | -------------------------------------- |
| `200` | Success |
| `400` | Invalid query parameters |
| `403` | Missing or invalid authorization token |
## Examples
### Fetch Rows
```javascript theme={null}
const response = await fetch(
"/api/database-tables/{table_id}/data?offset=0&limit=20",
{
headers: {
"Authorization": "Token ",
"Content-Type": "application/json",
},
}
);
const data = await response.json();
console.log("Results:", data.results);
console.log("Total count:", data.total_count);
```
```python theme={null}
import requests
response = requests.get(
"/api/database-tables/{table_id}/data",
params={"offset": 0, "limit": 20},
headers={"Authorization": "Token "},
)
data = response.json()
print("Results:", data["results"])
print("Total count:", data["total_count"])
```
```bash theme={null}
curl -G "https://trickest.io/api/database-tables/{table_id}/data" \
-H "Authorization: Token " \
-d "offset=0" \
-d "limit=20"
```
### Select Specific Columns
Use `select` to limit which fields are returned. This reduces response size for tables with many columns.
```javascript theme={null}
const params = new URLSearchParams({
select: "url,status_code,webserver",
offset: "0",
limit: "20",
});
const response = await fetch(
`/api/database-tables/{table_id}/data?${params}`,
{
headers: {
"Authorization": "Token ",
"Content-Type": "application/json",
},
}
);
const data = await response.json();
```
```python theme={null}
import requests
params = {
"select": "url,status_code,webserver",
"offset": 0,
"limit": 20,
}
response = requests.get(
"/api/database-tables/{table_id}/data",
params=params,
headers={"Authorization": "Token "},
)
data = response.json()
```
```bash theme={null}
curl -G "https://trickest.io/api/database-tables/{table_id}/data" \
-H "Authorization: Token " \
-d "select=url,status_code,webserver" \
-d "offset=0" \
-d "limit=20"
```
### Filter with TQL
Use the `q` parameter to pass a TQL filter expression.
```javascript theme={null}
const params = new URLSearchParams({
q: 'status_code = 200 AND webserver ~ "nginx"',
offset: "0",
limit: "20",
});
const response = await fetch(
`/api/database-tables/{table_id}/data?${params}`,
{
headers: {
"Authorization": "Token ",
"Content-Type": "application/json",
},
}
);
const data = await response.json();
console.log("Filtered results:", data.results);
```
```python theme={null}
import requests
params = {
"q": 'status_code = 200 AND webserver ~ "nginx"',
"offset": 0,
"limit": 20,
}
response = requests.get(
"/api/database-tables/{table_id}/data",
params=params,
headers={"Authorization": "Token "},
)
data = response.json()
print("Filtered results:", data["results"])
```
```bash theme={null}
curl -G "https://trickest.io/api/database-tables/{table_id}/data" \
-H "Authorization: Token " \
--data-urlencode 'q=status_code = 200 AND webserver ~ "nginx"' \
-d "offset=0" \
-d "limit=20"
```
Quote strings and dates in TQL expressions. Leave numbers unquoted. See [Querying](/docs/using-the-app/database-management/querying) for the full TQL syntax reference.
### Paginate Through All Results
Use `offset` and `limit` together to iterate through large result sets. Stop when an empty `results` array is returned.
```javascript theme={null}
async function fetchAll(tableId, limit = 100) {
const allResults = [];
let offset = 0;
while (true) {
const params = new URLSearchParams({
offset: String(offset),
limit: String(limit),
});
const response = await fetch(
`/api/database-tables/${tableId}/data?${params}`,
{
headers: {
"Authorization": "Token ",
"Content-Type": "application/json",
},
}
);
const data = await response.json();
const rows = data.results || [];
if (rows.length === 0) break;
allResults.push(...rows);
offset += limit;
}
return allResults;
}
```
```python theme={null}
import requests
def fetch_all(table_id, limit=100):
all_results = []
offset = 0
while True:
response = requests.get(
f"/api/database-tables/{table_id}/data",
params={"offset": offset, "limit": limit},
headers={"Authorization": "Token "},
)
data = response.json()
rows = data.get("results", [])
if not rows:
break
all_results.extend(rows)
offset += limit
return all_results
```
```bash theme={null}
# Fetch the first page
curl -G "https://trickest.io/api/database-tables/{table_id}/data" \
-H "Authorization: Token " \
-d "offset=0" \
-d "limit=100"
# Fetch the next page by incrementing offset
curl -G "https://trickest.io/api/database-tables/{table_id}/data" \
-H "Authorization: Token " \
-d "offset=100" \
-d "limit=100"
```
## Next Steps
How Solutions and Live Tables work on the platform.
Write and run TQL filters against your Live Tables in the UI.
# Trickest Platform Documentation
Source: https://trickest.com/docs/introduction
Welcome to Trickest Documentation
Learn how to visualize, operate, and scale offensive security workflows.
Core concepts that power the Trickest platform.
Check out Trickest Library and its tools, scripts, modules, and workflows.
Step-by-step guides for workflows, database management, and access control.
Learn about new releases.
Join the Trickest community on Discord.
Read the latest updates and posts on our blog.
# Building Blocks
Source: https://trickest.com/docs/key-concepts/building-blocks/introduction
Scripts, tools, and modules as the executable nodes in your workflows.
## Overview
On this page you will learn what building blocks are in Trickest, why they exist, and how they relate to workflows and the Library.
## What are Building Blocks
Building blocks are the **nodes** in your workflows. Each node is one of three types: a **script**, a **tool**, or a **module**. Together they are the executable components that give you a standardized way to run security tooling and custom automation without installing or wiring everything yourself.
## Why They Exist
Nodes solve the usual pain of offensive security tooling: finding tools, installing them, managing dependencies and environments, and chaining them manually. In Trickest, each node runs in a containerized environment with the right runtime and dependencies. You add nodes to a workflow, connect inputs and outputs, and the platform handles execution. You can reuse nodes from the [Library](/docs/library/introduction) or add your own.
## How It Works
Each node wraps a specific script, tool, or process and exposes a consistent interface: configurable parameters (inputs) and one or more outputs (e.g. files, folders, or data). When a workflow runs, the platform executes each node in order, passing outputs from one node to the inputs of the next. You design the workflow; the platform runs it in a repeatable way.
## Building Block Types
Python and Bash scripts for custom automation and one-off logic.
Command-line tools that cover specific security tasks and processes.
Reusable subgraphs that encapsulate end-to-end processes or use cases.
## How It Relates
* **Workflows:** Nodes in a workflow are scripts, tools, or modules. The workflow defines the graph; the nodes are the steps. See [Workflows](/docs/key-concepts/workflows).
* **Library:** The Library is where you discover and reuse scripts, tools, and modules as nodes. You add them to your workflows from there or use your own.
* **Runs:** When you run a workflow, each node executes and produces outputs that feed the next node.
## Common Patterns
* Picking scripts or tools from the Library and chaining them as nodes in a workflow
* Using modules to reuse a whole subgraph across multiple workflows
* Passing output from one node (e.g. a tool that finds subdomains) into another (e.g. a tool that probes them)
* Combining custom scripts with existing tools for hybrid automation
## Next Steps
Learn the workflow editor layout and how to add nodes.
Add and connect nodes, then run and inspect workflows.
Copy workflows and nodes from the Library into your workspace.
# Modules
Source: https://trickest.com/docs/key-concepts/building-blocks/modules
Module nodes as reusable subgraphs in workflows.
## Overview
On this page you will learn what module nodes are in Trickest, how they work, and how they relate to other building blocks and the Library.
## What is a Module Node
A module node is a **reusable subgraph** of nodes (tools, scripts, and optionally other modules) that appears as a **single node** in a workflow. Inside the module, multiple nodes are wired together to form an end-to-end process or use case. From the outside, the module has a clear boundary: it exposes **inputs** and **outputs** like any other node, so you can connect it upstream and downstream without caring about the internal steps. Modules let you encapsulate complexity and reuse the same pipeline across many workflows.
## Why Modules Exist
Building a workflow from dozens of tools and scripts works but can become hard to read and reuse. Modules solve that by grouping a logical sequence of steps into one unit. You can take a subgraph you use often (e.g. subdomain enumeration plus filtering plus output formatting), turn it into a module, and drop it into any workflow. Modules also make it easier to share and standardize processes: the [Library](/docs/library/introduction) offers ready-made modules for common offensive security use cases, and you can build and reuse your own.
## How It Works
A module is defined by its internal graph: the nodes it contains and the connections between them. Some of those nodes’ inputs and outputs are exposed at the module boundary and become the module’s inputs and outputs. When you add a module to a workflow, you connect to those boundary inputs and outputs the same way you would with a tool or script. When the workflow runs, the platform executes the module’s subgraph; from your perspective it behaves as one step. Modules can contain any mix of tools, scripts, and nested modules.
## How It Relates
* **Building blocks:** Modules are one of the three node types (scripts, tools, modules). See [Introduction](/docs/key-concepts/building-blocks/introduction).
* **Scripts and tools:** A module is a container for scripts and tools (and other modules). Scripts and tools are single nodes; a module is a subgraph that looks like a single node from the outside.
* **Workflows:** Modules run as nodes in a workflow. You design workflows by combining tools, scripts, and modules. See [Workflows](/docs/key-concepts/workflows).
* **Library:** The Library includes modules you can add to your workflows. You can also create modules from your own workflows and reuse them.
## Common Patterns
* Using a Library module to run a full use case (e.g. recon or content discovery) with a few inputs instead of building the graph from scratch
* Turning a repeated sequence of tools and scripts in a workflow into a module and reusing it in other workflows
* Chaining modules with tools and scripts: e.g. a module’s output feeding a tool, or a tool’s output feeding a module
* Keeping workflows readable by hiding detailed steps inside modules and working with high-level inputs and outputs
## Next Steps
Create modules, define inputs and outputs, and use them in workflows.
Add module nodes and connect them to other nodes.
# Scripts
Source: https://trickest.com/docs/key-concepts/building-blocks/scripts
Script nodes for custom automation and glue logic in workflows.
## Overview
On this page you will learn what script nodes are in Trickest, how they work, and how they relate to other building blocks and the Library.
## What is a Script Node
A script node is a **containerized environment** that runs code you provide. It accepts **file** and **folder** inputs and produces **file** and **folder** outputs. The same output can be used as a file or a folder depending on how the next node consumes it. Scripts let you add custom logic, parsing, and automation inside a workflow without installing runtimes yourself.
## Script Types
Trickest supports four script types:
* **Bash** – Shell scripts for quick transformations and glue logic
* **Python** – For richer parsing, data handling, and integration logic
* **Go** – For compiled, performant custom code
* **Node** – JavaScript/Node.js for scripting and tooling
You choose the type when you add or create a script node. The platform provides the right runtime and environment for each.
## Why Scripts Exist
Scripts extend and automate what tools and modules do. They are used to parse or transform tool output so it fits another tool’s input, extract the information that matters, and produce custom reports, files, or data. Because they run in a container with a known runtime, you avoid "works on my machine" issues and get repeatable execution in the workflow.
## How It Works
You write your script in one of the supported types (Bash, Python, Go, or Node). You define **script arguments**; these become **node inputs** that you can wire from other nodes or set manually. The platform builds the right command for the engine and executes it inside the script’s container. Inputs arrive as files or folders at known locations; your script reads them and writes outputs to the expected paths so the next node can consume them.
You can write your own scripts or use **preset scripts** from the [Library](/docs/library/introduction), which are ready to drop into a workflow and customize.
## How It Relates
* **Building blocks:** Scripts are one of the three node types (scripts, tools, modules). See [Introduction](/docs/key-concepts/building-blocks/introduction).
* **Tools:** Tools are pre-packaged command-line programs; scripts are code you write or reuse. Both are nodes with file/folder inputs and outputs and can be chained in a workflow.
* **Modules:** Modules are reusable subgraphs of nodes; a script is a single node. You can use script nodes inside a module.
* **Workflows:** Scripts run as nodes in a workflow. They receive data from upstream nodes and pass results downstream. See [Workflows](/docs/key-concepts/workflows).
## Common Patterns
* Parsing or filtering tool output (e.g. JSON) so it matches the input format expected by the next tool
* Extracting specific fields or lines from large outputs to reduce noise
* Generating custom reports, summaries, or derived files from tool results
* Chaining a script between two tools to adapt data shape or format
* Using a Library script as a starting point and adjusting arguments for your workflow
## Next Steps
Add script nodes, configure inputs, and run workflows.
Use variables in script parameters and script content.
# Tools
Source: https://trickest.com/docs/key-concepts/building-blocks/tools
Tool nodes as pre-packaged command-line programs in workflows.
## Overview
On this page you will learn what tool nodes are in Trickest, how they work, and how they relate to other building blocks and the Library.
## What is a Tool Node
A tool node is a **containerized environment** that runs a pre-packaged command-line tool. Each tool has its own Docker image with the tool and its dependencies already installed. You do not download or install the tool yourself. Tool nodes accept **inputs** (parameters) such as string, file, folder, and boolean values, and produce **file** and **folder** outputs. The platform builds the execution command from the inputs you configure, so you work with human-readable parameters instead of raw command-line flags.
## Why Tools Exist
Tools are the most common node type in workflows. They run specific security processes and tasks (e.g. scanning, fuzzing, enumeration) in a standardized way. Trickest removes the usual friction: no local install, no dependency or OS mismatch. You choose a tool from the [Library](/docs/library/introduction) or import your own, configure its parameters via node inputs, and the platform runs it in a repeatable containerized environment. Outputs can feed the next node in the workflow.
## How It Works
Each tool defines a set of parameters (required and optional). These parameters become **node inputs**. You provide values by connecting outputs from other nodes (e.g. a file from a previous tool or script) or by setting them explicitly (e.g. a target URL as a string, a wordlist as a file). The platform generates the final command from those inputs and executes it inside the tool’s container. The tool writes its results to the node’s output; file and folder outputs are then available to downstream nodes. Tools are designed to be chained: one tool’s output often becomes another tool’s input.
## How It Relates
* **Building blocks:** Tools are one of the three node types (scripts, tools, modules). See [Introduction](/docs/key-concepts/building-blocks/introduction).
* **Scripts:** Scripts are code you write or reuse; tools are pre-packaged CLI programs. Both have defined inputs and outputs and can be chained. Scripts are often used to parse or transform tool output for the next tool.
* **Modules:** Modules are reusable subgraphs of nodes; a tool is a single node. You can use tool nodes inside a module.
* **Workflows:** Tools run as nodes in a workflow. They receive data from upstream nodes and pass results downstream. See [Workflows](/docs/key-concepts/workflows).
## Common Patterns
* Chaining tools so the file or folder output of one tool (e.g. subdomain enumeration) is the input of another (e.g. port scanning or HTTP probing)
* Using string inputs for targets, URLs, or options and file inputs for wordlists, configs, or target lists
* Combining tools with script nodes to parse, filter, or reshape output between steps
* Reusing tools from the Library and configuring only the parameters your workflow needs
## Next Steps
Add tool nodes, configure parameters, and connect inputs and outputs.
Copy workflows and tools from the Library into your workspace.
# Introduction
Source: https://trickest.com/docs/key-concepts/introduction
Core concepts that power the Trickest platform and how they work together.
## Overview
Managing and executing offensive security tooling has become increasingly complex. The traditional approach of finding or building tools, installing them locally or on external infrastructure, and wiring them together manually is slow, error prone, and difficult to scale.
Trickest addresses these challenges through a workflow-based architecture built on five core concepts:
* How you organize work
* How you build automation
* What building blocks you use
* How you store and analyze results
* How you run and scale execution
## Why Key Concepts Matter
This section helps you build a clear mental model of the platform. Key Concepts reduce confusion by answering "what is X?" and "how does X relate to Y?" in one place.
On this page you will learn the main concepts that power the Trickest platform and how they work together to build and deploy offensive security workflows at scale.
## Explore Key Concepts
Organize your work using workspaces and projects to keep workflows, teams, and clients structured.
Build automation by connecting nodes in visual workflows that define your security processes.
Use scripts, tools, and modules as the executable components that power your workflows.
Store, query, and analyze results with Solutions and their integrated datasets.
Execute workflows on managed or self-hosted machines and scale across your fleet.
## Next Steps
Step-by-step guides for workflows, database, users, and more.
Learn the workflow editor layout and how to inspect runs.
Add nodes, configure them, and run workflows.
# Machines & Fleet
Source: https://trickest.com/docs/key-concepts/machines-and-fleet
Compute resources and fleets for running workflows.
## Overview
On this page you will learn what machines and fleets are in Trickest, how they are used to run workflows, and how they relate to the rest of the platform.
## What are Machines and Fleets
**Machines** are the compute resources that execute your workflows. Each run needs one or more machines to run the workflow’s nodes. Trickest provides **managed machines** (virtual machines run by Trickest). You can also attach **self-hosted machines**: your own devices or servers that you register with the platform so they can be used for execution.
A **fleet** is a group of machines used together for workflow execution. There are two fleet types: **Managed fleet** (Trickest-managed machines; you use them without extra setup) and **Self-hosted fleet** (machines you attached to your account; you run workflows on your own infrastructure). When you run a workflow, you choose which fleet to use; the execution engine then assigns machines from that fleet to the run.
## Why Machines and Fleets Exist
Workflows need somewhere to run. Machines and fleets give you that: either Trickest’s managed capacity so you can run without provisioning hardware, or your own machines for data locality, compliance, or custom environments. Fleets group machines so you can say “run this on managed” or “run this on my self-hosted set.” The number of managed machines available to you is defined by your subscription; self-hosted machines are limited only by what you attach.
## How It Works
**Managed machines:** Trickest allocates a fixed number of virtual machines to your account. They have defined CPU and memory (e.g. Community and Enterprise tiers). Machines can be in different states: idle (available), up (activated and ready), running (executing a workflow), or in error. You do not configure or maintain them; you run workflows and the engine assigns machines from the managed fleet.
**Self-hosted machines:** You install and register an agent (or equivalent) on your own hardware. Once attached, those machines appear in your self-hosted fleet. They can be any device or OS that the platform supports. You choose the self-hosted fleet when executing a workflow when you want the run to use your infrastructure.
> **Note** Self-hosted machines that have been inactive for 30 days are automatically removed from your fleet. To keep a machine registered, run the agent at least once within that window; if a machine was removed, re-register it from **Settings > Fleet > Self-Hosted**.
**Distribution:** You can run a workflow on a single machine or spread it across multiple machines. The execution engine, together with workflow structure (e.g. parallel nodes, distributed node outputs), can distribute execution so that different parts of the workflow run on different machines. That lets you scale heavy or parallel workloads.
## Resource Allocation on Managed Fleets
When a workflow runs on a Managed fleet, the platform decides how many machines to use and adjusts that number while the run is active. You do not size the run yourself.
### Starting a Run
Before the run begins, the backend looks at the workflow and counts the **starting nodes** (the nodes that can execute immediately). It submits the run to the execution engine with that many machines.
A run cannot start without at least **one available machine** in the fleet. If the fleet is full at submission time, the run waits until a machine becomes available.
### Scaling Up and Down
While the run is active, the backend monitors the **job queue** and adjusts the number of machines:
* **Scale up**: if jobs are pending and the fleet has capacity, the backend adds machines to the run, up to the number of pending jobs.
* **Scale down**: when a machine finishes its current job and has nothing else to do, the backend turns the machine off so the slot can go to another run.
Both directions apply a short time threshold rather than reacting instantly. This avoids wasteful churn:
* For scale-up, very short jobs (a few seconds) often complete before a new machine can be provisioned and joined to the run. By the time the new machine is ready, the existing machines have already drained the queue, and the new machine would be turned off immediately.
* For scale-down, a machine that just went idle is the cheapest place to run the next job. Keeping it alive briefly avoids a fresh provisioning cycle if more work arrives.
The thresholds are tuned so that scaling reflects sustained demand, not momentary spikes or lulls.
### Fleet Limits and Sharing
Each fleet has a hard machine cap. A single run can never exceed it: thousands of jobs can sit in the queue while the run uses only the fleet's available machines.
Multiple runs can be active on the same Managed fleet at the same time. They compete for the fleet's pool, and machines are reassigned to whichever run needs them as soon as they become free. There is no manual reservation; the backend continuously rebalances based on each run's pending queue.
## How It Relates
* **Workflows:** Workflows are executed on machines. When you run a workflow, you select a fleet (managed or self-hosted); the engine runs the workflow’s nodes on machines from that fleet. See [Workflows](/docs/key-concepts/workflows).
* **Runs:** Each run is executed on one or more machines. Run status and node status reflect whether machines are assigned, running, or finished.
* **Solutions:** Solution workflows run on the same machine and fleet model; you choose the fleet when running the Solution. See [Solutions & Database](/docs/key-concepts/solutions-database).
## Common Patterns
* Running most workflows on the managed fleet for simplicity and no infrastructure setup
* Attaching self-hosted machines when you need execution on your own network, data to stay on-premises, or specific hardware or OS
* Choosing the self-hosted fleet at run time for sensitive or regulated workloads
* Distributing execution across multiple machines for large or parallel workflows to reduce total run time
## Next Steps
Split file and folder outputs into multiple parallel jobs.
Attach and use your own machines for execution.
# Roles & Permissions
Source: https://trickest.com/docs/key-concepts/roles-and-permissions
Role-based access control and permissions in Trickest.
## Overview
On this page you will learn how access control works in Trickest, what roles exist at each level, and how permissions are inherited through teams.
Role-based access control (RBAC) is available exclusively for [Enterprise](https://trickest.com/pricing/) users.
Trickest uses role-based access control (RBAC) to manage what users can access and do within a Vault. Rather than configuring permissions per user per resource, you assign roles. Each role carries a defined set of permissions, and users get everything those roles allow.
There are two independent levels of roles:
* **Global roles** apply across the entire Vault and control organization-wide capabilities, such as inviting users and managing workspaces.
* **Workspace roles** apply within a specific workspace and control what a user can do with that workspace's content.
Roles can be assigned directly to individual users or to teams. When a user has multiple roles that apply to the same resource, the most permissive one takes precedence.
## Global Roles
All users have exactly one global role. It determines what they can do at the Vault level, independent of any workspace.
### Super Admin
The highest level of access in a Vault. Super Admins have full visibility and control over the entire organization. They are the only users who can invite new users, manage global settings, and administer teams.
### Workspace Admin
Can create and manage their own workspaces, and view all Vault users and teams. Cannot access workspaces they have not been explicitly added to, and cannot invite users or change global settings.
### Member
A standard Vault user with no elevated platform-wide permissions. Access to content is determined entirely by the workspace roles they are assigned.
### Global Role Permission Matrix
| Permission | Super Admin | Workspace Admin | Member |
| ----------------------------------------------- | :---------: | :-------------: | :----: |
| Invite users to the platform | ✅ | ❌ | ❌ |
| Manage global settings (fleet, Docker registry) | ✅ | ❌ | ❌ |
| Create and manage teams | ✅ | ❌ | ❌ |
| Create and manage custom modules | ✅ | ❌ | ❌ |
| Access all workspaces | ✅ | ❌ | ❌ |
| View all platform users and teams | ✅ | ✅ | ❌ |
| Create workspaces | ✅ | ✅ | ❌ |
| Delete workspaces | ✅ | ✅ | ❌ |
| Manage personal account settings | ✅ | ✅ | ✅ |
| Generate and manage personal API tokens | ✅ | ✅ | ✅ |
## Workspace Roles
Workspace roles are assigned per workspace. A user can have different roles in different workspaces. Users who create a workspace are automatically assigned the **Owner** role for it.
### Owner
Full control over the workspace. Can manage users, variables, workflows, solutions, and runs. The only role that can add or remove users from a workspace.
### Write
Can build and modify workflows, edit solutions, and manage projects. Cannot manage users or workspace variables.
### Execute
Can run existing workflows and view their results. Cannot create, edit, or delete anything.
### Read
Can view workflows, projects, runs, and files. Cannot create, edit, execute, or delete anything.
### Workspace Role Permission Matrix
| Permission | Owner | Write | Execute | Read |
| -------------------------------- | :---: | :---: | :-----: | :--: |
| Add and remove users and teams | ✅ | ❌ | ❌ | ❌ |
| Manage variables | ✅ | ❌ | ❌ | ❌ |
| Create and update workflows | ✅ | ✅ | ❌ | ❌ |
| Copy workflows from Library | ✅ | ✅ | ❌ | ❌ |
| Create and edit projects | ✅ | ✅ | ❌ | ❌ |
| Execute workflows | ✅ | ✅ | ✅ | ❌ |
| View workflows | ✅ | ✅ | ✅ | ✅ |
| View projects | ✅ | ✅ | ✅ | ✅ |
| View workflow runs | ✅ | ✅ | ✅ | ✅ |
| View files and variables | ✅ | ✅ | ✅ | ✅ |
| View solutions and solution data | ✅ | ✅ | ✅ | ✅ |
| Browse Trickest Library | ✅ | ✅ | ✅ | ✅ |
## Teams and Permission Inheritance
A team is a named group of users that can be assigned roles, just like individual users. Teams exist so you can manage access for a group of people in one place rather than configuring each user separately.
A user can belong to multiple teams. Their effective permissions are the union of all roles from every team they belong to, plus any roles assigned to them directly. When roles conflict, the most permissive one wins.
**Example:** A user belongs to two teams. Team A has the **Execute** workspace role on Workspace X, and Team B has the **Write** workspace role on the same workspace. The user's effective role on Workspace X is **Write**.
## How It Relates
* **Workspaces** — workspace roles are always scoped to a specific workspace. A user with no workspace role on a given workspace has no access to it. See [Workspaces & Projects](/docs/key-concepts/workspaces-and-projects).
* **Users** — new users start with no workspace roles. They must be added to a workspace with an explicit role before they can access anything in it.
## Next Steps
Invite users to the platform and assign access.
Manage teams and assign workspace roles.
Deactivate user accounts when needed.
# Solutions & Database
Source: https://trickest.com/docs/key-concepts/solutions-database
Solutions and live tables for storing and analyzing workflow results.
## Overview
On this page you will learn what Solutions are in Trickest, how they combine workflows with structured storage and analysis, and how they relate to the rest of the platform.
## What is a Solution
A **Solution** is a curated, end-to-end offering for a specific security objective. It bundles the workflows (modules, tools, and configuration) you need to achieve that objective, plus an integrated way to **store** and **analyze** the results. Instead of ad-hoc output files and manual correlation, Solution runs write into **live tables**: structured, queryable tables that the platform normalizes from workflow outputs. **Database mode** in the editor lets you search, filter, track change over time, and prioritize what matters. So a Solution is both "run this security use case" and "here is where and how the results live."
## Why Solutions Exist
Workflows alone give you automation; they do not by default give you a consistent place to store results, a schema that stays the same across runs, or a way to see what changed since the last run. Solutions address that by tying workflows to **live tables** in **Database mode**. You get a single place to configure inputs, run the workflow (on-demand or scheduled), and then query and analyze results in one place. Pre-built Solutions (e.g. Attack Surface Management, Dynamic Application Security Testing, Vulnerability Assessment) let you start quickly; custom Solutions let you define your own workflows and live tables for your use case.
## How It Works
A Solution has two main sides: **execution** and **storage and analysis**.
**Execution:** The Solution’s workflows are designed in the Workflow tab: modules, tools, inputs, and parameters. You provide inputs (e.g. target domains, IP ranges, config files) and run the Solution on-demand or on a schedule. Runs execute like any workflow run; what is different is where the outputs go.
**Storage and analysis:** The Solution defines one or more **live tables**. Each live table has a **schema**: named fields (e.g. hostname, port, vulnerability\_id) and types (text, int, datetime, etc.) plus key fields that uniquely identify a record. Workflow outputs are mapped into these live tables; the platform normalizes and indexes the data so it can be queried quickly. **Database mode** in the editor is the interface to that data: you switch between live tables, apply filters (often via a query language), build views (selected columns, sort order, saved filters), and see **change tracking** (e.g. new, resurfaced, missing, removed, unchanged) so you can focus on what changed between runs. Live tables and Database mode are also exposed via **API** for integration with other systems.
## How It Relates
* **Workflows:** Solutions use workflows (and thus nodes: modules, tools, scripts). The Workflow tab is where you design or customize the Solution’s workflow. See [Workflows](/docs/key-concepts/workflows).
* **Building blocks:** The workflows inside a Solution are built from modules, tools, and scripts. See [Building blocks](/docs/key-concepts/building-blocks/introduction).
* **Runs:** Each time you run a Solution, you get a run (or runs) like any workflow execution. Results from those runs feed the Solution’s live tables.
* **Machines & fleet:** Solution workflows run on your configured machines or fleet, same as other workflows. See [Machines & Fleet](/docs/key-concepts/machines-and-fleet).
## Common Patterns
* Using a pre-built Solution (e.g. ASM, DAST, Vulnerability Assessment) to get a full use case with minimal setup, then tailoring modules and inputs to your environment
* Building a custom Solution with your own workflow and dataset schemas when your process or data model does not match the pre-built ones
* Using Database mode to filter results, save views for triage, and track status changes (new, resurfaced, removed) across runs
* Pulling Solution dataset data via API for reporting, SIEM, or ticketing integration
## Next Steps
Create Live Tables from workflow output.
Filter and search Live Table data.
Save column layouts and filters as named views.
# Workflows
Source: https://trickest.com/docs/key-concepts/workflows
What workflows are, how they work, and how they relate to runs and nodes.
## Overview
On this page you will learn what workflows are in Trickest, how they work at a high level, and how they relate to runs, nodes, and the rest of the platform.
## What is a Workflow
A workflow is the automation you define by placing and connecting nodes on a canvas. Each node represents a step: a script, tool, or module. Connections between nodes define how data flows from one step to the next. The graph of nodes and connections is your security process.
Workflows exist so you can define repeatable, visual automation instead of wiring tools manually. You get one place to design the process, run it, and inspect what happened.
## How it works
You design a workflow on a canvas by adding nodes and connecting their inputs and outputs. When you run a workflow, the platform executes the nodes according to that graph and records the outcome as a run. Each run captures what each node did. Design, execution, and inspection all live in the same workflow view: you see the same canvas, the list of runs, and the details of any run and its nodes.
The building blocks of nodes (scripts, tools, and modules) are described in [Building blocks](/docs/key-concepts/building-blocks/introduction).
## How it relates
* **Workspaces and projects:** Workflows live in a workspace and optionally inside a project. See [Workspaces & Projects](/docs/key-concepts/workspaces-and-projects).
* **Runs:** A run is one execution of a workflow. One workflow can have many runs; each run is a record of that execution and what each node produced.
* **Nodes:** Nodes are the steps in the graph. They are implemented by scripts, tools, or modules from the [Building blocks](/docs/key-concepts/building-blocks/introduction) and the [Library](/docs/library/introduction).
## Common patterns
* Reusing workflows from the Library as a starting point and adapting them to your needs
* Chaining tools and scripts in a graph to form a repeatable pipeline
* Using modules to encapsulate subgraphs and reuse them across workflows
* Inspecting runs to see what each node did and debug or tune the workflow
## Next Steps
Learn the workflow editor layout and how to inspect runs.
Add nodes, configure them, and run workflows.
Run workflows on demand with Execute, Smart Execute, or Advanced Execute, or schedule recurring runs.
Copy workflow templates into your workspace.
# Workspaces & Projects
Source: https://trickest.com/docs/key-concepts/workspaces-and-projects
How workspaces and projects organize your work in Trickest.
## Overview
On this page you will learn what workspaces and projects are in Trickest and how they help you organize your work.
## Workspaces
A workspace is your active context in the platform. It determines what workflows, projects, and runs you see. You have one active workspace at a time; switching changes the scope of everything you see to that workspace.
Workspaces exist so you can separate work by client, methodology, or purpose without mixing workflows and runs. They keep each context isolated and easier to manage.
### Playground Workspace
When you create an account, a `Playground` workspace is created by default. It is meant for testing and learning. You can use it to explore workflows from the [Library](/docs/library/introduction) without affecting other work.
### Common patterns
* Separate workspaces per client (e.g. `Client A`, `Client B`)
* Workspaces for different attack methodologies or processes
* Workspaces for different workflow types
* Using Playground for experiments and learning
## Projects
Projects are optional folders inside a workspace. They group workflows for organization when you want more structure. When you use projects, each one can hold workflows. Projects do not change what is running or who has access; they only help you structure and find workflows.
Workflows always live in a workspace. They can sit directly in the workspace or inside a project. Moving or copying workflows between projects and workspaces is supported.
## How it relates
Every workflow belongs to exactly one workspace; it may sit in that workspace with no project or inside one of the workspace's projects. Variables and runs are scoped to the workspace. For how workflows fit into this model, see [Workflows](/docs/key-concepts/workflows).
## Next Steps
Duplicate workflows and move them between workspaces or projects.
Step-by-step guides for workflows, database, and users.
# Workflows
Source: https://trickest.com/docs/library/attack-surface-management/workflows
Explore a collection of powerful and efficient workflows in the Attack Surface Management category to enhance your productivity and security.
# 34 M Wordlist Subdomain Brute-Force
Source: https://trickest.com/docs/library/attack-surface-management/workflows/34-m-wordlist-subdomain-brute-force
Brute-Force subdomain with a huge wordlist
# ASN Based Network Scan
Source: https://trickest.com/docs/library/attack-surface-management/workflows/asn-based-network-scan
Expand ASNs to CIDR ranges and do port scan the top 1000 ports.
# Asset Discovery & Vulnerability Scanning
Source: https://trickest.com/docs/library/attack-surface-management/workflows/asset-discovery-and-vulnerability-scanning
Discover hostnames comprehensively through passive and active techniques, enumerate web servers, scan for open ports, and discover vulnerabilities, disclosed secrets, exposed panels, and more. The workflow uses previous results as seeds; run it regularly and it may discover new assets every time. To start, set your domain name, wordlist limit, vulnerability filter, Trickest token, and workflow ID
# Enumerate AWS web servers
Source: https://trickest.com/docs/library/attack-surface-management/workflows/enumerate-aws-web-servers
Scan AWS's IP space for http ports as seen on https://trickest.com/blog/cloudflare-bypass-discover-ip-addresses-aws and https://trickest.com/blog/hundreds-of-ssrfs
# Enumerate cloud resources
Source: https://trickest.com/docs/library/attack-surface-management/workflows/enumerate-cloud-resources
Find cloud resources across different providers based on a target's name and hostnames
# Find a server's origin IP address
Source: https://trickest.com/docs/library/attack-surface-management/workflows/find-a-server-origin-ip-address
Search for the origin IP address of a web server by scanning a list of IP addresses as seen on https://trickest.com/blog/cloudflare-bypass-discover-ip-addresses-aws and https://trickest.com/blog/hundreds-of-ssrfs
# Full Subdomain Enumeration
Source: https://trickest.com/docs/library/attack-surface-management/workflows/full-subdomain-enumeration
Enumerate subdomains for a list of domains using multiple effective techniques. Follow along the workflow creation process on https://trickest.com/blog/full-subdomain-brute-force-discovery-using-workflow/
# Hostnames S3 Bucket Finder
Source: https://trickest.com/docs/library/attack-surface-management/workflows/hostnames-s3-bucket-finder
Find s3 buckets by permutations of already known hostnames.
# Inventory 2.0 - Cloud Assets
Source: https://trickest.com/docs/library/attack-surface-management/workflows/inventory-2-0-cloud-assets
Enumerate cloud assets for a list of companies/hosts, across AWS, GCP, Azure, DigitalOcean, Linode, and other cloud providers. Check out the cloud assets of public bug bounty programs on https://github.com/trickest/inventory
# Inventory 2.0 - Hostnames
Source: https://trickest.com/docs/library/attack-surface-management/workflows/inventory-2-0-hostnames
Enumerate hostnames/subdomains for a list of domains using multiple passive and active techniques. Check out the hostnames of public bug bounty programs on https://github.com/trickest/inventory
# Inventory 2.0 - Web Servers
Source: https://trickest.com/docs/library/attack-surface-management/workflows/inventory-2-0-web-servers
Find live web servers for a list of subdomains. Check out the web servers of public bug bounty programs on https://github.com/trickest/inventory
# Inventory 3.0
Source: https://trickest.com/docs/library/attack-surface-management/workflows/inventory-3-0
Completely Transparent Attack Surface Management designed to monitor companies for new assets and streamline the asset management through easily readable CSV files.
# IP Ranges Port Scan
Source: https://trickest.com/docs/library/attack-surface-management/workflows/ip-ranges-port-scan
Port-scan a list of IP ranges
# Levels-deep Subdomain Enumeration
Source: https://trickest.com/docs/library/attack-surface-management/workflows/levels-deep-subdomain-enumeration
Discover overlooked assets by enumerating subdomains, sub-subdomains, sub-sub-subdomains, ...
# Mass Web Server Discovery
Source: https://trickest.com/docs/library/attack-surface-management/workflows/mass-web-server-discovery
Efficiently discover live web servers across a large list of hosts
# Resolve and port scan a list of hosts
Source: https://trickest.com/docs/library/attack-surface-management/workflows/resolve-and-port-scan-a-list-of-hosts
Resolving host names first can lead to a faster port scan and give you more visibility into your target's IP space
# Screenshots and Analysis
Source: https://trickest.com/docs/library/attack-surface-management/workflows/screenshots-and-analysis
Take screenshots of a list of web servers (in parallel) and analyze the screenshots using eyeballer
# Simple Visual Recon
Source: https://trickest.com/docs/library/attack-surface-management/workflows/simple-visual-recon
Find subdomains, check for available web servers and screenshot them.
# Subdomain Enumeration - @trick3st_bot Edition
Source: https://trickest.com/docs/library/attack-surface-management/workflows/subdomain-enumeration-trick3st-bot-edition
The workflow that powers the subdomain enumeration feature of the best security automation Twitter bot https://twitter.com/trick3st_bot
# Subdomain Enumeration - @trick3st_bot Edition
Source: https://trickest.com/docs/library/attack-surface-management/workflows/subdomain-enumeration-trick3stbot-edition
The workflow that powers the subdomain enumeration feature of the best security automation Twitter bot https://twitter.com/trick3st_bot
# Subdomain Port Scan
Source: https://trickest.com/docs/library/attack-surface-management/workflows/subdomain-port-scan
Resolve and port-scan a list of subdomains
# Cloud Storage Tools
Source: https://trickest.com/docs/library/cloud-storage/tools
Explore a collection of powerful and efficient tools in the Cloud Storage category to enhance your productivity and security.
# s3scanner
Source: https://trickest.com/docs/library/cloud-storage/tools/s3scanner
A tool to find open S3 buckets and dump their contents.
# scant3r
Source: https://trickest.com/docs/library/cloud-storage/tools/scant3r
Scant3r Scans all URLs with multiple HTTP Methods and Tries to look for bugs with basic exploits from Headers and URL Parameters By chaining waybackurls or gau with Scant3r you will have more time to look into functions and get Easy bugs on the way.
# Containers Tools
Source: https://trickest.com/docs/library/containers/tools
Explore a collection of powerful and efficient tools in the Containers category to enhance your productivity and security.
# Workflows
Source: https://trickest.com/docs/library/content-discovery/workflows
Explore a collection of powerful and efficient workflows in the Content Discovery category to enhance your productivity and security.
# APK Discovery - Urls & Paths
Source: https://trickest.com/docs/library/content-discovery/workflows/apk-discovery-urls-and-paths
Find URLs & Paths in an APK file
# Brute-Force Files & Directories on a List of Hosts
Source: https://trickest.com/docs/library/content-discovery/workflows/brute-force-files-and-directories-on-a-list-of-hosts
Fuzz a list of hosts for files/directories with a wordlist
# Brute-Force Parameters - Single URL
Source: https://trickest.com/docs/library/content-discovery/workflows/brute-force-parameters-single-url
Get all of the parameters that are used by a single url passed.
# Crawl URLs and Discover JavaScript URLs & Endpoints
Source: https://trickest.com/docs/library/content-discovery/workflows/crawl-urls-and-discover-javascript-urls-and-endpoints
Crawl a web host and extract endpoints and URLs from its JavaScript code
# Crawl URLs and Discover JavaScript URLs & Endpoints
Source: https://trickest.com/docs/library/content-discovery/workflows/crawl-urls-and-discover-javascript-urls-endpoints
Crawl a web host and extract endpoints and URLs from its JavaScript code
# Custom Parameter Discovery Wordlist
Source: https://trickest.com/docs/library/content-discovery/workflows/custom-parameter-discovery-wordlist
Collect URLs of a list of domains and generate a custom parameter discovery wordlist
# Fuzz URL levels
Source: https://trickest.com/docs/library/content-discovery/workflows/fuzz-url-levels
Enumerate URLs for a host, then use a wordlist to fuzz for additional directories at each level.
# Fuzz URL Levels - Multiple
Source: https://trickest.com/docs/library/content-discovery/workflows/fuzz-url-levels-multiple
Enumerate URLs for a list of hosts, then use a wordlist to fuzz for additional directories at each level.
# Get All Public Urls
Source: https://trickest.com/docs/library/content-discovery/workflows/get-all-public-urls
Get all archived urls for a list of subdomains.
# Get all urls and classify by vulnerability type
Source: https://trickest.com/docs/library/content-discovery/workflows/get-all-urls-and-classify-by-vulnerability-type
This workflow is used to gather ALL URLs and sort them by common vulnerabilities
# Inventory 2.0 - URL enumeration
Source: https://trickest.com/docs/library/content-discovery/workflows/inventory-2-0-url-enumeration
Enumerate URLs from passive sources and classify them based on potential vulnerabilities. Check out the URLs of public bug bounty programs on https://github.com/trickest/inventory
# JavaScript Links and Paths
Source: https://trickest.com/docs/library/content-discovery/workflows/javascript-links-and-paths
Find URLs/endpoints in a list of JavaScript files
# Simple Content Discovery
Source: https://trickest.com/docs/library/content-discovery/workflows/simple-content-discovery
Enumerate subdomains and discover URLs through multiple ways
# Single Web App Fuzz
Source: https://trickest.com/docs/library/content-discovery/workflows/single-web-app-fuzz
Fuzz and spider a web application, get responses and zip files for further examination.
# Spider All Subdomains
Source: https://trickest.com/docs/library/content-discovery/workflows/spider-all-subdomains
Spider all subdomains and merge all results.
# Ultimate Web Brute-Forcer
Source: https://trickest.com/docs/library/content-discovery/workflows/ultimate-web-brute-forcer
Get all possible URLs for a web app through js extraction, fuzzing per dir level, wayback archive, remove false positives and do everything in parallel
# Virtual Host Discovery
Source: https://trickest.com/docs/library/content-discovery/workflows/virtual-host-discovery
Enumerate virtual hosts
# Discovery Tools
Source: https://trickest.com/docs/library/discovery/tools
Explore a collection of powerful and efficient tools in the Discovery category to enhance your productivity and security.
# 404checker
Source: https://trickest.com/docs/library/discovery/tools/404checker
Auxiliary script thought to be used in Red Team exercises to check if a URL redirects to a masked 404 (such as 200 that redirects to a Not found page or similars). URLs must be passed sorted in order to improve performance.
# anew
Source: https://trickest.com/docs/library/discovery/tools/anew
Append lines from stdin to a file, but only if they don't already appear in the file. Outputs new lines to stdout too, making it a bit like a tee -a that removes duplicates.
# apkurlgrep
Source: https://trickest.com/docs/library/discovery/tools/apkurlgrep
ApkUrlGrep is a tool that allows extract endpoints from APK files.
# aquatone
Source: https://trickest.com/docs/library/discovery/tools/aquatone
Aquatone is a tool for visual inspection of websites across a large number of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface.
# aws-s3-data-finder
Source: https://trickest.com/docs/library/discovery/tools/aws-s3-data-finder
Find suspicious files (e.g. data backups, PII, credentials) across a large set of AWS S3 buckets and write the first 200k keys (by default) of listable buckets to a .json or .xml file (in buckets/) via AWS CLI or unauthenticated via HTTP requests.
# bfac
Source: https://trickest.com/docs/library/discovery/tools/bfac
BFAC (Backup File Artifacts Checker) is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords, directory structure, etc.
# cariddi
Source: https://trickest.com/docs/library/discovery/tools/cariddi
Take a list of domains, crawl URLs, and scan for endpoints, secrets, API keys, file extensions, tokens, and more...
# carlospolop-hakoriginfinder
Source: https://trickest.com/docs/library/discovery/tools/carlospolop-hakoriginfinder
Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs!
# cloudscraper
Source: https://trickest.com/docs/library/discovery/tools/cloudscraper
CloudScraper is a Tool to spider and scrape targets in search of cloud resources. Plug in a URL and it will spider and search the source of spidered pages for strings such as 's3.amazonaws.com', 'windows.net' and 'digitaloceanspaces'. AWS, Azure, Digital Ocean resources are currently supported.
# crawlergo
Source: https://trickest.com/docs/library/discovery/tools/crawlergo
A powerful browser crawler for web vulnerability scanners
# dirsearch
Source: https://trickest.com/docs/library/discovery/tools/dirsearch
Web path scanner
# fallparams
Source: https://trickest.com/docs/library/discovery/tools/fallparams
Find All Parameters - Tool to crawl pages, find potential parameters and generate a custom target parameter wordlist
# feroxbuster
Source: https://trickest.com/docs/library/discovery/tools/feroxbuster
A fast, simple, recursive content discovery tool written in Rust.
# fuzzuli
Source: https://trickest.com/docs/library/discovery/tools/fuzzuli
URL fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.
# gau
Source: https://trickest.com/docs/library/discovery/tools/gau
getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl for any given domain.
# gauplus
Source: https://trickest.com/docs/library/discovery/tools/gauplus
A modified version of (http://wwww.github.com/lc/gau)
# getjs
Source: https://trickest.com/docs/library/discovery/tools/getjs
getJS is a tool to extract all the javascript files from a set of given urls. The urls can also be piped to gets, or you can specify a single url.
# gittools-finder
Source: https://trickest.com/docs/library/discovery/tools/gittools-finder
Identify websites with publicly accessible .git repositories
# gobuster-dir
Source: https://trickest.com/docs/library/discovery/tools/gobuster-dir
A tool to brute-force directories and files in web sites.
# golinkfinder
Source: https://trickest.com/docs/library/discovery/tools/golinkfinder
A minimal JS endpoint extractor. It's used to extract endpoints in both HTML source and embedded javascript files. Useful for bug hunters, red teamers, infosec ninjas.
# gospider
Source: https://trickest.com/docs/library/discovery/tools/gospider
Fast web spider written in Go
# gowitness
Source: https://trickest.com/docs/library/discovery/tools/gowitness
gowitness is a website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results. Both Linux and macOS is supported, with Windows support mostly working.
# gowitness-nmap
Source: https://trickest.com/docs/library/discovery/tools/gowitness-nmap
gowitness is a website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results. Both Linux and macOS is supported, with Windows support mostly working.
# hakcheckurl
Source: https://trickest.com/docs/library/discovery/tools/hakcheckurl
Takes a list of URLs and returns their HTTP response codes.
# hakrawler
Source: https://trickest.com/docs/library/discovery/tools/hakrawler
Fast golang web crawler for gathering URLs and JavaSript file locations. This is basically a simple implementation of the awesome Gocolly library.
# httpx-screenshot
Source: https://trickest.com/docs/library/discovery/tools/httpx-screenshot
Take screenshots with httpx. Httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads
# httpx-screenshot-zip
Source: https://trickest.com/docs/library/discovery/tools/httpx-screenshot-zip
Take screenshots with httpx and export them to a zip archive. Httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads
# jsluice
Source: https://trickest.com/docs/library/discovery/tools/jsluice
Extract URLs, paths, secrets, and other interesting bits from JavaScript
# katana
Source: https://trickest.com/docs/library/discovery/tools/katana
A next-generation crawling and spidering framework.
# kiterunner
Source: https://trickest.com/docs/library/discovery/tools/kiterunner
Kiterunner is a tool that is capable of not only performing traditional content discovery at lightning-fast speeds but also brute-forcing routes/endpoints in modern applications.
# linkfinder
Source: https://trickest.com/docs/library/discovery/tools/linkfinder
LinkFinder is a python script written to discover endpoints and their parameters in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression.
# mass-gitfinder
Source: https://trickest.com/docs/library/discovery/tools/mass-gitfinder
Identify websites with publicly accessible .git repositories
# mass-linkfinder
Source: https://trickest.com/docs/library/discovery/tools/mass-linkfinder
A wrapper around LinkFinder to input a list of JS URLs. LinkFinder is a python script written to discover endpoints and their parameters in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression.
# meg
Source: https://trickest.com/docs/library/discovery/tools/meg
Meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating.
# sourcemapper
Source: https://trickest.com/docs/library/discovery/tools/sourcemapper
Extract JavaScript source trees from Sourcemap files
# swagger-jacker
Source: https://trickest.com/docs/library/discovery/tools/swagger-jacker
A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.
# urlfinder
Source: https://trickest.com/docs/library/discovery/tools/urlfinder
A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
# wappalyzer
Source: https://trickest.com/docs/library/discovery/tools/wappalyzer
Wappalyzer identifies technologies on websites, including content management systems, eCommerce platforms, JavaScript frameworks, analytics tools and much more.
# waybackrobots
Source: https://trickest.com/docs/library/discovery/tools/waybackrobots
Enumerate old versions of robots.txt paths using Wayback Machine for content discovery
# webanalyze
Source: https://trickest.com/docs/library/discovery/tools/webanalyze
This is a port of Wappalyzer in Go. This tool is designed to be performant and allows to test huge lists of hosts.
# webscreenshot
Source: https://trickest.com/docs/library/discovery/tools/webscreenshot
A simple script to screenshot a list of websites, based on the url-to-image PhantomJS script.
# witnessme-screenshot
Source: https://trickest.com/docs/library/discovery/tools/witnessme-screenshot
WitnessMe screenshot mode. WitnessMe is a primarily a Web Inventory tool inspired by Eyewitness, its also written to be extensible allowing you to create custom functionality that can take advantage of the headless browser it drives in the back-end.
# xnlinkfinder
Source: https://trickest.com/docs/library/discovery/tools/xnlinkfinder
A python tool used to discover endpoints (and potential parameters) for a given target
# Fuzzing Tools
Source: https://trickest.com/docs/library/fuzzing/tools
Explore a collection of powerful and efficient tools in the Fuzzing category to enhance your productivity and security.
# ffuf
Source: https://trickest.com/docs/library/fuzzing/tools/ffuf
A fast web fuzzer written in Go.
# ffuf-multi
Source: https://trickest.com/docs/library/fuzzing/tools/ffuf-multi
A fast web fuzzer written in Go.
# ffuf-od
Source: https://trickest.com/docs/library/fuzzing/tools/ffuf-od
A fast web fuzzer written in Go.
# ffuf-virtual-hosts
Source: https://trickest.com/docs/library/fuzzing/tools/ffuf-virtual-hosts
A fast web fuzzer written in Go, packaged for virtual host discovery
# paramspider
Source: https://trickest.com/docs/library/fuzzing/tools/paramspider
Finds parameters from web archives of the entered domain. Finds parameters from subdomains as well. Gives support to exclude urls with specific extensions. It mines the parameters from web archives (without interacting with the target host).
# shortscan
Source: https://trickest.com/docs/library/fuzzing/tools/shortscan
An IIS short filename enumeration tool
# x8
Source: https://trickest.com/docs/library/fuzzing/tools/x8
The tool helps to find hidden parameters that can be vulnerable or can reveal interesting functionality that other hunters miss. Greater accuracy is achieved thanks to the line-by-line comparison of pages, comparison of response code and reflections.
# Trickest Library
Source: https://trickest.com/docs/library/introduction
Explore the components of the Trickest platform
Welcome to Trickest Library
End-to-end solutions for seamless security automation.
Learn more about Trickest Nodes
![Workflows]()
Workflows
Explore how workflows can automate your offensive security tasks, saving time and boosting efficiency.
Explore Workflows →
![Modules]()
Modules
See how tailored modules for offensive security can help you get faster results by simplifying your tasks.
Explore Modules →
![Tools]()
Tools
Find out how tools can help you create custom automation for offensive security.
Explore Tools →
![Scripts]()
Scripts
Discover how scripts can help you extract, transform, and integrate your security data effectively.
Explore Scripts →
# Machine Learning Tools
Source: https://trickest.com/docs/library/machine-learning/tools
Explore a collection of powerful and efficient tools in the Machine Learning category to enhance your productivity and security.
# eyeballer
Source: https://trickest.com/docs/library/machine-learning/tools/eyeballer
Eyeballer is meant for large-scope network penetration tests where you need to find interesting targets from a huge set of web-based hosts. Go ahead and use your favorite screenshotting tool like normal (EyeWitness or GoWitness) and then run them through Eyeballer to tell you what's likely to contain vulnerabilities, and what isn't.
# Misconfiguration Tools
Source: https://trickest.com/docs/library/misconfiguration/tools
Explore a collection of powerful and efficient tools in the Misconfiguration category to enhance your productivity and security.
# crlfuzz
Source: https://trickest.com/docs/library/misconfiguration/tools/crlfuzz
A fast tool to scan CRLF vulnerability written in Go
# hinject
Source: https://trickest.com/docs/library/misconfiguration/tools/hinject
Host Header Injection Vulnerability Checker
# subjack
Source: https://trickest.com/docs/library/misconfiguration/tools/subjack
Subjack is a Subdomain Takeover tool written in Go designed to scan a list of subdomains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double-check the results manually to rule out false positives
# whatweb
Source: https://trickest.com/docs/library/misconfiguration/tools/whatweb
WhatWeb identifies websites. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices.
# Attack Surface Management Modules
Source: https://trickest.com/docs/library/modules/attack-surface-management
Explore a collection of powerful and efficient modules in the Attack Surface Management category to enhance your workflows.
# Enumerate DNS Records
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-dns-records
Enumerate DNS records for a list of hostnames, IP addresses, or IP ranges
# Enumerate DNS Records
## Description
Enumerate DNS records for a list of hostnames, IP addresses, or IP ranges. Then, analyze the results to gather additional relevant data such as resolving hostnames, IP addresses, and associated hostnames.
## Features
* Enumerates `A`, `AAAA`, `CNAME`, `MX`, `NS`, `TXT`, `CAA`, and `PTR` records.
* Identifies records with `NOERROR`, `REFUSED`, or `SERVFAIL` return codes.
* Capable of processing **tens of thousands of hostnames** simultaneously.
* Discovers **additional hostnames** associated with the target organization.
* Includes a precompiled list of trusted DNS resolvers.
## Inputs
### Required
* **hosts**: a list of hostnames, IP addresses, or IP ranges
```
dashboard.example.com
5.6.7.8/24
shop.example.com
```
## Outputs
* **dns-records**: JSONLines DNS records.
```
{"host": "dashboard.example.com", "response_code": "NOERROR", "record_type": "a", "value": "1.2.3.4", "ttl": 900}
{"host": "dashboard.example.com", "response_code": "NOERROR", "record_type": "a", "value": "5.6.7.8", "ttl": 900}
{"host": "5.6.7.8", "response_code": "NOERROR", "record_type": "ptr", "value": "dev.example.com", "ttl": 900}
{"host": "dashboard.example.com", "response_code": "NOERROR", "record_type": "ns", "value": "ns1.example.com", "ttl": 900}
{"host": "shop.example.com", "response_code": "NOERROR", "record_type": "cname", "value": "example.myshopify.com", "ttl": 900}
```
* **resolving-hostnames**: List of hostnames that have at least one valid DNS record
```
dashboard.example.com
shop.example.com
```
* **ip-address-details**: JSONLines records of IP address discovery details
```
{"ip_address": "1.2.3.4", "data_source": "dns record", "type": "IPv4", "context": "a", "linked_asset": "dashboard.example.com"}
{"ip_address": "5.6.7.8", "data_source": "dns record", "type": "IPv4", "context": "a", "linked_asset": "dashboard.example.com"}
```
* **ip-addresses**: List of IP addresses
```
1.2.3.4
5.6.7.8
```
* **subdomains**: List of discovered subdomains
```
dev.example.com
ns1.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "dev.example.com", "domain_name": "example.com", "data_source": "dns record", "context": "ptr", "linked_asset": "5.6.7.8"}
{"hostname": "ns1.example.com", "domain_name": "example.com", "data_source": "dns record", "context": "ns", "linked_asset": "dashboard.example.com"}
```
* **potential-hostnames**: List of related hostnames outside the strict scope.
```
example.myshopify.com
```
* **potential-hostname-details**: JSONLines records of potential hostname discovery details.
```json theme={null}
{"hostname": "example.myshopify.com", "domain_name": "myshopify.com", "data_sources": "dns record", "context": "cname", "linked_asset": "shop.example.com"}
```
* **subdomain-wildcards**: List of discovered subdomain wildcards.
```
*.internal.example.com
```
* **subdomain-wildcard-details**: JSONLines records of subdomain wildcard discovery details.
```json theme={null}
{"hostname": "*.internal.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "cloud tls certificate"}
```
* **potential-hostname-wildcards**: List of related hostnames with wildcards outside the strict scope.
```
*.proxy.example-corp.com
```
* **potential-hostname-wildcard-details**: JSONLines records of potential hostname wildcard discovery details.
```json theme={null}
{"hostname": "*.proxy.example-corp.com", "domain_name": "example-corp.com", "data_source": "osint source", "context": "certificate transparency"}
```
**Note**: The `*-details` outputs may contain duplicates if a hostname was discovered in multiple records.
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Remove duplicate DNS records from the output
# Enumerate Hostnames via Crawling
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-hostnames-via-crawling
Enumerate subdomains by crawling web servers and analyzing their HTML content and headers
# Enumerate Hostnames via Crawling
## Description
Enumerate subdomains by crawling web servers and analyzing their HTML content and headers.
## Features
* Discovers subdomains in **HTML attributes, HTTP headers, and JavaScript code** that may not be identified through other sources.
* Offers **customizable crawling depth** to balance speed and coverage.
* Capable of processing **tens of thousands of web servers** simultaneously.
## Inputs
### Required
* **web-servers**: a list of web servers
```
https://dashboard.example.com
https://payments.example.com
http://shop.example.com:8080
```
### Optional
* **depth**: maximum crawling depth (default: 2)
## Outputs
* **subdomains**: List of discovered subdomains
```
admin.example.com
assets.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "admin.example.com", "domain_name": "example.com", "data_source": "crawling", "context": "a href", "linked_asset": "dashboard.example.com"}
{"hostname": "assets.example.com", "domain_name": "example.com", "data_source": "crawling", "context": "script text", "linked_asset": "payments.example.com"}
```
**Note**: The `subdomain-details` outputs may contain duplicates if a hostname was discovered in multiple locations.
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Added `header` and `header-file` inputs
# Enumerate Hostnames via DNS Permutations Brute Force
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-hostnames-via-dns-permutations-brute-force
Enumerate hostnames by checking for permutations of known hostnames
# Enumerate Hostnames via Permutation DNS Brute Force
## Description
Enumerate hostnames by checking for permutations of known hostnames. This module finds different environments, regions, and associated software. It has an effective built-in wordlist but you can also use a custom wordlist tailored to your organization’s naming conventions.
## Features
* Discovers **different environments, regions, and associated software** based on the input hostnames.
* **Built-in wordlists** with the option to **use custom ones** tailored to your target.
* A **daily validated list of resolvers** to ensure accuracy.
* Result **verification using manually curated trusted resolvers**.
* A **wildcard filter** takes care of false positives.
## Inputs
### Required
* **hostnames**: a list of hostnames
```
dashboard.example.com
shop.example.com
payments.example.com
```
## Outputs
* **subdomains**: a list of found subdomains
```
dev-dashboard.example.com
shop.us-east-1.example.com
payments-log.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "dev-dashboard.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "permutation brute force"}
{"hostname": "shop.us-east-1.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "permutation brute force"}
{"hostname": "payments-log.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "permutation brute force"}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Improve coverage by increasing the number of tested permutations
* v1.0.2
* Improve wildcard filtering
# Enumerate Hostnames via OSINT Sources
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-hostnames-via-osint-sources
Enumerate subdomains and hostnames passively using OSINT data sources
# Enumerate Hostnames via OSINT Sources
## Description
Enumerate subdomains passively using carefully chosen and tuned data sources to balance speed and thoroughness. It can also identify extra root domains and associated hostnames linked to the specified target domains, even if they aren’t their subdomains. You don't need any 3rd-party API keys to use this module, but if you choose to query more data sources, you can give it that extra boost.
## Features
* Carefully **curated and optimized data sources** ensure a balance between speed and comprehensiveness.
* Can enumerate **thousands of domains** simultaneously.
* Capable of identifying not only subdomains but also **additional hostnames and root domains** associated with the target organization.
* Functional **without any API keys**, but offers the option to provide them to improve results.
* Includes a **detailed output file** showing which data sources found each subdomain, helping you learn more.
## Inputs
### Required
* **domains:** a list of domain names
```
example.com
```
### Optional
* **source-configuration**: YAML file with API keys and data source configuration
```yaml theme={null}
github:
- GITHUB_API_KEY_1
- GITHUB_API_KEY_2
shodan:
- SHODAN_API_KEY
#
# supported sources:
# - alienvault
# - anubis
# - binaryedge
# - bufferover
# - c99
# - censys
# - certspotter
# - chaos
# - chinaz
# - commoncrawl
# - crtsh
# - digitorus
# - dnsdb
# - dnsdumpster
# - dnsrepo
# - fofa
# - fullhunt
# - github
# - hackertarget
# - hunter
# - intelx
# - netlas
# - leakix
# - passivetotal
# - quake
# - rapiddns
# - redhuntlabs
# - robtex
# - securitytrails
# - shodan
# - sitedossier
# - threatbook
# - virustotal
# - waybackarchive
# - whoisxmlapi
# - zoomeyeapi
# - facebook
# - builtwith
```
## Outputs
* **subdomains**: List of discovered subdomains.
```
foo.example.com
bar.example.com
baz.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "foo.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "github"}
{"hostname": "bar.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "shodan"}
{"hostname": "baz.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "waybackarchive"}
```
* **potential-hostnames**: List of related hostnames outside the strict scope.
```
foo.example-internal.com
bar.example-subsidiary.com
baz.example-service-provider.net
```
* **potential-hostname-details**: JSONLines records of potential hostname discovery details.
```json theme={null}
{"hostname": "foo.example-corp.com", "domain_name": "example-corp.com", "data_sources": "osint source", "context": "cloud tls certificate"}
{"hostname": "bar.example-subsidiary.com", "domain_name": "example-subsidiary.com", "data_sources": "osint source", "context": "reverse analytics code search"}
{"hostname": "baz.example-service-provider.net", "domain_name": "example-service-provider.net", "data_sources": "osint source", "context": "certificate transparency"}
```
* **subdomain-wildcards**: List of discovered subdomain wildcards.
```
*.internal.example.com
```
* **subdomain-wildcard-details**: JSONLines records of subdomain wildcard discovery details.
```json theme={null}
{"hostname": "*.internal.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "cloud tls certificate"}
```
* **potential-hostname-wildcards**: List of related hostnames with wildcards outside the strict scope.
```
*.proxy.example-corp.com
```
* **potential-hostname-wildcard-details**: JSONLines records of potential hostname wildcard discovery details.
```json theme={null}
{"hostname": "*.proxy.example-corp.com", "domain_name": "example-corp.com", "data_source": "osint source", "context": "certificate transparency"}
```
**Note**: The `*-details` outputs may contain duplicates if a hostname was discovered through multiple sources.
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Bug fixes
* v1.0.2
* Performance improvements
* v1.0.3
* Improved output efficiency by storing one record per unique hostname from the certificate\_transparency source
# Enumerate Hostnames via Recursive DNS Brute Force
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-hostnames-via-recursive-dns-brute-force
Enumerate sub-subdomains of a list of hostnames using DNS brute force on the most likely hostnames
# Enumerate Hostnames via Recursive DNS Brute Force
## Description
Enumerate sub-subdomains of a list of hostnames using DNS brute force on the most likely hostnames. The module starts by determining which hostnames have the highest probability of having valid hostnames at other levels and then generates the permutations.
For example, given a subdomain like `test.foo.bar.baz.example.com`, it will try variations like `FUZZ.foo.bar.baz.example.com`, `FUZZ.bar.baz.example.com`, `FUZZ.baz.example.com`, and so on. It uses regularly updated wordlists made specifically for this purpose, based on analyzing the hostnames of hundreds of organizations. You can also use custom wordlists tailored to your organization’s naming conventions.
### Features
* Discovers **different environments, regions, and associated software** based on the input hostnames.
* **Faster than standard permutation scanning**, focusing on high-probability hostnames.
* **Built-in wordlists** with the option to **use custom ones** tailored to your target.
* A **daily validated list of resolvers** to ensure accuracy.
* Result **verification using manually curated trusted resolvers**.
* A **wildcard filter** takes care of false positives.
## Inputs
### Required
* **subdomains:** a list of subdomains
```
test.foo.bar.baz.example.com
dev.shop.example.com
```
### Optional
* **hostnames-per-level**l: the number of hostnames to brute-force at each level - a higher value will lead to more comprehensive results but also require more time and/or machines (default: 200)
* **level-2-wordlist**: a custom wordlist for level-2 enumeration `FUZZ.1.example.com`
```
prod
test
dev
```
* **level-3-wordlist**" a custom wordlist for level-3 enumeration `FUZZ.2.1.example.com`
```
api
web
ingress
```
* **level-4-wordlist**: a custom wordlist for level-4 (and higher) enumeration `FUZZ.3.2.1.example.com`
```
auth
admin
private
```
## Outputs
* **subdomains**: a list of found subdomains
```
prod.baz.example.com
api.dev.shop.example.com
admin.foo.bar.baz.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "prod.baz.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
{"hostname": "api.dev.shop.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
{"hostname": "admin.foo.bar.baz.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Improve wildcard filtering
# Enumerate Hostnames via Root Domain DNS Brute Force
Source: https://trickest.com/docs/library/modules/attack-surface-management/enumerate-hostnames-via-root-domain-dns-brute-force
Enumerate subdomains of a list of domains via DNS brute force
# Enumerate Hostnames via Root Domain DNS Brute Force
## Description
Enumerate subdomains of a list of domains via DNS brute force. The module uses an effective built-in subdomain enumeration wordlist and provides the option to provide a custom list tailored to your organization's naming conventions. For accuracy and reliability, it relies on a daily updated list of DNS resolvers and cross-checks findings with a curated set of trusted resolvers. Additionally, it includes a wildcard filter to weed out any false positives.
## Features
* **Built-in wordlist** with an option to **use a custom one** tailored to your target.
* A **daily validated list of resolvers** to ensure accuracy.
* Result **verification using manually curated trusted resolvers**.
* A **wildcard filter** takes care of false positives.
* Can enumerate **thousands of domains** simultaneously.
## Inputs
### Required
* **domains:** a list of domain names
```
example.com
```
### Optional
* **wordlist:** a custom subdomain enumeration wordlist
```
acme-admin
my-product
custom-name
```
### Outputs
* **subdomains**: a list of found subdomains
```
foo.example.com
bar.example.com
baz.example.com
```
* **subdomain-details:** JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "foo.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "root domain brute force"}
{"hostname": "bar.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "root domain brute force"}
{"hostname": "baz.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "root domain brute force"}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Improve wildcard filtering
# Fingerprint Network Services
Source: https://trickest.com/docs/library/modules/attack-surface-management/fingerprint-network-services
Identify services running on network ports
# Fingerprint Network Services
## Description
Identify and analyze services running on network ports. This module scans for various service types, collecting detailed metadata about each identified service.
## Features
* Identifies **different types of services** like SSH, FTP, MySQL, and more.
* Collects **metadata about the identified services**, including the protocol, banner, and products in use.
* Capable of processing **tens of thousands of hosts** simultaneously.
## Inputs
### Required
* **port-details**: JSONLines records of port discovery details from the "Scan for Open Ports" module
```
{"ip_address": "1.3.3.7", "port": 443, "hostname": "dashboard.example.com"}
{"ip_address": "1.2.3.4", "port": 21}
```
## Outputs
* **network-service-details**: JSONLines records of network service discovery details.
```
{"ip_address": "1.3.3.7", "port": 443, "protocol": "https", "hostname": "dashboard.example.com", "tls": true, "transport": "tcp", "version": "nginx", "banner": "302 Moved Temporarily", "products": ["Nginx"]}
{"ip_address": "1.2.3.4", "port": 21, "protocol": "ssh", "tls": false, "transport": "tcp", "banner": "SSH-2.0-Go\r\n"}
```
## Changelog
* v1.0
* Initial release
# Fingerprint Web Technologies
Source: https://trickest.com/docs/library/modules/attack-surface-management/fingerprint-web-technologies
Identify technologies running on a list of web servers
# Fingerprint Web Technologies
## Description
Identify technologies running on a list of web servers. This module identifies different types of web technologies, including web server software, content management systems (CMS), content delivery networks (CDN), web application firewalls (WAF), and more.
## Features
* Identifies **various types of web technologies**.
* Collects **metadata about the identified technologies**, including the version information and technology-specific locations (such as login panels).
* Capable of processing **tens of thousands of hosts** simultaneously.
## Inputs
### Required
* **web-serverss**: a list of web server URLs
```
https://blog.example.com
```
## Outputs
* **web-technologies**: JSONLines records of web technology discovery details.
```
{"asset": "https://blog.example.com", "technology": "WordPress", "location": "https://blog.example.com/wp-admin/install.php", "version": "6.5.3", "version_status": "outdated", "latest_version": "6.8.2"}
{"asset": "https://blog.example.com", "technology": "Bootstrap"}
{"asset": "https://blog.example.com", "technology": "Cloudflare WAF", "location": "https://blog.example.com/?jbsmfoey=%3Cscript%3Ealert%28%22XSS%22%29%3B%3C%2Fscript%3E&xtrsrvgz=UNION+SELECT+ALL+FROM+information_schema+AND+%27+or+SLEEP%285%29+or+%27&tqvgazak=..%2F..%2F..%2F..%2Fetc%2Fpasswd", "context": "Cloudflare Inc."}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Added `header` input
* v2.0.0
* Added detection of outdated technologies across common categories, including web servers (e.g. Apache HTTP Server), language runtimes (e.g. PHP), and frameworks (e.g. ASP.NET).
* When a version is successfully identified, it is added to the `version` field.
* If outdated version checks are supported for the detected technology:
* The latest known version is added to the `latest_version` field.
* If the detected version is outdated, `version_status` is set to `outdated`.
* If the detected version is current, `version_status` is set to `up_to_date`.
* If the version cannot be determined or the technology is not supported for version checking, `version_status` is set to `unknown`.
# Generate Custom DNS Wordlists
Source: https://trickest.com/docs/library/modules/attack-surface-management/generate-custom-dns-wordlists
Generate custom DNS brute force wordlists using known hostnames
# Generate Custom DNS Wordlists
## Description
Generate custom DNS brute force wordlists using known hostnames. This module creates wordlists suitable for both root and recursive DNS brute force that have a high likelihood of finding assets on your target domains by deriving the wordlists from existing keywords and naming conventions.
## Features
* Generates **custom wordlists** tailored to your target's unique keywords and naming conventions.
* Creates **different types of wordlists** for root and recursive brute force.
* Readily integrates with the **Enumerate Hostnames via Root Domain DNS Brute Force** and **Enumerate Hostnames via Recursive DNS Brute Force** modules.
## Inputs
### Required
* **hostnames**: a list of hostnames
```
foo.example.com
staging.foo.example.com
dashboard.staging.foo.example.com
2022.dashboard.staging.foo.example.com
```
## Outputs
* **level-1-wordlist**: Wordlist suitable for level-1 (root) DNS brute force, including all the keywords and combinations found in the hostnames.
```
example
foo
staging
dashboard
2022
staging.foo
dashboard.staging.foo
2022.dashboard.staging.foo
```
* **level-2-wordlist**: Wordlist suitable for level-2 DNS brute force
```
staging
```
* **level-3-wordlist**: Wordlist suitable for level-3 DNS brute force
```
dashboard
```
* **level-4-wordlist**: Wordlist suitable for level-4 DNS brute force
```
2022
```
## Changelog
* v1.0
* Initial release
# Probe for Web Servers
Source: https://trickest.com/docs/library/modules/attack-surface-management/probe-for-web-servers
Probe for web servers on a list of hostnames, IP addresses, or IP ranges
# Probe for Web Servers
## Description
Probe for web servers on several common HTTP ports and collect relevant details about each discovered server. This module checks a list of common HTTP ports and gathers information including HTML titles, redirects, content lengths, favicons, TLS data, and more. You can supply hostnames, IP addresses, or IP ranges.
## Features
* Enriches discovered hosts with **useful data to guide prioritization** and help identify patterns.
* Capable of processing **tens of thousands of hosts** simultaneously.
* Supports **hostnames, IP addresses, and IP ranges**.
* Probes the **most statistically likely ports** to have HTTP servers, balancing speed and thoroughness.
* Discovers **additional hostnames** associated with the target organization.
## Inputs
### Required
* **hosts**: a list of hostnames, IP addresses, or IP ranges
```
dashboard.example.com
1.2.3.4
5.6.7.8/24
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
## Outputs
* **web-servers**: List of web server URLs.
```
https://dashboard.example.com
http://1.2.3.4
http://5.6.7.10:8080
```
* **web-server-details**: JSONLines records of web server details.
```
{"timestamp":"2024-01-01T11:11:11.111111111Z","port":443,"url":"https://dashboard.example.com","input":"dashboard.example.com","scheme":"https","webserver":"cloudflare","method":"GET","host":"1.2.3.4","path":"/","favicon_path":"/favicon.ico","time":"133.7ms","a":["1.2.3.4","1.2.3.4"],"words":7331,"lines":1337,"status_code":200,"cdn":true,"cdn_name":"cloudflare","tls_host":"dashboard.example.com","tls_port":"443","tls_probe_status":true,"tls_version":"tls13","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_not_before":"2021-3-3T07:00:00Z","tls_not_after":"2027-3-3T07:00:00Z","tls_subject_dn":"CN=*.example.com, O=Example\\, Inc., L=San Francisco, ST=California, C=US","tls_subject_cn":"*.example.com","tls_subject_org":["Example, Inc."],"tls_subject_an":["*.example.com","example.com"],"tls_issuer_dn":"CN=Acme TLS RSA SHA256 2020 CA1, O=Acme Inc, C=US","tls_issuer_cn":"Acme TLS RSA SHA256 2020 CA1","tls_issuer_org":["Acme Inc"],"tls_fingerprint_hash_md5":"9ff41ab3d13b2386ad77fa0b1f058f4f","tls_fingerprint_hash_sha1":"9dc28cb216b46bee01eeaeb5d4ff5906bbba582b","tls_fingerprint_hash_sha256":"324db4e227d9b5fb5dc175d7b4bb984705b9f4ec07a36bfe2fd4df79a965961e","tls_wildcard_certificate":true,"tls_connection":"ctls","tls_sni":"dashboard.example.com","headers":["Cf-Cache-Status: DYNAMIC","Server: cloudflare"]}
```
* **subdomains**: List of discovered subdomains.
```
foo.example.com
bar.example.com
baz.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "foo.example.com", "domain_name": "example.com", "data_source": "http response", "context": "http redirecrt", "linked_asset": "http://1.2.3.4"}
{"hostname": "bar.example.com", "domain_name": "example.com", "data_source": "http response", "context": "content security policy (csp)", "linked_asset": "http://5.6.7.10:8080"}
{"hostname": "baz.example.com", "domain_name": "example.com", "data_source": "tls certificate", "context": "tls subject alternative name (san)", "linked_asset": "https://dashboard.example.com"}
```
* **potential-hostnames**: List of related hostnames outside the strict scope.
```
foo.example-internal.com
bar.example-subsidiary.com
baz.example-service-provider.net
```
* **potential-hostname-details**: JSONLines records of potential hostname discovery details.
```json theme={null}
{"hostname": "foo.example-internal.com", "domain_name": "example.com", "data_source": "http response", "context": "http redirecrt", "linked_asset": "http://1.2.3.4"}
{"hostname": "bar.example-subsidiary.com", "domain_name": "example.com", "data_source": "http response", "context": "content security policy (csp)", "linked_asset": "http://5.6.7.10:8080"}
{"hostname": "baz.example-service-provider.net", "domain_name": "example.com", "data_source": "tls certificate", "context": "tls subject alternative name (san)", "linked_asset": "https://dashboard.example.com"}
```
* **subdomain-wildcards**: List of discovered subdomain wildcards.
```
*.internal.example.com
```
* **subdomain-wildcard-details**: JSONLines records of subdomain wildcard discovery details.
```json theme={null}
{"hostname": "*.internal.example.com", "domain_name": "example.com", "data_source": "tls certificate", "context": "tls common name (cn)", "linked_asset": "https://dashboard.example.com"}
```
* **potential-hostname-wildcards**: List of related hostnames with wildcards outside the strict scope.
```
*.proxy.example-corp.com
```
* **potential-hostname-wildcard-details**: JSONLines records of potential hostname wildcard discovery details.
```json theme={null}
{"hostname": "*.proxy.example-corp.com", "domain_name": "example.com", "data_source": "tls certificate", "context": "tls common name (cn)", "linked_asset": "https://dashboard.example.com"}
```
**Note**: The `*-details` outputs may contain duplicates if a hostname was discovered through multiple sources.
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Improved handling of cases where a live web server redirects to a non-existent or unreachable host.
* Enhanced overall detection accuracy with a more advanced retry mechanism.
* Adjusted port scan logic to scan only ports 80 and 443 for hosts behind cloud WAFs or CDNs.
* Added filters to exclude responses with protocol mismatches.
* v1.1.1
* Preserve existing paths and queries from the input, if present.
* v1.1.2
* Added `header` and `header-file` inputs
# Scan for Open Ports
Source: https://trickest.com/docs/library/modules/attack-surface-management/scan-for-open-ports
Scan for the top 1000 most common open ports on a list of hostnames, IP addresses, or IP ranges
# Scan for Open Ports
## Description
Scan for the top 1000 most common open ports on a list of hostnames, IP addresses, or IP ranges.
## Features
* Outputs in **different formats to allow for both detailed queries and also integration** with other modules and tools.
* Capable of processing **tens of thousands of hosts** simultaneously.
* Supports **hostnames, IP addresses, and IP ranges**.
* Scans **all IP addresses** associated with a hostname.
## Inputs
### Required
* **hosts**: a list of hostnames, IP addresses, or IP ranges
```
dashboard.example.com
1.2.3.4
5.6.7.8/24
```
## Optional
* **port-threshold**: Exclude hosts with more than this number of open ports (default: 10)
* **ports**: Comma-separated list of ports to include in the scan
* **exclude-ports**: Comma-separated list of ports to exclude from the scan
## Outputs
* **port-details**: JSONLines records of port discovery details.
```
{"ip_address": "1.3.3.7", "port": 443, "hostname": "dashboard.example.com"}
{"ip_address": "1.2.3.4", "port": 80}
{"ip_address": "5.6.7.8", "port": 21}
```
* **hostname-ports**: List of open ports formatted as `hostname:port`
```
dashboard.example.com:443
```
* **ip-ports**: List of open ports formatted as `ip_address:port`
```
1.3.3.7:443
1.2.3.4:80
5.6.7.8:21
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Increase port threshold from 10 to 15
* v1.1.1
* Add `ports` and `exclude-ports` inputs to allow customization of scanned ports
# Content Discovery Modules
Source: https://trickest.com/docs/library/modules/content-discovery
Explore a collection of powerful and efficient modules in the Content Discovery category to enhance your workflows.
# Discover Paths via Crawling
Source: https://trickest.com/docs/library/modules/content-discovery/discover-paths-via-crawling
Crawl a list of web server URLs to discover endpoints and form a comprehensive map of each asset on your attack surface
# Discover Paths via Crawling
## Description
Crawl a list of web server URLs to discover endpoints and form a comprehensive map of each asset on your attack surface.
## Features
* Supports **headless browser crawling** for more accurate spidering.
* Parses **JavaScript code to discover additional endpoints** and hidden paths.
* Can crawl **thousands of web servers** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **depth**: Maximum crawling depth (default: 5)
* **headless**: Enable headless browser mode (default: false)
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **urls:** List of discovered URLs.
```
https://foo.example.com/about
https://foo.example.com/login
https://bar.example.com/app.js
https://bar.example.com/admin
```
* **url-details**: JSONLines records of URL discovery details.
```json theme={null}
{"url": "https://foo.example.com/about", "hostname": "foo.example.com", "domain_name": "example.com", "data_source": "crawling", "status_code": 200, "content_length": 9283}
{"url": "https://foo.example.com/login", "hostname": "foo.example.com", "domain_name": "example.com", "data_source": "crawling", "status_code": 200, "content_length": 2031}
{"url": "https://bar.example.com/app.js", "hostname": "bar.example.com", "domain_name": "example.com", "data_source": "crawling", "status_code": 200, "content_length": 4212}
{"url": "https://bar.example.com/admin", "hostname": "bar.example.com", "domain_name": "example.com", "data_source": "crawling", "status_code": 403, "content_length": 385}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.2.0
* Support exporting non-GET requests to the `url-details` output
* Automatically extract forms and fetch requests from crawled pages
* Submit POST requests using sample data
* Extend `url-details` format to support `method`, `body`, `body_parameters`, and `query_parameters` fields
# Discover Paths via Directory Brute Force
Source: https://trickest.com/docs/library/modules/content-discovery/discover-paths-via-directory-brute-force
Brute force a list of web server URLs to discover hidden paths and endpoints
# Discover Paths via Directory Brute Force
## Description
Brute force a list of web server URLs to discover hidden paths and endpoints.
## Features
* Includes **heuristic filtering to reduce false positives** from masked 404 pages.
* **Built-in wordlist** with an option to **use a custom one** tailored to your target.
* Can brute force **thousands of web servers** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **wordlist:** a custom directory brute force wordlist
```
admin
login
signup
```
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **urls:** List of discovered URLs.
```
https://foo.example.com/login
https://bar.example.com/admin
https://bar.example.com/signup
```
* **url-details**: JSONLines records of URL discovery details.
```json theme={null}
{"url": "https://foo.example.com/login", "hostname": "foo.example.com", "domain_name": "example.com", "data_source": "directory_brute_force", "status_code": 200, "content_length": 2031}
{"url": "https://bar.example.com/admin", "hostname": "bar.example.com", "domain_name": "example.com", "data_source": "directory_brute_force", "status_code": 200, "content_length": 4212}
{"url": "https://bar.example.com/signup", "hostname": "bar.example.com", "domain_name": "example.com", "data_source": "directory_brute_force", "status_code": 403, "content_length": 385}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Improved the filtering algorithm to reduce false positives by 50% to 80%
* v1.2.0
* Added support for using multiple wordlists in a single run
* Defaulted to URL-encoding space characters in wordlists
* v1.3.0
* Added `header-file` input
* v1.3.1
* Extend `url-details` format to support `body`, `body_parameters`, and `query_parameters` fields
# Discover Paths via OSINT Sources
Source: https://trickest.com/docs/library/modules/content-discovery/discover-paths-via-osint-sources
Search OSINT sources for a list of hosts to discover hidden paths and endpoints
# Discover Paths via OSINT Sources
## Description
Search OSINT sources for a list of hosts to discover hidden paths and endpoints.
## Features
* **Aggregates URLs from multiple OSINT sources**, combining historical and recent data.
* **Cleans and normalizes URLs** to consolidate semantic duplicates and ensure consistent formatting.
* Can process **thousands of hosts** simulataneously.
## Inputs
### Required
* **hosts**: A list of hostnames for which URLs are to be discovered
```
foo.example.com
bar.example.net
```
## Outputs
* **urls:** List of discovered URLs.
```
https://foo.example.com/login
https://bar.example.net/admin
https://bar.example.net/signup
```
* **url-details**: JSONLines records of URL discovery details.
```json theme={null}
{"url": "https://foo.example.com/login", "hostname": "foo.example.com", "domain_name": "example.com", "data_source": "osint source"}
{"url": "https://bar.example.net/admin", "hostname": "bar.example.net", "domain_name": "example.com", "data_source": "osint source",}
{"url": "https://bar.example.net/signup", "hostname": "bar.example.net", "domain_name": "example.com", "data_source": "osint source"}
```
## Changelog
* v1.0.0
* Initial release
# Utilities Modules
Source: https://trickest.com/docs/library/modules/utilities
Explore a collection of powerful and efficient modules in the Utilities category to enhance your workflows.
# Generate Scan Report
Source: https://trickest.com/docs/library/modules/utilities/generate-scan-report
Aggregates diverse data types from various modules into a consolidated, easy-to-review report
# Generate Scan Report
## Description
Aggregates diverse data types from various modules into a consolidated, easy-to-review report.
## Features
* Summarizes findings and provides breakdowns of the collected data.
* Creates a screenshot gallery of captured URLs for visual reference.
* Allows searching and filtering of URLs by full URL, body parameters, and discovery source.
* Supports multiple data types, including:
* Vulnerability findings
* Network services
* Web servers
* Web technologies
* DNS records
* WHOIS records
* URLs
* Screenshots
* JavaScript code
* Application sitemap
## Inputs
### Optional
* **findings**: JSONLines records of finding details.
```json theme={null}
{"finding": "SQL Injection", "location": "http://example.com/search.php?test=", "severity": "high", "hostname": "example.com", "domain_name": "example.com", "field": "test", "attack": "query' AND (SELECT * FROM (SELECT(SLEEP(5)))lzuk) AND 'nrTr'='nrTr", "method": "GET", "request": "GET http://example.com/search.php?test=query%27+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29lzuk%29+AND+%27nrTr%27%3D%27nrTr HTTP/1.1\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-US,en;q=0.9\r\nconnection: Close\r\nhost: example.com\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\r\n\r\n"}
```
* **port-details**: JSONLines records of port discovery details.
```json theme={null}
{"ip_address": "1.2.3.4", "port": 80}
```
* **network-service-details**: JSONLines records of network service discovery details.
```json theme={null}
{"ip_address": "5.6.7.8", "port": 21, "protocol": "ssh", "tls": false, "transport": "tcp", "banner": "SSH-2.0-Go\r\n"}
```
* **web-server-details**: JSONLines records of web server details.
```json theme={null}
{"timestamp":"2024-01-01T11:11:11.111111111Z","port":443,"url":"https://dashboard.example.com","input":"dashboard.example.com","scheme":"https","webserver":"cloudflare","method":"GET","host":"1.2.3.4","path":"/","favicon_path":"/favicon.ico","time":"133.7ms","a":["1.2.3.4","1.2.3.4"],"words":7331,"lines":1337,"status_code":200,"cdn":true,"cdn_name":"cloudflare","tls_host":"dashboard.example.com","tls_port":"443","tls_probe_status":true,"tls_version":"tls13","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_not_before":"2021-3-3T07:00:00Z","tls_not_after":"2027-3-3T07:00:00Z","tls_subject_dn":"CN=*.example.com, O=Example\\, Inc., L=San Francisco, ST=California, C=US","tls_subject_cn":"*.example.com","tls_subject_org":["Example, Inc."],"tls_subject_an":["*.example.com","example.com"],"tls_issuer_dn":"CN=Acme TLS RSA SHA256 2020 CA1, O=Acme Inc, C=US","tls_issuer_cn":"Acme TLS RSA SHA256 2020 CA1","tls_issuer_org":["Acme Inc"],"tls_fingerprint_hash_md5":"9ff41ab3d13b2386ad77fa0b1f058f4f","tls_fingerprint_hash_sha1":"9dc28cb216b46bee01eeaeb5d4ff5906bbba582b","tls_fingerprint_hash_sha256":"324db4e227d9b5fb5dc175d7b4bb984705b9f4ec07a36bfe2fd4df79a965961e","tls_wildcard_certificate":true,"tls_connection":"ctls","tls_sni":"dashboard.example.com","headers":["Cf-Cache-Status: DYNAMIC","Server: cloudflare"]}
```
* **web-technologies**: JSONLines records of web technology discovery details.
```json theme={null}
{"asset": "https://blog.example.com", "technology": "WordPress", "location": "https://blog.example.com/wp-admin/install.php", "context": "6.5.3"}
```
* **dns-records**: JSONLines DNS records.
```json theme={null}
{"host": "dashboard.example.com", "response_code": "NOERROR", "record_type": "a", "value": "1.2.3.4", "ttl": 900}
```
* **whois-records**: JSONLines WHOIS records for domains and IP addresses.
```json theme={null}
{"query":"vulnweb.com","Domain Name":["vulnweb.com"],"Registrar":["Eurodns S.A."],"Creation Date":["2010-06-14T00:00:00Z"],"Registrar Registration Expiration Date":["2026-06-13T00:00:00Z"],"Updated Date":["2025-05-21T15:16:31Z"],"Domain Status":["clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited"],"Name Server":["ns1.eurodns.com","ns2.eurodns.com"],"DNSSEC":["unsigned"]}
{"query":"44.228.249.3","NetRange":["44.224.0.0 - 44.255.255.255"],"CIDR":["44.224.0.0/11"],"Organization":["Amazon.com, Inc. (AMAZO-47)"],"NetName":["AMAZO-ZPDX"],"Country":["US"],"City":["Seattle"],"StateProv":["WA"],"OrgAbuseEmail":["trustandsafety@support.aws.com"]}
```
* **url-details**: JSONLines records of URL discovery details.
```json theme={null}
{"url": "https://foo.example.com/login", "hostname": "foo.example.com", "domain_name": "example.com", "data_source": "directory_brute_force", "status_code": 200, "content_length": 2031}
```
* **screenshots**: Folder containing screenshots of the URLs. The screenshots are named after the `url-details` URL they are associated with, e.g. `https-foo.example.com-443-login.png`.
* **javascript-code**: Folder containing JavaScript code.
* **sitemap**: Application sitemap export file.
## Outputs
* **html-zip**: A ZIP archive containing an HTML report.
* The main entry point is `./index.html`
* The screenshot gallery is located at `./screenshots.html`
* The sitemap is at `./sitemap`
* The JavaScript code is in the `./javascript` directory
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Add click-to-copy functionality for finding descriptions
* v1.0.2
* Add `Outdated` tag to outdated technologies and show version comparisons
# Vulnerability Scanning Modules
Source: https://trickest.com/docs/library/modules/vulnerability-scanning
Explore a collection of powerful and efficient modules in the Vulnerability Scanning category to enhance your workflows.
# Analyze JavaScript Code
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/analyze-javascript-code
Identify vulnerabilities, collect useful data, and prepare JavaScript code for manual review
# Analyze JavaScript Code
## Description
Retrieve JavaScript code from a list of URLs while preserving its original location structure. When available, extract sourcemaps to obtain non-minified code, then beautify and deobfuscate all code. Analyze the code to discover hidden endpoints, generate custom path and parameter brute-force wordlists based on script content, and scan for vulnerabilities by identifying outdated dependencies, insecure code patterns, and exposed secrets.
## Features
* **Prepares code for manual review** by downloading all files to a single location, extracting sourcemaps when available to obtain original, non-minified code.
* Simplifies code review by **beautifying and deobfuscating code**, and applying transformations such as unpacking arrays and removing redundant proxy functions.
* Extracts **hidden endpoints** and paths from the code, including parameters and request methods.
* Generates a **custom wordlist for path discovery** based on identified endpoints.
* Creates a **custom wordlist for parameter discovery** using found endpoints and variable names.
* Checks for **outdated dependencies** and identifies associated CVEs when available.
* Scans for a wide range of **exposed secrets**.
* Analyzes code for **insecure patterns and client-side vulnerabilities**.
## Inputs
### Required
* **urls:** List of JavaScript code URLs (non-JS URLs will be automatically filtered out)
```
https://example.com/script.js
https://cdn.example.com/assets/app.min.js
https://another-example.com/js/main.js
```
## Outputs
* **findings**: JSONLines records of finding details
```json theme={null}
{"finding": "Potential exposed secret: URI","location": "https://cdn.example.com/assets/app.min.js","severity": "unknown","hostname": "cdn.example.com","domain_name": "example.com","method": "GET","matches": ["http://admin:password@example.com"]}
{"finding": "Outdated JavaScript component: jquery 2.2.3","location": "https://example.com/script.js","severity": "medium","hostname": "example.com","domain_name": "example.com","method": "GET","matches": ["CVE-2015-9251","CVE-2019-11358","CVE-2020-11023","CVE-2020-11022"]}
{"finding": "DOM Based XSS","location": "https://another-example.com/js/main.js","severity": "medium","description": "Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default= which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.","hostname": "another-example.com","domain_name": "another-example.com","method": "GET","matches": ["line 27"]}
```
* **endpoints**: JSONLines records of endpoint details, including parameters and request methods
```json theme={null}
{"url": "/api/login", "query_parameter": "", "body_parameter": "username", "method": "POST", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/api/login", "query_parameter": "", "body_parameter": "password", "method": "POST", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/api/users", "query_parameter": "id", "body_parameter": "", "method": "GET", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/Dashboard", "query_parameter": "", "body_parameter": "", "method": "", "source_files": ["https://another-example.com/js/main.js"]}
```
* **path-wordlist**: List of possible paths derived from identified endpoints
```
api/login/
api/users
Dashboard
```
* **parameter-wordlist**: List of possible parameters derived from identified endpoints and variable names within the code
```
username
password
id
url
role
```
* **code**: Folder containing the downloaded and analyzed code, with files beautified, deobfuscated, simplified, and sourcemaps resolved where available.
```
code/
├── example.com/
│ └── app.js # Original source from resolved sourcemap
├── cdn.example.com/
│ ├── script.js # Beautified and deobfuscated version of the original minified script
└── another-example.com/
└── main.js
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Added `header` input
* v1.0.2
* Improved source map handling for locations that have no corresponding content available
* v2.0.0
* Update `endpoints` output format to be compatible with the `url-details` format
* Add `in-scope` and `out-of-scope` inputs for filtering extracted endpoints
# Fuzz Web Applications for Vulnerabilities
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/fuzz-web-applications-for-vulnerabilities
Scan for vulnerabilities in web applications actively by crawling the app and fuzzing inputs
# Fuzz Web Applications for Vulnerabilities
## Description
Scan for vulnerabilities in web applications actively by crawling the app, fuzzing inputs, and reporting insecure behaviors and potential security flaws.
## Features
* Scans for a wide range of vulnerabilities by **actively injecting payloads and analyzing responses**.
* Crawls the web application before and after payload injection to **discover endpoints and detect stored vulnerabilities**.
* Automatically **switches to headless browser crawling** when necessary.
* Can scan **thousands of web applications** simultaneously.
## Inputs
### Required
* **urls:** List of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **exclude-urls**: List of URLs, paths, or regular expressions to exclude from scanning
```
https://foo.example.com/profiles?id=.*
/admin
```
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Cross Site Scripting (Reflected)", "location": "https://foo.example.com/products?category=%0A%0D%0A%0D%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E", "hostname": "foo.example.com", "domain_name": "example.com", "severity": "high", "method": "GET", "field": "category", "attack": "\n\r\n\r", "description": "Cross-site Scripting (XSS) is an attack technique that involves echoing attacker-supplied code into a user's browser instance. A browser instance can be a standard web browser client, or a browser object embedded in a software product such as the browser within WinAmp, an RSS reader, or an email client. The code itself is usually written in HTML/JavaScript, but may also extend to VBScript, ActiveX, Java, Flash, or any other browser-supported technology.When an attacker gets a user's browser to execute his/her code, the code will run within the security context (or zone) of the hosting web site. With this level of privilege, the code has the ability to read, modify and transmit any sensitive data accessible by the browser. A Cross-site Scripted user could have his/her account hijacked (cookie theft), their browser redirected to another location, or possibly shown fraudulent content delivered by the web site they are visiting. Cross-site Scripting attacks essentially compromise the trust relationship between a user and the web site. Applications utilizing browser object instances which load content from the file system may execute code under the local machine zone allowing for system compromise.There are three types of Cross-site Scripting attacks: non-persistent, persistent and DOM-based.Non-persistent attacks and DOM-based attacks require a user to either visit a specially crafted link laced with malicious code, or visit a malicious web page containing a web form, which when posted to the vulnerable site, will mount the attack. Using a malicious form will oftentimes take place when the vulnerable resource only accepts HTTP POST requests. In such a case, the form can be submitted automatically, without the victim's knowledge (e.g. by using JavaScript). Upon clicking on the malicious link or submitting the malicious form, the XSS payload will get echoed back and will get interpreted by the user's browser and execute. Another technique to send almost arbitrary requests (GET and POST) is by using an embedded client, such as Adobe Flash.Persistent attacks occur when the malicious code is submitted to a web site where it's stored for a period of time. Examples of an attacker's favorite targets often include message board posts, web mail messages, and web chat software. The unsuspecting user is not required to interact with any additional site/link (e.g. an attacker site or a malicious link sent via email), just simply view the web page containing the code.", "matches": [""]}
{"finding": "Vulnerable JS Library", "location": "https://bar.example.com/resources/js/angular_1-7-7.js", "hostname": "bar.example.com", "domain_name": "example.com", "severity": "medium", "method": "GET", "description": "CVE-2023-26116\nCVE-2022-25869\nCVE-2022-25844\nCVE-2024-21490\nCVE-2020-7676\nCVE-2023-26117\nCVE-2019-10768\nCVE-2023-26118\n", "matches": ["/*\n AngularJS v1.7.7"]}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Improved the finding `description` field to include more relevant information.
* Resolved an issue where a scan rule for detecting proxy misconfigurations was generating false positives.
* v1.2.0
* Added `header-file` input
* v2.0.0
* Added automatic validation for SQL injection vulnerabilities using single-threaded, high-accuracy checks
* Added detection of file upload forms as informational findings
* Improved headless crawling to better support JavaScript-heavy dynamic applications
* Added `url-details` input to allow passing non-GET endpoints with custom bodies; enables integration with the `Analyze JavaScript Code` module
* Added `sitemap` output to export the dynamically accessed sitemap in a format compatible with `ZAP Messages`
# Scan for Exposed Admin Panels
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-exposed-admin-panels
Scan for web administrative panels that may provide an entry point to an asset, and check them for default credentials
# Scan for Exposed Admin Panels
## Description
Scan for web administrative panels that may provide an entry point to an asset, and check them for default credentials.
## Features
* Scans for a **wide range of admin panel paths across various stacks**.
* Checks for **default credentials** on a subset of found panels.
* Can scan **thousands of web servers** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Pulse Secure VPN Login Panel", "location": "https://foo.example.com/dana-na/auth/url_default/welcome.cgi", "severity": "info", "hostname": "foo.example.com", "domain_name": "example.com", "ip_address": "1.2.3.4", "method": "GET", "description": "Pulse Secure VPN login panel was detected."}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
* v1.3.0
* Added checks for admin panels located at custom paths
* v1.3.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
# Scan for Exposed Backups
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-exposed-backups
Scan for exposed backup files that may leak sensitive information
# Scan for Exposed Backups
## Description
Scan for exposed backup files that may leak sensitive information, including source code, database backups, and application logs.
## Features
* Generates **custom wordlists** dynamically based on the hostname.
* Runs heuristic analysis on brute force results to **minimize false positives**.
* Can scan **thousands of web servers** simultaneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Exposed Backup File", "location": "https://foo.example.com/foo.zip", "severity": "unknown", "hostname": "foo.example.com", "domain_name": "example.com", "method": "GET", "description": "A backup file with a size of 123.4MB was detected, which may expose source code, configuration files, or other sensitive information"}
{"finding": "Exposed Backup File", "location": "https://bar.example.com/www.sql.tar.gz", "severity": "unknown", "hostname": "bar.example.com", "domain_name": "example.com", "method": "GET", "description": "A backup file with a size of 567.8MB was detected, which may expose source code, configuration files, or other sensitive information"}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Fixed a bug that caused false positives where some `text/plain` responses were incorrectly identified as exposed backups.
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
# Scan for Exposed Secrets
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-exposed-secrets
Scan HTTP responses for exposed tokens, credentials, and other sensitive information
# Scan for Exposed Secrets
## Description
Scan HTTP responses for exposed tokens, credentials, and other sensitive information.
## Features
* Scans for a **wide range of secret patterns**.
* Reuses HTTP responses across searches to **minimize outgoing requests**.
* Can scan **thousands of URLs** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
https://bar.example.com/app
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "GitHub Personal Access Token", "location": "https://foo.example.com", "severity": "info", "hostname": "foo.example.com", "domain_name": "example.com", "ip_address": "1.2.3.4", "method": "GET", "matches": ["ghp_DUMMY1234567890abcdefghijklmnopqrstuvw"]}
{"finding": "OpenAI API Key", "location": "https://bar.example.com/app", "severity": "info", "hostname": "bar.example.com", "domain_name": "example.com", "ip_address": "5.6.7.8", "method": "GET", "matches": ["sk-DUMMY1234567890abcdefghijklmnopqrstuvw"]}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
* v1.2.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
# Scan for Misconfigured Software
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-misconfigured-software
Scan for web misconfigurations that can expose sensitive functionality
# Scan for Misconfigured Software
## Description
Scan for web misconfigurations that range from disclosing information and exposing sensitive functionality to enabling complete takeover of an asset
## Features
* Scans for a **wide range of misconfiguration scenarios**.
* Validates the server responses to **minimize false positives**.
* Can scan **thousands of web servers** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
https://bar.example.com/app
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Uninitialized GitLab instances", "location": "https://foo.example.com/users/sign_in", "severity": "high", "hostname": "foo.example.com", "domain_name": "example.com", "ip_address": "1.2.3.4", "method": "GET", "description": "Prior to version 14, GitLab installations required a root password to be set via the web UI. If the administrator skipped this step, any visitor could set a password and control the instance."}
{"finding": "Public Swagger API", "location": "https://bar.example.com/app/docs", "severity": "info", "hostname": "bar.example.com", "domain_name": "example.com", "ip_address": "5.6.7.8", "method": "GET", "description": "Public Swagger API was detected."}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Added `Basic Auth` to the list of flagged configurations with a severity level of `info`
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
* v1.2.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
# Scan for Outdated Software
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-outdated-software
Scan for outdated software with known publicly exploitable vulnerabilities from the CVE and CNVD databases
# Scan for Outdated Software
## Description
Scan for outdated software with known publicly exploitable vulnerabilities from the CVE and CNVD databases.
## Features
* Checks for **vulnerable software listed in the CVE and CNVD databases**.
* Uses proof-of-concept (PoC) scanning to highlight only exploitable vulnerabilities and **minimize false positives**.
* Can scan **thousands of web servers** simultaneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "WordPress HTML5 Video Player - SQL Injection", "location": "https://foo.example.com/?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+-", "severity": "critical", "hostname": "foo.example.com", "domain_name": "example.com", "method": "GET", "description": "WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks"}
{"finding": "Citrix Gateway and Citrix ADC - Cross-Site Scripting", "location": "https://bar.example.com/oauth/idp/logout?post_logout_redirect_uri=%0d%0a%0d%0a", "severity": "medium", "hostname": "bar.example.com", "domain_name": "example.com", "method": "GET", "description": "Citrix ADC and Citrix Gateway versions before 13.1 and 13.1-45.61, 13.0 and 13.0-90.11, 12.1 and 12.1-65.35 contain a cross-site scripting vulnerability due to improper input validation."}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
* v1.2.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
* v1.2.2
* Accuracy improvements
# Scan for Sensitive Files
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-sensitive-files
Scan for exposed sensitive files that may leak sensitive information
# Scan for Sensitive Files
## Description
Scan for exposed files that may leak sensitive information, including logs, configuration files, and development artifacts.
## Features
* Scans for a **wide range of sensitive files**.
* Validates the content to **minimize false positives**.
* Can scan **thousands of web servers** simulataneously.
## Inputs
### Required
* **urls:** a list of URLs
```
https://foo.example.com
https://bar.example.com
https://bar.example.com/app
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Git Configuration", "location": "https://foo.example.com/.git/config", "severity": "medium", "hostname": "foo.example.com", "domain_name": "example.com", "ip_address": "1.2.3.4", "method": "GET", "description": "Git configuration was detected via the pattern /.git/config and log file on passed URLs"}
{"finding": "AWS Credentials", "location": "https://bar.example.com/app/.aws/credentials", "severity": "high", "hostname": "bar.example.com", "domain_name": "example.com", "ip_address": "5.6.7.8", "method": "GET", "description": "AWS credentials found via /.aws/credentials endpoint"}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.2.0
* Added recursive scanning to detect vulnerabilities at every level of the input URL paths
* v1.2.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
# Scan for Technology-Specific Vulnerabilities
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-for-technology-specific-vulnerabilities
Scan the identified technologies on your attack surface using tailored checks and methodologies for each
# Scan for Technology-Specific Vulnerabilities
## Description
Scan the identified technologies on your attack surface using tailored checks and methodologies for each. The currently supported technologies are:
* WordPress
* Microsoft IIS
* Ivanti Pulse Secure
* Joomla
* GitLab
* Jenkins
* Spring Boot
* Jira
* Splunk
* WebLogic
## Features
* Performs **custom checks based on the identified technologies** for a more targeted scan.
* Detects **related components and extensions**, such as WordPress plugins and themes.
* Can scan thousands of web servers simultaneously.
## Inputs
### Required
* **web-technologies:** JSONLines records of web technology discovery details from the "Fingerprint Web Technologies" module.
```
{"asset": "https://foo.example.com", "technology": "WordPress"}
{"asset": "https://bar.example.com", "technology": "Microsoft IIS"}
{"asset": "https://baz.example.com", "technology": "Springboot Actuators"}
```
### Optional
* **header**: Header(s) to include in HTTP requests
* **header-file**: File with header(s) to include in HTTP requests
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "Outdated WordPress Plugin", "location": "https://foo.example.com", "severity": "unknown", "hostname": "foo.example.com", "domain_name": "example.com", "method": "GET", "description": "Detected WordPress plugin \"elementor\" version 3.6.2"}
{"finding": "IIS Short File Name Enumeration", "location": "https://bar.example.com", "severity": "unknown", "hostname": "bar.example.com", "domain_name": "example.com", "method": "GET", "description": "The IIS server is vulnerable to an issue that reveals short names for files and directories using the 8.3 file naming scheme. By sending specially crafted requests containing the tilde \"~\" character, attackers can exploit this flaw to discover hidden files or directories, potentially exposing sensitive information"}
{"finding": "Spring Boot Actuators (Jolokia) XXE", "location": "https://baz.example.com/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml", "hostname": "baz.example.com", "domain_name": "example.com", "severity": "high", "method": "GET", "description": "A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities (XXE) attack and include content stored on a remote server as if it was its own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive information from the target machine."}
```
* **web-technologies:** JSONLines records of web component discovery details.
```json theme={null}
{"asset": "https://foo.example.com", "technology": "elementor WordPress plugin", "location": "https://foo.example.com/wp-content/plugins/elementor/", "context": "3.6.2"}
```
## Changelog
* v1.0.0
* Initial release
* v1.1.0
* Added `header-file` input
* v1.1.1
* Included the HTTP request that triggered each finding in the `request` field of the `findings` output
# Scan Network Services for Misconfigurations
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-network-services-for-misconfigurations
Scan for network service misconfigurations that range from disclosing information and exposing sensitive functionality to enabling complete
# Scan Network Services for Misconfigurations
## Description
Scan for network service misconfigurations that range from disclosing information and exposing sensitive functionality to enabling complete takeover of an asset.
## Features
* Scans for a **wide range of misconfiguration scenarios**.
* Supports **various network protocols**.
* Can scan **thousands of web servers** simulataneously.
## Inputs
### Required
* **port-details:** JSONLines records of port or network service discovery details from the "Scan for Open Ports" or "Fingerprint Network Services" modules.
```json theme={null}
{"hostname": "foo.example.com", "ip_address": "1.2.3.4", "port": 21, "protocol": "ftp", "tls": false, "transport": "tcp", "banner": "220 (vsFTPd 3.0.5)\r\n"}
{"hostname": "bar.example.com", "ip_address": "5.6.7.8", "port": 22, "protocol": "ssh", "tls": false, "transport": "tcp", "banner": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.4\r\n"}
```
### Optional
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "FTP Anonymous Login", "location": "1.2.3.4:21", "severity": "medium", "ip_address": "1.2.3.4", "hostname": "foo.example.com", "domain_name": "example.com", "description": "Anonymous FTP access allows anyone to access your public_ftp folder, allowing unidentified visitors to download (and possibly upload) files on your website. Anonymous FTP creates the potential for a security hole for hackers and is not recommended."}
{"finding": "SSH Password-based Authentication", "location": "5.6.7.8:22", "severity": "info", "ip_address": "5.6.7.8", "hostname": "bar.example.com", "domain_name": "example.com"}
```
## Changelog
* v1.0
* Initial release
# Scan Network Services for Weak Credentials
Source: https://trickest.com/docs/library/modules/vulnerability-scanning/scan-network-services-for-weak-credentials
Scan the identified network services on your attack surface for weak credentials
# Scan Network Services for Weak Credentials
## Description
Scan the identified network services on your attack surface for weak credentials. The currently supported protocol are:
* SSH
* FTP
* MySQL
* PostgreSQL
* Microsoft SQL Server
## Features
* Supports **various network protocols**
* Offers **customizable wordlists** for using custom dictionaries and executing password spraying attacks.
* Can scan **thousands of web servers** simulataneously.
## Inputs
### Required
* **port-details:** JSONLines records of port or network service discovery details from the "Scan for Open Ports" or "Fingerprint Network Services" modules.
```json theme={null}
{"hostname": "foo.example.com", "ip_address": "1.2.3.4", "port": 21, "protocol": "ftp", "tls": false, "transport": "tcp", "banner": "220 (vsFTPd 3.0.5)\r\n"}
{"hostname": "bar.example.com", "ip_address": "5.6.7.8", "port": 3306, "protocol": "mysql", "tls": false, "transport": "tcp", "version": "8.0.39-0ubuntu0.24.04.1"}
```
### Optional
* **rate-limit**: Maximum number of requests to send per second per machine (default: 300)
### Outputs
* **findings:** JSONLines records of finding details.
```json theme={null}
{"finding": "FTP Weak Credentials", "location": "159.223.96.85:21", "severity": "high", "ip_address": "1.2.3.4", "hostname": "foo.example.com", "domain_name": "example.com", "matches": ["ftp:ftp123"]}
{"finding": "MySQL Weak Credentials", "location": "5.6.7.8:3306", "hostname": "bar.example.com", "domain_name": "example.com", "severity": "high", "ip_address": "5.6.7.8", "matches": ["root:mysql123"]}
```
## Changelog
* v1.0
* Initial release
# Network Tools
Source: https://trickest.com/docs/library/network/tools
Explore a collection of powerful and efficient tools in the Network category to enhance your productivity and security.
# asnmap
Source: https://trickest.com/docs/library/network/tools/asnmap
Go CLI for quickly mapping organization network ranges using ASN information.
# decant
Source: https://trickest.com/docs/library/network/tools/decant
Decant can be used to expand CIDR ranges into a list of IP addresses easily.
# dnsvalidator
Source: https://trickest.com/docs/library/network/tools/dnsvalidator
Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.
# dnsvalidator-patch
Source: https://trickest.com/docs/library/network/tools/dnsvalidator-patch
Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.
# evilscan
Source: https://trickest.com/docs/library/network/tools/evilscan
Nodejs Simple Network Scanner
# fingerprintx
Source: https://trickest.com/docs/library/network/tools/fingerprintx
Standalone utility for service discovery on open ports.
# get-asn-prefixes
Source: https://trickest.com/docs/library/network/tools/get-asn-prefixes
Get prefixes by asn.
# httprobe
Source: https://trickest.com/docs/library/network/tools/httprobe
Take a list of domains and probe for working http and https servers.
# httpx
Source: https://trickest.com/docs/library/network/tools/httpx
Httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads
# ipinfo
Source: https://trickest.com/docs/library/network/tools/ipinfo
Command Line Interface for the IPinfo API (IP geolocation and other types of IP data)
# mapcidr
Source: https://trickest.com/docs/library/network/tools/mapcidr
Perform multiple operations for a given subnet/CIDR ranges.
# masscan
Source: https://trickest.com/docs/library/network/tools/masscan
This is an Internet-scale port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.
# masscan-json
Source: https://trickest.com/docs/library/network/tools/masscan-json
This is an Internet-scale port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.
# naabu
Source: https://trickest.com/docs/library/network/tools/naabu
Naabu is a port scanning tool written in Go that allows you to enumerate valid ports for hosts in a fast and reliable manner. It is a really simple tool that does fast SYN scans on the host/list of hosts and lists all ports that return a reply.
# nscan
Source: https://trickest.com/docs/library/network/tools/nscan
Nscan is a fast Network scanner optimized for internet-wide scanning purposes and inspired by Masscan and Zmap. It has it's own tiny TCP/IP stack and uses Raw sockets to send TCP SYN probes. It doesn't need to set SYN Cookies so it doesn't wastes time checking if a received packet is a result of it's own scan, that makes Nscan faster than other similar scanners.
# prips
Source: https://trickest.com/docs/library/network/tools/prips
tool that prints the IP addresses in a given range
# rustscan
Source: https://trickest.com/docs/library/network/tools/rustscan
The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).
# rustscan-loop
Source: https://trickest.com/docs/library/network/tools/rustscan-loop
The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).
# uncover
Source: https://trickest.com/docs/library/network/tools/uncover
Quickly discover exposed hosts on the internet using multiple search engines.
# zmap
Source: https://trickest.com/docs/library/network/tools/zmap
ZMap is a fast single packet network scanner designed for Internet-wide network surveys.
# OSINT Tools
Source: https://trickest.com/docs/library/osint/tools
Explore a collection of powerful and efficient tools in the OSINT category to enhance your productivity and security.
# dnsdumpster-dns-lookup
Source: https://trickest.com/docs/library/osint/tools/dnsdumpster-dns-lookup
Look up DNS records on DNSDumpster
# dnsdumpster-host-search
Source: https://trickest.com/docs/library/osint/tools/dnsdumpster-host-search
Look up a host on DNSDumpster
# dnstwist
Source: https://trickest.com/docs/library/osint/tools/dnstwist
See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence.
# enumerepo
Source: https://trickest.com/docs/library/osint/tools/enumerepo
List all public repositories for (valid) Github usernames
# infoga
Source: https://trickest.com/docs/library/osint/tools/infoga
Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source (search engines, pgp key servers and shodan) and check if emails was leaked using haveibeenpwned.com API.
# maigret
Source: https://trickest.com/docs/library/osint/tools/maigret
Collect a dossier on a person by username from thousands of sites
# pymeta
Source: https://trickest.com/docs/library/osint/tools/pymeta
Search the web for files on a domain to download and extract metadata. This technique can be used to identify: domains, usernames, software/version numbers and naming conventions.
# shodan-download
Source: https://trickest.com/docs/library/osint/tools/shodan-download
Download json.gz data from shodan.
# shodan-python
Source: https://trickest.com/docs/library/osint/tools/shodan-python
Shodan is a search engine for Internet-connected devices. Google lets you search for websites, Shodan lets you search for devices.
# socialscan
Source: https://trickest.com/docs/library/osint/tools/socialscan
Socialscan offers accurate and fast checks for email address and username usage on online platforms. Given an email or username, socialscan returns whether it is available, taken or invalid on online platforms.
# Passwords Tools
Source: https://trickest.com/docs/library/passwords/tools
Explore a collection of powerful and efficient tools in the Passwords category to enhance your productivity and security.
# hydra
Source: https://trickest.com/docs/library/passwords/tools/hydra
Parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.
# phpmyadmin-auth-bruteforce
Source: https://trickest.com/docs/library/passwords/tools/phpmyadmin-auth-bruteforce
phpmyadmin-authentication-bruteforce is a tool designed to brute-force PHPMyAdmin authentification
# pydictor
Source: https://trickest.com/docs/library/passwords/tools/pydictor
pydictor - A powerful and useful hacker dictionary builder for a brute-force attack
# Recon Tools
Source: https://trickest.com/docs/library/recon/tools
Explore a collection of powerful and efficient tools in the Recon category to enhance your productivity and security.
# aiodnsbrute
Source: https://trickest.com/docs/library/recon/tools/aiodnsbrute
A Python 3.5+ tool that uses asyncio to brute force domain names asynchronously. It's fast. Benchmarks on small VPS hosts put around 100k DNS resolutions at 1.5-2mins. An amazon M3 box was used to make 1 mil requests in just over 3 minutes. Your mileage may vary. It's probably best to avoid using Google's resolvers if you're purely interested in speed. Trickest currently supports only json output for aiodnsbrute.
# amass
Source: https://trickest.com/docs/library/recon/tools/amass
The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.
# amass-intel
Source: https://trickest.com/docs/library/recon/tools/amass-intel
The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.
# amass-json
Source: https://trickest.com/docs/library/recon/tools/amass-json
The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. This version produces JSON output
# analyticsrelationships
Source: https://trickest.com/docs/library/recon/tools/analyticsrelationships
Get related domains / subdomains by looking at Google Analytics IDs
# assetfinder
Source: https://trickest.com/docs/library/recon/tools/assetfinder
Find domains and subdomains potentially related to a given domain.
# bbot
Source: https://trickest.com/docs/library/recon/tools/bbot
OSINT automation for hackers
# bigip-scanner
Source: https://trickest.com/docs/library/recon/tools/bigip-scanner
Determine the running software version of a remote F5 BIG-IP management interface
# ccpy
Source: https://trickest.com/docs/library/recon/tools/ccpy
Extracting URLs of a specific target based on the results of commoncrawl.org.
# cdncheck
Source: https://trickest.com/docs/library/recon/tools/cdncheck
A utility to detect various technology for a given IP address.
# cero
Source: https://trickest.com/docs/library/recon/tools/cero
Scrape domain names from SSL certificates of arbitrary hosts
# certsh-subdomains
Source: https://trickest.com/docs/library/recon/tools/certsh-subdomains
Connect to the crt.sh database and get the subdomains of a domain
# chaos-client
Source: https://trickest.com/docs/library/recon/tools/chaos-client
Go client to communicate with Chaos DB API.
# chronos
Source: https://trickest.com/docs/library/recon/tools/chronos
Extract pieces of info from a web page's Wayback Machine history
# cloud-enum
Source: https://trickest.com/docs/library/recon/tools/cloud-enum
Multi-cloud enumeration utility
# crosslinked
Source: https://trickest.com/docs/library/recon/tools/crosslinked
LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping
# csprecon
Source: https://trickest.com/docs/library/recon/tools/csprecon
Discover new target domains using Content Security Policy
# dnsrecon
Source: https://trickest.com/docs/library/recon/tools/dnsrecon
Author description - DNSRecon is a Python port of a Ruby script that I wrote to learn the language and about DNS in early 2007. This time I wanted to learn about Python and extend the functionality of the original tool and in the process re-learn how DNS works and how could it be used in the process of a security assessment and network troubleshooting. This tool provides the ability to perform: Check all NS Records for Zone Transfers; Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT); Perform common SRV Record Enumeration; Top Level Domain (TLD) Expansion; Check for Wildcard Resolution; Brute Force subdomain and host A and AAAA records given a domain and a wordlist; Perform a PTR Record lookup for a given IP Range or CIDR; Check a DNS Server Cached records for A, AAAA and CNAME Records provided a list of host records in a text file to check.
# dnsx
Source: https://trickest.com/docs/library/recon/tools/dnsx
dnsx is a fast and multi-purpose DNS toolkit allow to run multiple probers using retryabledns library, that allows you to perform multiple DNS queries of your choice with a list of user supplied resolvers.
# dorky
Source: https://trickest.com/docs/library/recon/tools/dorky
A tool to automate dorking of GitHub/GitLab
# favfreak
Source: https://trickest.com/docs/library/recon/tools/favfreak
FavFreak takes a list of urls from stdin, fetches favicon.ico , calculate tha hash value and matches the calculated favicon hashes with the favicon hashes present in the fingerprint dictionary
# findomain
Source: https://trickest.com/docs/library/recon/tools/findomain
The complete solution for domain recognition. Supports screenshotting, port scan, HTTP check, data import from other tools, subdomain monitoring.
# gh-scraper
Source: https://trickest.com/docs/library/recon/tools/gh-scraper
Process GitHub Archive URLs and generate unique repositories and users CSV files
# github-subdomains
Source: https://trickest.com/docs/library/recon/tools/github-subdomains
Find subdomains on GitHub
# goaltdns
Source: https://trickest.com/docs/library/recon/tools/goaltdns
GoAltdns is a permutation generation tool that can take a list of subdomains, permute them using a wordlist, insert indexes, numbers, dashes and increase your chance of finding that estoeric subdomain that no-one found during bug-bounty or pentest.
# gobuster-dns
Source: https://trickest.com/docs/library/recon/tools/gobuster-dns
A tool used to brute-force DNS subodmains(with wildcard support)
# gotator
Source: https://trickest.com/docs/library/recon/tools/gotator
Gotator is a tool to generate DNS wordlists through permutations.
# hakrevdns
Source: https://trickest.com/docs/library/recon/tools/hakrevdns
Small, fast, simple tool for performing reverse DNS lookups en masse. You feed it IP addresses, it returns hostnames. This can be a useful way of finding domains and subdomains belonging to a company from their IP addresses.
# haktrails
Source: https://trickest.com/docs/library/recon/tools/haktrails
Golang client for querying SecurityTrails API data
# hosthunter
Source: https://trickest.com/docs/library/recon/tools/hosthunter
A tool to efficiently discover and extract hostnames providing a large set of target IP addresses. HostHunter utilises simple OSINT techniques to map IP addresses with virtual hostnames. It generates a CSV or TXT file containing the results of the reconnaissance.
# jldc-subdomains
Source: https://trickest.com/docs/library/recon/tools/jldc-subdomains
Get subdomains from jldc.me.
# massdns
Source: https://trickest.com/docs/library/recon/tools/massdns
MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per second using publicly available resolvers.
# mksub
Source: https://trickest.com/docs/library/recon/tools/mksub
Make subdomains using a wordlistRead a wordlist file (lowercase, remove [^a-zA-Z0-9-_.]+), filter unique words and generate subdomains.
# nrich
Source: https://trickest.com/docs/library/recon/tools/nrich
Analyze a list of IP addresses and see which ones have open ports/vulnerabilities through Shodan
# oneforall
Source: https://trickest.com/docs/library/recon/tools/oneforall
Multi-featured subdomain recon tool
# puredns
Source: https://trickest.com/docs/library/recon/tools/puredns
Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.
# second-order
Source: https://trickest.com/docs/library/recon/tools/second-order
Crawler and second-order subdomain takeover scanner
# securitytrails-subdomains
Source: https://trickest.com/docs/library/recon/tools/securitytrails-subdomains
Get subdomains for root domain from SecurityTrails.
# shuffledns
Source: https://trickest.com/docs/library/recon/tools/shuffledns
shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support.
# spiderfoot
Source: https://trickest.com/docs/library/recon/tools/spiderfoot
OSINT for threat intelligence and attack surface mapping
# subbrute
Source: https://trickest.com/docs/library/recon/tools/subbrute
SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting (https://www.us-cert.gov/ncas/alerts/TA13-088A). This design also provides a layer of anonymity, as SubBrute does not send traffic directly to the target's name servers.
# subdomainizer
Source: https://trickest.com/docs/library/recon/tools/subdomainizer
SubDomainizer is a tool designed to find hidden subdomains and secrets present is either webpage, Github, and external javascripts present in the given URL.
# subfinder
Source: https://trickest.com/docs/library/recon/tools/subfinder
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources. It has a simple modular architecture and is optimized for speed. Subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.
# sublist3r
Source: https://trickest.com/docs/library/recon/tools/sublist3r
Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and Ask.
# sudomy
Source: https://trickest.com/docs/library/recon/tools/sudomy
Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting
# theharvester
Source: https://trickest.com/docs/library/recon/tools/theharvester
E-mails, subdomains and names enumeration tool
# tlsx
Source: https://trickest.com/docs/library/recon/tools/tlsx
Fast and configurable TLS grabber focused on TLS based data collection.
# vita
Source: https://trickest.com/docs/library/recon/tools/vita
Vita is a tool to gather subdomains from passive sources.
# waymore
Source: https://trickest.com/docs/library/recon/tools/waymore
Find way more from the Wayback Machine
# whatweb
Source: https://trickest.com/docs/library/recon/tools/whatweb
WhatWeb identifies websites. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices.
# whois-with-ripe
Source: https://trickest.com/docs/library/recon/tools/whois-with-ripe
Get whois data through ripe.net
# whoisninja
Source: https://trickest.com/docs/library/recon/tools/whoisninja
Reverse WHOIS lookup script
# xsubfind3r
Source: https://trickest.com/docs/library/recon/tools/xsubfind3r
xsubfind3r is designed to efficiently identify known subdomains of given domains by tapping into a multitude of curated online passive sources.
# zdns
Source: https://trickest.com/docs/library/recon/tools/zdns
Fast CLI DNS Lookup Tool
# zgrab2-http
Source: https://trickest.com/docs/library/recon/tools/zgrab2-http
Fast Go Application Scanner
# zgrab2-http-simple
Source: https://trickest.com/docs/library/recon/tools/zgrab2-http-simple
Fast Go Application Scanner, parsed to print out title status and content length
# zgrab2-jarm
Source: https://trickest.com/docs/library/recon/tools/zgrab2-jarm
Fast Go Application Scanner
# zgrab2-multiple
Source: https://trickest.com/docs/library/recon/tools/zgrab2-multiple
Fast Go Application Scanner
# zgrab2-tls
Source: https://trickest.com/docs/library/recon/tools/zgrab2-tls
Fast Go Application Scanner
# Workflows
Source: https://trickest.com/docs/library/recon/workflows
Explore a collection of powerful and efficient workflows in the Recon category to enhance your productivity and security.
# 5WP Subdomain Recon by NahamSec
Source: https://trickest.com/docs/library/recon/workflows/5wp-subdomain-recon-by-nahamsec
NahamSec's 5WP recon workflow to identify subdomains across multiple domains and different ports
# Scanners Tools
Source: https://trickest.com/docs/library/scanners/tools
Explore a collection of powerful and efficient tools in the Scanners category to enhance your productivity and security.
# airixss
Source: https://trickest.com/docs/library/scanners/tools/airixss
Finding XSS during recon
# alterx
Source: https://trickest.com/docs/library/scanners/tools/alterx
Fast and customizable vulnerability scanner based on simple YAML based DSL.
# bomber
Source: https://trickest.com/docs/library/scanners/tools/bomber
Scans SBoMs for security vulnerabilities
# chopchop
Source: https://trickest.com/docs/library/scanners/tools/chopchop
ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: chopchop.yml), fully configurable, and especially by developers.
# jaeles
Source: https://trickest.com/docs/library/scanners/tools/jaeles
The Swiss Army knife for automated Web Application Testing
# joomscan
Source: https://trickest.com/docs/library/scanners/tools/joomscan
OWASP Joomla! Vulnerability Scanner (JoomScan) is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. Implemented in Perl, this tool enables seamless and effortless scanning of Joomla installations, while leaving a minimal footprint with its lightweight and modular architecture. It not only detects known offensive vulnerabilities, but also is able to detect many misconfigurations and admin-level shortcomings that can be exploited by adversaries to compromise the system. Furthermore, OWASP JoomScan provides a user-friendly interface and compiles the final reports in both text and HTML formats for ease of use and minimization of reporting overheads.
# nikto
Source: https://trickest.com/docs/library/scanners/tools/nikto
Nikto is web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers.
# nikto-list
Source: https://trickest.com/docs/library/scanners/tools/nikto-list
[DEPRECATED: use nikto directly instead] A wrapper around nikto with support for multiple targets. Nikto is web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers.
# nomore403
Source: https://trickest.com/docs/library/scanners/tools/nomore403
Advanced tool for security researchers to bypass 403/40X restrictions through smart techniques and adaptive request manipulation. Fast. Precise. Effective.
# nuclei
Source: https://trickest.com/docs/library/scanners/tools/nuclei
Fast and customizable vulnerability scanner based on simple YAML based DSL.
# nuclei-markdown
Source: https://trickest.com/docs/library/scanners/tools/nuclei-markdown
Run a Nuclei scan and export the results in markdown format. Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL.
# patator
Source: https://trickest.com/docs/library/scanners/tools/patator
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage
# sslyze
Source: https://trickest.com/docs/library/scanners/tools/sslyze
Fast and powerful SSL/TLS scanner
# twa
Source: https://trickest.com/docs/library/scanners/tools/twa
A tiny web auditor with strong opinions.
# twa-loop
Source: https://trickest.com/docs/library/scanners/tools/twa-loop
A tiny web auditor with strong opinions.
# wafw00f
Source: https://trickest.com/docs/library/scanners/tools/wafw00f
WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
# wapiti
Source: https://trickest.com/docs/library/scanners/tools/wapiti
Web vulnerability scanner written in Python3
# wascan
Source: https://trickest.com/docs/library/scanners/tools/wascan
WAScan ((W)eb (A)pplication (Scan)ner) is a Open Source web application security scanner. It is designed to find various vulnerabilities using black-box method, that means it won't study the source code of web applications but will work like a fuzzer, scanning the pages of the deployed web application, extracting links and forms and attacking the scripts, sending payloads and looking for error messages,..etc.
# wpscan
Source: https://trickest.com/docs/library/scanners/tools/wpscan
WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites.
# wpscan-loop
Source: https://trickest.com/docs/library/scanners/tools/wpscan-loop
WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites.
# zap-api-scan
Source: https://trickest.com/docs/library/scanners/tools/zap-api-scan
Run a full scan against an API defined by OpenAPI/Swagger, SOAP or GraphQL using ZAP
# zap-automation-framework
Source: https://trickest.com/docs/library/scanners/tools/zap-automation-framework
Run ZAP via a single YAML file
# zap-full-scan
Source: https://trickest.com/docs/library/scanners/tools/zap-full-scan
Run a full scan against a target URL using ZAP
# Workflows
Source: https://trickest.com/docs/library/secret-discovery/workflows
Explore a collection of powerful and efficient workflows in the Secret Discovery category to enhance your productivity and security.
# Get Secrets From WayBack HTTP Responses
Source: https://trickest.com/docs/library/secret-discovery/workflows/get-secrets-from-wayback-http-responses
Gather all wayback urls, request them, and search for secrets inside of http responses.
# Search for leaks in Web Servers
Source: https://trickest.com/docs/library/secret-discovery/workflows/search-for-leaks-in-web-servers
Starting with a list of web servers, search for leaked credentials, access tokens, and interesting endpoints in the responses (including JavaScript files)
# Social Engineering Tools
Source: https://trickest.com/docs/library/social-engineering/tools
Explore a collection of powerful and efficient tools in the Social Engineering category to enhance your productivity and security.
# h8mail
Source: https://trickest.com/docs/library/social-engineering/tools/h8mail
h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services.
# Static Code Analysis Tools
Source: https://trickest.com/docs/library/static-code-analysis/tools
Explore a collection of powerful and efficient tools in the Static Code Analysis category to enhance your productivity and security.
# dumpsterdiver
Source: https://trickest.com/docs/library/static-code-analysis/tools/dumpsterdiver
DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys (e.g. AWS Access Key, Azure Share Key or SSH keys) or passwords. Additionally, it allows creating a simple search rules with basic conditions (e.g. report only csv files including at least 10 email addresses). The main idea of this tool is to detect any potential secret leaks.
# gitleaks
Source: https://trickest.com/docs/library/static-code-analysis/tools/gitleaks
Gitleaks is a SAST tool for detecting hard coded secrets like passwords, API keys, and tokens in git repos. Gitleaks is an easy-to-use, all-in-one solution for finding secrets, past or present, in your code. Set leaks-exit-code to 0 for outputs to be saved.
# javascript-deobfuscator
Source: https://trickest.com/docs/library/static-code-analysis/tools/javascript-deobfuscator
General purpose JavaScript deobfuscator
# leakos
Source: https://trickest.com/docs/library/static-code-analysis/tools/leakos
Search leaks in a github org or in the responses of urls
# noseyparker
Source: https://trickest.com/docs/library/static-code-analysis/tools/noseyparker
Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
# reposcanner
Source: https://trickest.com/docs/library/static-code-analysis/tools/reposcanner
Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys.
# retire-js
Source: https://trickest.com/docs/library/static-code-analysis/tools/retire-js
There is a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development,but we need to stay up-to-date on security fixes. Using Components with Known Vulnerabilities is now a part of the OWASP Top 10 list of security risks and insecure libraries can pose a huge risk to your Web app. The goal of Retire.js is to help you detect the use of JS-library versions with known vulnerabilities.
# rex
Source: https://trickest.com/docs/library/static-code-analysis/tools/rex
regexFinder gives the matches with a directory (or github repository) of the regexes, and saves the matches of found secrets in a json format.
# secretfinder
Source: https://trickest.com/docs/library/static-code-analysis/tools/secretfinder
SecretFinder is a python script based on LinkFinder (version for burpsuite here), written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression.
# semgrep-scan
Source: https://trickest.com/docs/library/static-code-analysis/tools/semgrep-scan
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
# trufflehog
Source: https://trickest.com/docs/library/static-code-analysis/tools/trufflehog
Find credentials all over the place
# Workflows
Source: https://trickest.com/docs/library/threat-intelligence/workflows
Explore a collection of powerful and efficient workflows in the Threat Intelligence category to enhance your productivity and security.
# Extensive OSINT
Source: https://trickest.com/docs/library/threat-intelligence/workflows/extensive-osint
Collect IP addresses, open ports, vulnerabilities, technologies, DNS records, related domains, lookalike domains, documents, email addresses, and user accounts
# Shodan Threat Intelligence
Source: https://trickest.com/docs/library/threat-intelligence/workflows/shodan-threat-intelligence
Get information from Shodan API, organize it into meaningful categories, get alternative org names, gather hostnames, web servers, screenshot them and port scan all the collected IP addresses.
# Utilities Tools
Source: https://trickest.com/docs/library/utilities/tools
Explore a collection of powerful and efficient tools in the Utilities category to enhance your productivity and security.
# apktool-decode
Source: https://trickest.com/docs/library/utilities/tools/apktool-decode
A tool for reverse engineering Android apk files
# assert-tool
Source: https://trickest.com/docs/library/utilities/tools/assert-tool
Interprets a file as a list of values, checks if required conditions are met and exits with corresponding message and code.
# batch-output
Source: https://trickest.com/docs/library/utilities/tools/batch-output
Output file lines by batch size represented by START_LINE, END_LINE
# cent
Source: https://trickest.com/docs/library/utilities/tools/cent
Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place.
# cewl
Source: https://trickest.com/docs/library/utilities/tools/cewl
CeWL is a ruby app which spiders a given URL to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.
# clean-wordlist
Source: https://trickest.com/docs/library/utilities/tools/clean-wordlist
Clean up a wordlist by running a series of regexes against it
# diff-trickest-files
Source: https://trickest.com/docs/library/utilities/tools/diff-trickest-files
Diff an input file against a file from your Trickest file storage
# dnsgen
Source: https://trickest.com/docs/library/utilities/tools/dnsgen
This tool generates a combination of domain names from the provided input. Combinations are created based on wordlist. Custom words are extracted per execution.
# dsieve
Source: https://trickest.com/docs/library/utilities/tools/dsieve
Take a list of urls and filter or extract domains by level.
# duplicut
Source: https://trickest.com/docs/library/utilities/tools/duplicut
Remove duplicates from a wordlist without sorting it to maintain order of probability.
# elasticsearch-index
Source: https://trickest.com/docs/library/utilities/tools/elasticsearch-index
Manage attack surface data on Elasticsearch
# execute-nodejs
Source: https://trickest.com/docs/library/utilities/tools/execute-nodejs
Execute a Node.js script
# fgrep-by-string
Source: https://trickest.com/docs/library/utilities/tools/fgrep-by-string
Fgrep content in files by input string.
# generate-yaml-report
Source: https://trickest.com/docs/library/utilities/tools/generate-yaml-report
Generate a yaml report from the outputs of multiple tools
# get-trickest-files
Source: https://trickest.com/docs/library/utilities/tools/get-trickest-files
Get a file from your Trickest file storage
# get-trickest-output
Source: https://trickest.com/docs/library/utilities/tools/get-trickest-output
[DEPRECATED] Get trickest workflow output by node id.
# gf
Source: https://trickest.com/docs/library/utilities/tools/gf
A wrapper around grep to avoid typing common patterns.
# mgwls
Source: https://trickest.com/docs/library/utilities/tools/mgwls
mgwls is a simple script written in GO to merge 2 wordlists
# mkpath
Source: https://trickest.com/docs/library/utilities/tools/mkpath
Make URL paths using a wordlist
# notify
Source: https://trickest.com/docs/library/utilities/tools/notify
Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms.
# openai-file
Source: https://trickest.com/docs/library/utilities/tools/openai-file
A CLI utility and Python library for interacting with OpenAI and generating AI response through input file.
# prefix-file-lines
Source: https://trickest.com/docs/library/utilities/tools/prefix-file-lines
Add prefix string on each line in files.
# put-trickest-files
Source: https://trickest.com/docs/library/utilities/tools/put-trickest-files
Upload a file(s) into your Trickest file storage
# qsreplace
Source: https://trickest.com/docs/library/utilities/tools/qsreplace
Accept URLs on stdin, replace all query string values with a user-supplied value
# string-to-file
Source: https://trickest.com/docs/library/utilities/tools/string-to-file
Write strings to a file
# trickest-execute
Source: https://trickest.com/docs/library/utilities/tools/trickest-execute
Execute a Trickest workflow
# unfurl
Source: https://trickest.com/docs/library/utilities/tools/unfurl
Pull out bits of URLs provided on stdin
# urldedupe
Source: https://trickest.com/docs/library/utilities/tools/urldedupe
urldedupe is a tool to quickly pass in a list of URLs, and get back a list of deduplicated (unique) URL and query string combination. This is useful to ensure you don't have a URL list will hundreds of duplicated parameters with differing qs values.
# Workflows
Source: https://trickest.com/docs/library/utilities/workflows
Explore a collection of powerful and efficient workflows in the Utilities category to enhance your productivity and security.
# CVEs
Source: https://trickest.com/docs/library/utilities/workflows/cves
Almost every publicly available CVE PoC - https://github.com/trickest/cve
# Enumerate TLD domain names
Source: https://trickest.com/docs/library/utilities/workflows/enumerate-tld-domain-names
Find registered domains for a specific TLD
# Github Recon & Scanner
Source: https://trickest.com/docs/library/utilities/workflows/github-recon-and-scanner
Create your own recon & vulnerability scanner with Trickest and GitHub - https://github.com/trickest/recon-and-vulnerability-scanner-template
# Vulnerabilities Tools
Source: https://trickest.com/docs/library/vulnerabilities/tools
Explore a collection of powerful and efficient tools in the Vulnerabilities category to enhance your productivity and security.
# bypass-403
Source: https://trickest.com/docs/library/vulnerabilities/tools/bypass-403
Go script for bypassing 403 forbidden
# cve-2023-3519-inspector
Source: https://trickest.com/docs/library/vulnerabilities/tools/cve-2023-3519-inspector
Accurately fingerprint and detect vulnerable versions of Netscaler / Citrix ADC to CVE-2023-3519
# dalfox
Source: https://trickest.com/docs/library/vulnerabilities/tools/dalfox
DalFox is a fast, powerful parameter analysis and XSS scanner, based on a golang/DOM parser.
# dnsreaper
Source: https://trickest.com/docs/library/vulnerabilities/tools/dnsreaper
subdomain takeover tool for attackers, bug bounty hunters and the blue team!
# dsss
Source: https://trickest.com/docs/library/vulnerabilities/tools/dsss
Damn Small SQLi Scanner (DSSS) is a fully functional SQL injection vulnerability scanner (supporting GET and POST parameters) written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie.
# dsxs
Source: https://trickest.com/docs/library/vulnerabilities/tools/dsxs
Damn Small XSS Scanner (DSXS) is a fully functional Cross-site scripting vulnerability scanner (supporting GET and POST parameters) written in under 100 lines of code.
# find-gh-poc
Source: https://trickest.com/docs/library/vulnerabilities/tools/find-gh-poc
Find CVE PoCs on GitHub
# findom-xss
Source: https://trickest.com/docs/library/vulnerabilities/tools/findom-xss
FinDOM-XSS with file input. FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner.
# oralyzer
Source: https://trickest.com/docs/library/vulnerabilities/tools/oralyzer
Oralyzer, a simple python script that is capable of finding the open redirection vulnerability in a website. It does that by fuzzing the url i.e. provided as the input.
# sqlmap
Source: https://trickest.com/docs/library/vulnerabilities/tools/sqlmap
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers
# ssrfuzz
Source: https://trickest.com/docs/library/vulnerabilities/tools/ssrfuzz
SSRFuzz is a tool to find Server Side Request Forgery vulnerabilities
# subzy
Source: https://trickest.com/docs/library/vulnerabilities/tools/subzy
Subzy is subdomain takeover tool which works based on matching response fingerprings from can-i-take-over-xyz.
# tko-subs
Source: https://trickest.com/docs/library/vulnerabilities/tools/tko-subs
A tool that can help detect and takeover subdomains with dead DNS records
# tplmap
Source: https://trickest.com/docs/library/vulnerabilities/tools/tplmap
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
# Workflows
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows
Explore a collection of powerful and efficient workflows in the Vulnerability Scanning category to enhance your productivity and security.
# ASN Vulnerability Scanning
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/asn-vulnerability-scanning
Scan web servers for vulnerabilities using ASNs as input
# Bypassing 403 Endpoints
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/bypassing-403-endpoints
Test for ways to bypass 403 responses through 6 different techniques that are found to be effective, quick, and capable of scanning numerous endpoints in no time.
# Check for DNS Takeover with dnsReaper
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/check-for-dns-takeover-with-dnsreaper
Use dnsReaper along with a batching pattern to check for DNS takeover en masse
# Check for DNS Takeover with dnsX
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/check-for-dns-takeover-with-dnsx
Use dnsX to fetch hosts which respond with either servfail or refused status codes, which may be susceptible to DNS takeover
# Check For Subdomain Takeover
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/check-for-subdomain-takeover
Scan a list of subdomains for subdomain takeover
# Citrix CVE-2023-3519
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/citrix-cve-2023-3519
Check for CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway.
# Dynamic Web App Scanner
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/dynamic-web-app-scanner
Finding paths and parameters with various techniques and creating a templates for finding LFI,SSRF,XSS,SQLI,RCE based on user-supplied payloads
# Fuzz new endpoints for vulnerabilities
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/fuzz-new-endpoints-for-vulnerabilities
Discover a web app's endpoints, diff them, and fuzz newly discovered endpoints for common vulnerabilities like SQL injection, SSRF, XSS, and more.
# Fuzz web app for vulnerabilities
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/fuzz-web-app-for-vulnerabilities
Efficiently discover and scan a web app's content for common vulnerabilities. Identify potential SQL injection, SSRF, XSS, and more.
# IDOR Checker for GET HTTP requests
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/idor-checker-for-get-http-requests
Check list of URLs with three different authorization headers for legitimate user, attacker users and anonymous user and compare responses
# Open Redirect Finder
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/open-redirect-finder
Get a list of URLs from WaybackMachine and scan for open redirects
# Random Parameter SSRF Finder
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/random-parameter-ssrf-finder
Fire random SSRF checks through user-supplied parameters for GET and POST requests, additionally crawl the app and add SSRF payload to each GET parameter
# Scan hosts with Nuclei & Cent
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/scan-hosts-with-nuclei-and-cent
Get all the open-source templates for nuclei with cent, and scan the list of hosts.
# Web Cache Poisoning Finder
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/web-cache-poisoning-finder
Attempts to cause web cache poisoning attacks on several hosts
# XSS Finder
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/xss-finder
Get all Wayback URLs for the domain and find XSS.
# ZAP Full Scan
Source: https://trickest.com/docs/library/vulnerability-scanning/workflows/zap-full-scan
Use OWASP ZAP to spider and scan a website while authenticated
# Trickest Changelog 2026
Source: https://trickest.com/docs/releases/changelog
Platform updates and improvements in 2026
## v1.0.22
### Runs & Execution
* **Execution optimizer** — A new partial-run preview computes which nodes actually need to re-execute based on what changed since the last run. Quick-execute automatically picks between a full re-run and an optimized partial run.
* **Accurate run view** — Viewing a run now hydrates the exact workflow version that run executed against, not the current draft.
* **Cleaner canvas during active runs** — Paused and cached nodes have clearer visual states, and stale indicators are cleared when selecting an active run.
### Database & Solutions
* **Re-index live tables** — Re-index existing workflow output against a live table from the table header menu.
* **Indexing history drawer** — Each live table has a drawer showing its full indexing history.
* **Query CSV export** — Export query results directly to CSV from the query tab.
### Security
* **Audit log CSV export** — Enterprise admins can now export audit logs as a CSV from the audit logs page.
### Editor
* **README editor drawer** — Edit workflow and module READMEs in-place without leaving the canvas.
* **Distribute from the connection UI** — Start the distribute wizard directly while connecting two tools.
* **Node Library redesign** — Restructured hierarchy, better search, and clearer categories in the node library sidebar.
* **Quick Add scripts & popular modules** — Quick-add script entry points are back, and the library surfaces popularity signals for common picks.
## v1.0.20 & v1.0.21
### Canvas Copy & Paste
* **Copy workflow as JSON to your system clipboard** — Pressing **Ctrl/Cmd+C** on a canvas selection now writes pretty-printed JSON to your OS clipboard, so you can paste into external editors or share workflow structure outside the platform.
* **Paste from the system clipboard** — **Ctrl/Cmd+V** now reads directly from your OS clipboard, so you can paste workflow JSON that came from anywhere — not just from within the platform.
* **Multiple JSON formats accepted** — The canvas import understands workflow snapshots, legacy exports, internal clipboard payloads, and raw workflow JSON, all via the same Ctrl+V or Ctrl+I flow.
* **Auto-layout after import** — When you import workflow JSON, the graph is re-laid out automatically so imported nodes don't overlap.
* **Pasted and imported nodes stay selected** — After pasting or importing, the newly added nodes remain selected so you can move, connect, or delete them immediately.
## v1.0.19
### Disabled Nodes
* **Disable individual nodes** — Mark a node as disabled from its settings popover. Disabled nodes appear faded with a dashed border and a **Disabled** badge; connected edges use a dotted style.
* **Upstream awareness** — Running a node whose upstream contains a disabled node is blocked, with a toast naming the blocker.
* **Bulk enable/disable** — The selection toolbar shows a single **Disable (N)** or **Enable (N)** action depending on the current state of your selection.
### Runs & Execution
* **Cached-run styling** — Nodes and edges served from cache on the last run appear with a muted dashed look, so you can quickly tell which parts of a run were re-executed vs replayed.
### Editor
* **Better section resize handles** — Sections now show visible resize lines on the right and bottom, plus corner handles, making them easier to grab.
* **Annotation light theme** — Annotation content renders correctly in light mode with proper heading colors and code-block treatment, and the scrollbar no longer appears on empty annotations.
* **Run view ↔ editor sync** — Leaving a historical run view reloads the current workflow version automatically instead of leaving stale data.
* **Trackpad swipe-back prevention** — Accidental browser back-navigation from horizontal trackpad scrolling is suppressed across the dashboard.
* **Distribute dialog polish** — Renamed Strategy to Mode and grouped parameters into required vs optional with clearer outcome summaries.
## v1.0.18
### Editor Performance
* **Smoother canvas during active runs** — Polling no longer triggers extra canvas redraws. Switching between runs fades cleanly instead of flickering.
* **Faster editor load** — Execute and schedule modals are loaded on demand, and the dashboard shows 10 runs initially instead of 200.
* **Accurate execution badges** — Nodes no longer get stuck in "Queued…" or "Preparing distribution…" states when no real job is running.
### App Builder
* **Boilerplate refresh** — The Next.js starter template has been upgraded to Next.js 16 and Tailwind v4.
* **Better previews** — Previews detect client-only imports in server components and surface clear, actionable error messages.
### Billing
* **Outbound traffic warnings** — The outbound traffic progress bar warns at 90% usage and shows a "Limit exceeded" state at 100%.
## v1.0.17
### Navigation
* **Drill-down sidebar** — The primary sidebar replaces the stacked Main/Platform sections with a workspace-scoped root plus drill-down categories. Your current category is remembered across sessions.
* **Full-width settings pages** — Settings pages use the full content area; navigation between sections lives in the main sidebar.
### Workflow Editor
* **Export workflow snapshots** — Any saved snapshot can be exported to JSON from the snapshot sidebar.
* **Import workflows from JSON** — Press **Ctrl/Cmd+I** anywhere on the canvas to paste or upload workflow JSON. Imported content is merged into your current workflow with auto-layout.
* **Redesigned snapshot diff** — Snapshot history shows clear `+ / ~ / −` counts for a quick sense of what changed.
* **Canvas polish** — Node library categories default to collapsed, canvas toolbar buttons are uniform size, and connection-handle hover states are smoother.
### Library
* **Shareable library URLs** — Library filters (type, visibility, category, sort) sync with the URL so you can bookmark and share filtered views.
### Runs & Workflows
* **Partial vs Full filter** — Filter the runs list by partial or full executions.
* **Delete without flash** — Deleting a workflow no longer briefly shows an empty list before the new data loads.
### Authentication
* **Shared password requirements UI** — Signup, password reset, and security settings all use the same live-updating requirements checklist, with a show/hide toggle on signup and reset.
### Workspace
* **Destructive confirmation** — Deleting a workspace now opens a destructive-action dialog instead of a quiet dropdown entry.
* **Workspace switcher polish** — Cleaner chevron affordance, better spacing, and improved copy for users without any workspaces.
## v1.0.16
### Performance
* **Smoother canvas during active runs** — The workflow canvas is now significantly faster while workflows are executing. Status updates and node indicators are applied incrementally instead of redrawing the entire canvas on each update.
### Runs & Execution
* **Console improvements** — Switching between nodes in the console now immediately clears stale output and cancels pending data loads, giving you a cleaner view faster.
### Bug Fixes
* Fixed an issue where nested JSON structures could cause errors when creating live tables from workflow output.
## v1.0.15
### Node Configuration
* **Redesigned inputs panel** — Tool inputs are now organized into two tabs: All and Configured. A count badge shows how many inputs are already set. Required inputs appear at the top, and optional inputs are grouped into collapsible sections. A built-in search makes it easy to find any input by name.
* **Click-outside fix** — Clicking outside the node configuration panel now reliably closes it.
### Scripts
* **Golang support** — Go is now available as a script language alongside Bash, Python, and Node.js.
* **Folder inputs** — Scripts can now accept entire folders as input (e.g., a Git repository URL), not just individual files.
### Distributed Workflows
* **Detailed preparation status** — Distributed nodes now display which stage of preparation they're in — calculating split ranges, splitting input, or creating batches — instead of a generic "Preparing distribution…" message.
* **Clear failure messages** — When distribution setup fails, the error now identifies which stage failed and why.
* **Running indicator** — Distributed nodes show a clear "Running…" state during execution.
### Runs & Execution
* **Safer run deletion** — Runs still being processed by the platform can no longer be accidentally deleted. When deletion fails, the actual error message is now shown instead of a generic failure.
* **Faster file downloads** — Large output files are now streamed directly, improving download speed for large results.
### Editor
* **Unified workflow mode** — The separate "Design" and "Run" modes have been merged into a single "Workflow" mode for a simpler editing experience.
### Library
* **Smoother script editing** — Switching between script languages now automatically updates the template. Creating or importing a script refreshes the library immediately.
### Bug Fixes
* Fixed an issue where the node configuration panel could accumulate too many file tabs when browsing outputs.
* Various stability improvements across file handling and data loading.
## v1.0.11
### Workflow Canvas
* **New layout engine** — Cleaner workflow visualizations with improved edge routing for complex workflows.
* **Status-aware edge coloring** — Edges are now colored by execution status, making it easy to trace which paths succeeded, failed, or are still running.
### Runs & Execution
* **Improved run tracking** — Stale run indicators are cleared automatically, and node statuses load correctly on the first execution.
* **Scheduled workflow safety** — Auto-repair and auto-update are skipped on scheduled workflows to prevent accidental disruption.
### Bug Fixes
* Fixed overlay issues on the canvas during execution states.
* Fixed overflow on connected-node pills and input panels.
* Fixed pending run blur overlay that could get stuck.
## v1.0.10
### Workflow Editor
* **Layout direction persistence** — The editor remembers your chosen layout direction (top-to-bottom or left-to-right) across sessions.
* **Scaling banner** — New canvas indicator showing machine count information during execution.
* **Module modal lock** — Module modal canvas is now view-only, preventing accidental edits to module internals.
### Modules
* **Connection repair** — Corrupted module connections are now automatically repaired when detected.
* **Auto-connect outputs** — Module outputs are connected automatically during repair.
### Library
* **Card actions** — Enhanced actions on library cards including copy and duplicate.
## v1.0.9
### Workflow Editor
* **Orthogonal edges** — New edge routing style for top-to-bottom layouts using right-angle paths for cleaner vertical workflows.
### Billing
* **Payment method management** — Payment method change and removal now works correctly.
### Bug Fixes
* Various stability improvements.
## v1.0.8
### Workflow Editor
* **Module connection fix** — Fixed an issue where updating a module could break its connections to other nodes.
* **Improved module modal** — Streamlined module view with an embedded read-only canvas preview.
### Bug Fixes
* Various performance and stability improvements.
## v1.0.7
### Workflow Canvas
* **Bezier curve edges** — Replaced angular edges with smooth curves for a cleaner, more readable canvas.
* **Execution status coloring** — Edges colored by execution status: running (blue), succeeded (green), failed (red).
* **Hover & selection** — Smooth transitions on edge hover and selection highlighting.
### Runs & Execution
* **Partial run accumulation** — Running individual nodes sequentially now shows combined results from all partial runs, instead of only the most recent one.
* **Module connection fix** — Fixed module-to-module connection failures caused by output key mismatches.
### Performance
* **Faster platform** — Significant reduction in background processing overhead, resulting in a more responsive experience.
* **Improved real-time updates** — More reliable WebSocket connections with automatic recovery from dropped connections.
## v1.0.6
### Workflow Editor
* **Partial execution highlighting** — When a run only executes some nodes, the ones that didn't run are now visually dimmed so you can quickly see what actually executed.
* **Faster workflow switching** — Switching between workflows no longer briefly shows run data from the previous workflow.
* **Historical version fix** — Fixed a flash of incorrect node statuses when viewing a previous workflow version.
* **Node visual polish** — Improved status indicators and styling across tool, group, and output nodes.
### Runs & Execution
* **Active runs on listing pages** — Workflow cards and rows now show live run status directly, so you can see what's running at a glance without opening the editor.
* **Smoother canvas updates** — Reduced unnecessary canvas redraws during run polling, resulting in a more responsive editor while workflows execute.
* **Console streaming** — Console output now streams in real time instead of polling, giving you faster feedback during execution.
### Library
* **Delete tools & scripts** — Private tools and scripts can now be deleted directly from library cards with a confirmation dialog.
* **Improved tool & script editors** — Enhanced editor pages for tool and script configuration.
* **Detail drawer refresh** — The library detail drawer has improved layout and actions.
### Workflows
* **Workflow diff** — Compare two versions of a workflow to see what changed between them.
* **Workflow validation** — Validate a workflow's nodes, connections, and configuration before executing.
* **Workflow status** — New composite view combining workflow metadata, latest run status, and schedule info.
* **Distribution management** — View and update distribution split configuration for distributed nodes.
### Notifications
* **Bulk actions** — Delete or mark multiple notifications as read in one action.
* **Notification settings** — Configure your notification preferences.
### Modules
* **Full module updates** — Modules now support full updates in addition to partial edits.
### Performance & Stability
* **Workflow listing pagination** — Improved pagination and error handling on workflow listing pages.
* **Run state cleanup** — Deleted nodes no longer inherit stale execution state when names are reused.
## v1.0.5
### Workflow Editor
* **Scheduled workflow locking** — The editor is now read-only when a workflow has an active schedule, preventing accidental edits to running automations.
* **Schedule indicators** — Workflow cards, list rows, and run items now display a badge when a schedule is active.
* **Active run navigation** — Clicking a workflow in listing pages now navigates directly to the editor with the active run pre-selected.
* **Database schema popover** — The database badge on canvas nodes now shows a schema popover with table structure on hover.
* **Inline edit fix** — Fixed an issue where clicking to rename a tool node in the canvas wasn't registering correctly.
* **Module IO cleanup** — Internal input names are no longer shown in the module input/output panel.
* **Parallelism slider fix** — The parallelism control now reads the correct value from the API, preventing mismatched settings.
* **Annotation resize handles** — Simplified annotation node resize handles for smoother interactions.
### Runs & Execution
* **Task children view** — Distributed tasks now show individual sub-tasks with live polling and a per-task stop button.
* **Execution timeline bars** — Distributed task children are now visualized as sub-bars within the execution timeline.
* **Input/Output file split view** — The task detail panel now shows input files (from upstream nodes) alongside output files in a side-by-side layout.
* **Runtime params bar** — Task parameters are displayed in a compact, collapsible bar above the console instead of a separate tab.
* **IP display & bulk download** — Run details now show assigned IPs and offer an export dropdown for bulk output downloads.
* **Run stop removed from listing pages** — The stop button has been removed from the runs listing to avoid accidental stops; use the run detail view instead.
* **Distribution UI copy** — Improved distribution mode descriptions and step labels for clarity.
### File Preview
* **JSONL content detection** — Files containing JSON Lines data are now automatically detected and rendered with the interactive JSON viewer, even without a `.jsonl` extension.
* **Unified file preview** — File preview across the platform now uses a single consistent component with delete confirmation.
### Database
* **Row history drawer** — View the change history for any row in database mode.
### Projects
* **Move project to workspace** — Projects can now be moved between workspaces via the project header actions menu.
### Modules
* **Module actions** — Module cards now support edit, delete, and open actions with consistent card styling.
### Navigation & Layout
* **Sidebar collapse** — The sidebar collapse icon is now always visible, not just on hover.
* **Workflow cards & rows** — Unified styling and added quick actions across all workflow listing pages.
* **Solution badges** — Workflow listing now displays database and solution badges for quick identification.
* **Dashboard run sidebar** — Workflow name is now shown in the dashboard run sidebar for better context.
* **Dashboard layout** — New workflow CTA moved to the header for easier access; "View all" moved to the bottom.
* **Editor state preservation** — Navigating away and back to the editor no longer loses your current run context.
* **Light theme checkbox fix** — Fixed checkbox border visibility in light theme.
* **Copy improvements** — Improved copy across solutions, database mode, and distribution dialogs for clarity.
# Trickest Changelog 2024
Source: https://trickest.com/docs/releases/changelog-2024
Platform updates and improvements in 2024
## Solutions Support Comment Count in Rows
Solutions now display comments counts in rows, providing better insights into categorization and prevalence of tagged items.
## Solution Duplication
Solutions can now be duplicated, allowing you to quickly create copies of existing solutions as templates for new projects.
## CSP and HSTS Headers
Implemented Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) headers to enhance application security and protect against various web vulnerabilities.
![Solution Rows Support Comments]()
## Solution Rows Support Comments
Solution rows now support comments, enabling better collaboration and discussion around specific findings or data points.
## Solutions Support Tags
Solutions now support tags for improved organization, filtering, and categorization of your data.
## SMS Verification
Added SMS verification for community users during sign-up to enhance account security and prevent automated registrations.
## Module Readmes
Modules now include detailed README documentation, providing clear instructions, examples, and best practices for module usage.
![Export Solution Views in CSV]()
## Export Solution Views in CSV
You can now export solution views in CSV format for easier data sharing and offline analysis.
## Solution Row History
Solution rows now include a history tab that displays the complete change history for each row, enabling better tracking and auditing of modifications.
## Modules Onboarding and User Guides
Developed comprehensive [onboarding materials](https://trickest.com/docs/key-concepts/building-blocks/modules) and user guides for modules to facilitate easier adoption and understanding.
## Workflow Distribution Tutorials
Released [new tutorials](https://trickest.com/docs/using-the-app/workflow-and-executions/distributing-and-scaling-jobs) covering workflow distribution and execution to help users maximize the platform's capabilities.
## Integrated Workflows in Solutions
Solutions now have natively integrated workflows and additional tabs: `Dashboards`, `Insights`, `Builder`, and `Runs` for a more streamlined experience.
## Views Column Fixes
Saving new views are now also saving appropriate columns selected for the view.
## Show TQL in Views
Added the ability to show TQL in views for better visibility and understanding of queries used in custom views.
## Default Status Sorting
Default sorting for status column is now fixed to sort statuses in order: `New`, `Resurfaced`, `Missing`, `Removed`, `Unchanged`.
## Configurable Data Retention
Enterprise users will have custom data retention policies according to their compliance and operational needs.
## Advanced Alerting for Engine Jobs
Implemented advanced alerting and monitoring mechanisms for engine jobs to improve reliability and performance tracking.
## Improved Folder Aggregation
Enhanced folder aggregation to improve performance and reduce latency in data processing.
## EC2 Instance Fixes
Resolved issues related to machine's instances to enhance stability and performance.
## Updated Icons for Custom Views
Fixed and updated icons for custom views in the right sidebar for improved visual consistency and user experience.
## Engine Services Updated to Go 1.23.x
All engine services have been upgraded to Go version 1.23.x, enhancing performance, security, and compatibility across the platform.
## Improved Editor UI
We've polished the editor's user interface with minor CSS tweaks and fixed issues in the command line component for a smoother editing experience.
## New Button Styles
Updated the button styles across the platform for a refreshed look and improved user interaction.
## Datasets as Tabs in Solutions
Navigating through datasets in solutions is now more intuitive with tabs replacing the previous dropdown menu system.
## Custom Statuses and Icons
Introduced custom statuses—`new`, `missing`, `resurfaced`, `removed`, `unchanged`—along with corresponding icons in solution columns for better tracking and visualization.
![Custom Views and Saved Queries]()
## Custom Views and Saved Queries
You can now create custom views in solutions and save your preferred columns and queries for quick access and personalized data analytics.
## Light Theme Improvements
Applied several fixes to the light theme within solutions to ensure a consistent and visually appealing experience.
## Run and Module Insights
Gain deeper visibility into your runs and modules performance with the new Module and Run Insights available in Run Mode.
## Enhanced Query Language
The Trickest Query Language now features icons in search results and autocomplete suggestions for quicker recognition and selection.
## Documentation Enhancements
The Trickest editor is now embeddable within our documentation, enabling interactive examples and hands-on learning. Explore the latest tutorials at [https://trickest.com/docs/introduction](https://trickest.com/docs/introduction).
## Bug Fix: Splitter Jobs
Resolved an issue where splitter jobs were using incorrect inputs when their parent job was lifted, ensuring accurate data processing.
![Private Agents]()
## Private Agents
Deploy agents to scan environments internally on any device, even behind VPNs and office networks. Integrate into existing workflows to enable continuous monitoring and vulnerability scanning of both internal and external infrastructure.
## Modules
Automated security processes with structured inputs/outputs, built-in scalability, and automatic tool updates. Minimizes disruptions from manual tool management and ensures consistent results across workflows.
## Private Tooling for Custom Workflows
Securely integrate proprietary tools within the platform. Managed and executed in a secure environment by connecting a Private Docker Registry.
## Advanced Variables for Dynamic Workflows
Add variables to workflows for dynamic inputs and outputs. Scope variables globally or to specific projects for enhanced workflow customization flexibility.
## Self-Hosted Machines
Connect and execute workflows via self-hosted machines with public IP addresses for more control over the execution environment.
## Private Script Library
Create and manage a centralized library of Bash or Python script templates that can be reused across workflows.
## New Editor Design
Experience a revamped interface with the new editor design, currently accessible via a feature flag.
## Clear Dataset Functionality
Manage your data with the ability to clear all data from Solution Datasets.
## User Interface Improvements
* Added pagination support in the Right Sidebar for Splitter Nodes in Run Mode
* Enhanced user experience with various UI fixes for Node Inputs
## Security and Compliance
Detailed audit logs now available for enterprise customers.
## Policy Updates
New data retention policy for community users: workflow data retained for 14 days with access to the 10 most recent runs.
# Trickest Changelog 2025
Source: https://trickest.com/docs/releases/changelog-2025
Platform updates and improvements in 2025
![Monthly Activity Report]()
![Notification Settings]()
## Monthly Activity Report
Introducing Monthly Activity Reports - a comprehensive overview of your workspace activity over the past month. Get insights into workflow executions, resource usage, team performance, and key metrics that help you understand how your workspace is being utilized. The report provides valuable data to help optimize your automation workflows and track your team's productivity trends.
![User activation and deactivation interface]()
## User Account Management - Activate & Deactivate Users
Added the ability to activate and deactivate user accounts within your workspace. This feature allows administrators to temporarily disable user access without removing them from the team, making it easier to manage team permissions and maintain security.
![Global workflow timeout settings]()
## Global Workflow Timeout Configuration
Introduced global workflow timeout configuration in Workflow Details, allowing you to set a maximum execution time that applies to each node in your workflow. Each node will be automatically terminated if it exceeds the specified duration, with a maximum limit of 24 hours. This timeout is now displayed in the run item popover within the Editor's Runs tab, providing better visibility into execution constraints and helping prevent individual jobs from running indefinitely.
## Enhanced DNA UI in Run Item Popover
Updated the DNA (Dynamic Node Allocation) interface within the run item popover in the Editor's Runs tab. The new design provides clearer visualization and improved user experience when viewing DNA information for your workflow executions.
![Real-time scaling on managed fleets]()
## Improved Machine Scaling Behavior
[Machine scaling](https://trickest.com/docs/key-concepts/machines-and-fleet#how-it-works) now adjusts dynamically during workflow execution, right-sizing capacity as demand changes.
This means you can execute more with the same number of machines, because capacity is automatically distributed across your entire account.
![Export IPs menu option in run actions]()
![Export IP Addresses modal with copyable list]()
## Export IP Addresses from Runs
Added the ability to export IP addresses used by workflow runs. Access this feature through the run actions menu to view and copy all IP addresses associated with a specific run execution. Useful for whitelisting, network analysis, and debugging purposes.
![Job Timeout Configuration in Node Settings]()
## Job Timeout Configuration
Added the ability to configure job timeouts for individual nodes in workflows. Set custom timeout durations to automatically stop jobs that run longer than expected, improving resource management and preventing workflows from hanging indefinitely.
## Documentation Updates
Documentation updates across tutorials and library reference materials.
**New Tutorials:**
* [Private Scripts](https://trickest.com/docs/key-concepts/building-blocks/scripts) - Guide on creating and managing private scripts for Enterprise users
* [Solutions](https://trickest.com/docs/key-concepts/solutions-database) - Custom solutions, vulnerability assessment, and DAST workflows
* [Insights & Datasets](https://trickest.com/docs/key-concepts/solutions-database) - Creating and managing datasets in Solutions
* [Query Language](https://trickest.com/docs/using-the-app/database-management/querying) - Trickest Query Language (TQL) syntax and usage
## Workflow Rendering Fix for Chrome
Fixed an issue where splitter nodes were not rendering correctly in the latest version of Chrome browser.
![Main Navigation Expanded]()
![Main Navigation Collapsed]()
## Improved Main Navigation
Navigation is now faster and clearer, with more visibility and fewer clicks needed to reach key sections.
![Edit Datasets in Solutions]()
## Edit Datasets in Solutions
Added the ability to add, remove, and edit dataset columns directly inside Solutions.
![Cross-Workspace Solution Management]()
## Cross-Workspace Solution Management
You can now move solutions seamlessly between workspaces, giving teams more flexibility.
## Bug Fixes
Several fixes to improve stability and usability:
**Key Benefits:**
* **Abort Button**: Fixed issue where abort button still appeared after a workflow was stopped.
* **Workflow Page Search**: Fixed disappearing search bar in workspace workflow pages.
* **Pagination**: Added pagination to long lists on the same page for smoother navigation.
![Row History UI Update]()
## Row History UI Update
* More clear changes between different keys in the row history
* Improved search capability
## Workspace Persistence & Navigation Improvements
Enhanced main navigation with persistent workspace state and improved user experience.
**Key Benefits:**
* **Workspace State Persistence**: The platform now automatically saves and restores your last visited workspace, redirecting you to the same workspace when you return to the platform.
* **Persistent Navigation**: Main navigation stays open during workspace interactions, allowing seamless browsing between workspaces without constantly reopening menus.
* **Workspace Created Dates**: Added creation dates under workspace names in the dropdown for better workspace identification and management.
## Modules in Modules
Now you can build modules using other modules. Check the right sidebar of the Module Workflow Editor for available modules.
**Key Benefits:**
* **Development**: Combine existing modules to create different module combinations for your specific use cases.
* **Maintenance**: Updating one module used accross different modules with update it on all of them.
* **Reduced Complexity**: Abstract complex multi-step processes into simple, reusable module nodes.
* **Team Collaboration**: Build on each other's work and create organization-wide module libraries.
![Modules used Runs List]()
## Module Usage Runs
Modules now display a list of runs where they are used across your workflows. This provides instant visibility into module adoption, helps identify dependencies, and enables better assessment when updating or maintaining modules.
![Download stdout and stderr logs]()
## Stdout and Stderr Download
You can now download stdout and stderr from each node.
![Solutions Filters]()
## Solutions Filters
Instead of writing your TQL queries manually, the workflow filters will autogenerate them for you for easier and faster filtering of your solutions.
## Workflow Editor Optimizations
* Reduced CPU usage for complex workflows
* Improved panning on connecting nodes that are far away
* Added grid background pattern for better visibility of the canvas
* Various performance improvements
## UI Updates & Fixes
* Bug Fixes
* Running animation on workflow nodes now correctly stops when execution is completed or finished.
* Refactor
* Streamlined and refactored the alert system for more consistent and predictable behavior across the platform.
## Column Styling Upgrade
* Improvements:
* Enhanced column styles for better visual clarity and consistency across tables.
* Updated column configuration UI/UX with improved layout, responsiveness, and more intuitive controls.
* Bug Fixes:
* Fixed issues in main navigation.
![Workflow Timeline Overview - Visual execution timeline with task durations]()
![Timeline Outlier Detection - Automatic identification of slow and fast tasks]()
## Run Timelines
New timeline visualization in the Workflow Editor provides real-time execution insights, task duration tracking, and automatic outlier detection. See at a glance which tasks are running slower or faster than expected, with detailed performance analytics for distributed workflows.
![Move Workflow Feature - Workflow card dropdown with move option]()
## Move Workflows
Workflows can now be moved between workspaces using the new Move option in the workflow card dropdown menu when inside the Workspace or on All Workflows page.
## WORKFLOW\_NAME Variable Added
Added new WORKFLOW\_NAME workflow variable, allowing users to reference the current workflow name in their scripts and tools using `${{vars.WORKFLOW_NAME}}` format.
## Minor Bug Fixes
Fixed various UI issues, including:
* Variables display
* Builder run functionality for solutions
* Improved audit log event mapping
* Replaced matrix parameters with query parameters for more consistent runs navigation
* Fixed broken links across the interface
* Resolved UX issue where filter and search bars disappeared when no results were available in the runs view
![RBAC User Management Overview]()
![RBAC Team Management Overview]()
![User Workspace Management - Granular access control per workspace]()
## Advanced Role-Based Access Control (RBAC) System
Comprehensive RBAC system with granular permissions, account, team and workspace management.
[Contact Us](https://trickest.com/talk-with-us)
![Audit Logs API Documentation]()
## Audit Logs API Documentation
Comprehensive API documentation for Audit Logs is now publicly available. Enterprise customers can access the documentation directly from the [Audit Logs page](https://trickest.io/dashboard/settings/audit-logs) by clicking the "API Docs" button, enabling programmatic access to audit data for security and compliance.
![Custom Filtering for Audit Logs]()
## Custom Filtering for Audit Logs
Enhanced audit logs with advanced filtering capabilities, allowing enterprise users to filter logs by use and action type, user and more.
![Main Navigation Redesign]()
## Main Navigation Redesign
The main navigation has been redesigned and moved from the left sidebar to be workspace-specific. Following the RBAC update, navigation is now contextual per workspace, providing better organization and access control for workspace-specific resources and settings.
![Solutions Space for Enterprise]()
## Solutions Space for Enterprise
Solutions deployed for enterprise customers will now reside in **Solutions Workspace**, providing dedicated workspace environment for enterprise-level solution management and collaboration.
![Execute Modal - Machine Selection]()
## Execute Modal Improvements
Enhanced workflow execution modal with improved machine availability display, more intuitive fleet selection interface, and new ability to execute workflows across all available machines with a single click.
![File Preview in Editor]()
## File Preview in Editor
New feature allowing users to preview files directly within the workflow editor, enabling faster workflow configuration and better understanding of data without leaving the editor interface.
![My Account Page Redesign]()
## My Account Page Redesign
Completely redesigned My Account page with a cleaner interface, better organization of user information, and improved visibility of account details and settings for a more streamlined user experience.
![Billing Page Feature Status Update]()
## Billing Page Feature Status Update
Enhanced billing page now displays all available features with their current status (active/inactive) and detailed descriptions, providing better visibility into enabled enterprise capabilities and subscription benefits.
![Project Cards UI Improvements]()
## Project Cards UI Improvements
Project cards have been redesigned with improved visual hierarchy, better information display, and enhanced user interaction for a more intuitive workflow management experience.
![README Editor UI Enhancement]()
## Readme in Editor UI Makeover
Enhanced README editor in the workflow editor with improved markdown editing interface, better formatting options, and streamlined documentation creation for workflows.
![Inputs sidebar update]()
## Inputs Sidebar Update
Inputs sidebar is now updated to support CLI 2.0 input aliases.
![Trickest CLI 2.0 Pre-Release]()
## Trickest CLI 2.0 Pre-Release
Trickest CLI 2.0 is now in pre-release and available.
New Trickest CLI v2.0.0 introduces input aliases, built-in help and auto readme generation, time-specific workflow insights, distributed nodes analysis, and more.
[Changelog](https://github.com/trickest/trickest-cli/releases/tag/v2.0.0) | [Blog Post](https://trickest.com/blog/trickest-cli-2-0-0/)
![File Page Updates]()
## File Page Updates
[File Page](https://trickest.io/dashboard/files) is now updated with file tree and file tabs for better organization and navigation.
**Note:** You can use URL to share specific files with others.
![Sidebar Collapse Changes]()
## Sidebar Collapse Changes
Left and Right Sidebar button is moved to the editor single action bar.
![Run Traffic]()
## Run Traffic
Run traffic is now being collected and displayed in [Billing](https://trickest.io/dashboard/settings/payments) page for Enterprise users.
![Private Scripts]()
## Private Scripts
Private scripts can now be created directly from the Command Line Interface in the Workflow Editor.
![Variables in Code Editor for Scripts]()
## Variables in Code Editor for Scripts
Variables are now available in the Code Editor for Scripts for easy access and reference.
## Home Dashboard Library Workflows
Library Workflows in Home Dashboard are now appearing at random order.
![Run List Filters]()
## Run List Filters
Run list filters are now expandable for better visibility and monitoring of the run list.
![Module Run Preview]()
## Module Run Preview
User built modules now have a preview popover for better visibility and monitoring of the module runs and outputs.
![Workflow Run Mode File Tree]()
## Workflow Run Mode File Tree
The workflow run mode now features a file tree for better organization and navigation of the node outputs.
![Outputs in File Tabs]()
## Outputs in File Tabs
Files can now be opened in a new tab with syntax highlighting and line numbers for fully functional and structured analysis of workflows runs.
Custom Previews are available for:
* Image Types
![CLI Updates]()
## CLI Updates
The CLI is redesigned with a new command editor and terminal output for more streamlined monitoring and debugging of workflows.
![Popular Nodes in Workflow Editor]()
## Popular Nodes in Workflow Editor
Frequently used nodes are now integrated directly into the workflow editor interface, making it easier to access and add common components to your workflows.
![New Editor Generally Available]()
## New Editor Generally Available
The new editor is now generally available to all users with additional UI improvements for enhanced usability and performance.
![Workflow Cards Preview]()
## Workflow Cards Preview
Workflows now feature a preview capability and have been completely redesigned for a more intuitive and efficient user experience.
![Home Dashboard Tool Library Updates]()
## Home Dashboard Tool Library Updates
The Home Dashboard now shows library updates for tools that have been recently updated, helping you stay informed about the latest improvements.
![Home Dashboard Improvements]()
## Home Dashboard Improvements
Enhanced Home Dashboard with improved layout, performance optimizations, and better information hierarchy for a more user-friendly experience.
## Service Orchestration Integration
New service orchestration integration for interacting with file and run storage systems, enabling more efficient data management and workflow execution.
![Workflow Details UI Improvements]()
## Workflow Details UI Improvements
Enhanced Workflow Details interface now displays average run time, total run counts providing better insights into workflow performance.
![TQL Syntax Highlighting and Autocomplete]()
## TQL Syntax Highlighting and Autocomplete
Added syntax highlighting and autocomplete suggestions for Trickest Query Language, improving developer experience and reducing errors when writing queries.
## Platform-wide Modal Updates
Updated all modals throughout the platform with a consistent, modern design for improved user experience and accessibility.
![Auto-generate CLI Config]()
## Auto-generate CLI Config
New feature to automatically generate CLI configuration for workflows, simplifying integration with automation scripts and CI/CD pipelines.
## Solution APIs
Solutions now have out-of-the-box APIs, enabling seamless integration with other tools and custom applications.
![Workflow Run Filters]()
## Workflow Run Filters
New filters for runs on workflows make it easier to find and analyze specific executions based on various criteria.
![Single Job Stop]()
## Single Job Stop
Users can now stop individual jobs within workflows, providing more granular control over execution and resource management.
![Custom Tag Colors]()
## Custom Tag Colors
Tags in solutions now support custom colors, improving visual organization and making it easier to identify different categories at a glance.
## Solution Row Navigation
Solution rows now have arrow controls to navigate through them in detail view, making it easier to review sequential items without returning to the main list.
# Creating a Database
Source: https://trickest.com/docs/using-the-app/database-management/creating-database
Let the platform detect structured output from your workflows and turn it into a live, auto-updating database table.
## Overview
The platform automatically detects when a workflow node produces [JSON Lines](https://jsonlines.org/) output. Structured output is any node output where each line is a valid JSON object. When this is detected, you can create a **Live Table** directly from that output without defining a schema manually.
Live Tables are updated after every workflow run, so your database always reflects the latest results.
You do not need to configure output formats or install additional nodes. Any node whose output contains valid JSON Lines will appear in the **Detected from workflow** section of the Database tab.
## How Detection Works
After a workflow run completes, the platform inspects node outputs for JSON Lines format. Each detected output appears as a candidate in the **Database** tab under **Detected from workflow**, along with a preview of the fields found and sample values from the actual output.
## Creating a Live Table
Navigate to your workflow and click the **Database** tab. If any node outputs have been detected as structured JSON Lines, they appear under the **Detected from workflow** section.
Click **Create Live Table** next to the output you want to use as a data source. A configuration panel opens with a preview of the detected fields and sample data from the last run.
Enter a name for the table. Use a name that reflects the content (e.g., `open_ports`, `discovered_subdomains`).
Review the list of detected fields. For each field you want to include as a column:
* Toggle the field on to include it in the table.
* Set the **data type** for the column.
| Type | Use for |
| ---------- | ------------------------------------------- |
| `text` | Hostnames, URLs, strings |
| `int` | Ports, counts, numeric scores |
| `int64` | Large integers exceeding standard int range |
| `float` | Decimal numbers |
| `float64` | High-precision decimal numbers |
| `bool` | True/false flags |
| `uuid` | Identifiers |
| `datetime` | Timestamps |
| `data` | Raw or complex values |
The sample data preview updates as you make changes, so you can verify the column will be populated correctly.
Toggle **Primary key** on for at least one column. You can select multiple columns to form a composite primary key.
The primary key uniquely identifies each record. When new data arrives from a workflow run, records with a matching primary key are updated rather than duplicated. Records with a new primary key are inserted as new rows.
**Choosing a good primary key:**
* Use fields that are stable and unique per logical record (e.g., `hostname` for assets, `ip + port` for services).
* Avoid high-cardinality fields that change between runs if you want to track changes over time rather than create new rows.
Click **Create Live Table**. The table is created immediately and populated with data from the last run.
## How Live Tables Are Updated
After each workflow run, the platform writes new output to all connected Live Tables using the following logic:
* **Primary key match found**: the non-key columns for that record are updated with the new values.
* **No primary key match**: a new row is inserted.
* **Row not present in new output**: the existing row is left unchanged until you act on it (see [Schema and data changes](#schema-and-data-changes) below).
This means your table accumulates all discovered records over time, with non-key fields always reflecting the most recent values seen.
## Schema and Data Changes
As workflows evolve, the output structure may change between runs. The platform handles two cases:
### New field detected
If a run produces a JSON object with a field that does not exist as a column in the table, the platform notifies you. You can choose to:
* **Add the column** to the table with a chosen data type.
* **Ignore** the field, in which case it is excluded from future imports until you act on it.
### Field no longer present
If a field that previously existed in the output is no longer found in a run's data, the platform flags the column as missing from the source. You can choose to:
* **Keep the column** as-is. Existing values are preserved; new rows will have no value for that column.
* **Delete the column** from the table entirely, which removes all stored values for that field.
Deleting a column is permanent. All data stored in that column is removed and cannot be recovered.
## Troubleshooting
**Possible causes:**
* The workflow has not been run yet. Run the workflow at least once to generate output.
* Node output is not valid JSON Lines. Each line must be a complete, standalone JSON object. Arrays, multi-line JSON, and plain text are not detected.
* The run failed before any output was produced. Check the run status in the **Runs** tab.
Sample data is drawn from the last completed run. If the output is very large, only a subset of rows is shown in the preview. The full dataset is used when the Live Table is created.
If values look wrong, verify the node output format directly by inspecting the run's output file.
Duplicate rows indicate that the primary key is not unique enough. For example, using only `hostname` as a primary key when the same hostname can appear with different ports will cause updates rather than inserts, which may not be the intended behavior.
Review your primary key selection and consider using a composite key (e.g., `hostname + port`) to uniquely identify each logical record.
## Next Steps
Filter and search your Live Table data using the query language.
Save column layouts and filters as named views for your team.
Download table data for use in external tools and reports.
# Creating Views
Source: https://trickest.com/docs/using-the-app/database-management/creating-views
Save queries and column layouts as named views for quick reuse across your team.
## Overview
A **view** is a saved combination of a query filter and a column selection. Views let you and your team return to a specific perspective on a Live Table instantly, without rewriting filters or reconfiguring columns each time.
In the platform UI, views are stored as **saved queries**: you save them through the **Save Query** dialog and access them from the **Saved Queries** sidebar.
## Creating a View
In the **Query** tab, write the filter you want the view to capture and use the column selector to choose which columns should be visible. Run the query to confirm the results look correct.
Click **Save** in the Query tab. The **Save Query** dialog opens.
Enter a descriptive **Name** that reflects what the view is filtering for (e.g., `open-critical-ports`, `staging-subdomains`, `recent-changes`).
Use the **Folder** picker to group related saved queries together. To create a new folder, open the picker and select **+ New folder**, then type a name. Leave the folder unset to save the query at the top level.
Click **+ Add description** to expose the **Description** field, then describe what the saved query does. The description is shown next to the entry in the **Saved Queries** sidebar.
Click **Save**. The saved query appears in the **Saved Queries** sidebar and is available to all team members with access to the table.
## Saved Queries
The **Saved Queries** sidebar lists all saved queries, organized by folder. Click any entry to apply its query and column layout instantly against the active Live Table.
Folders collapse and expand to keep the list manageable as the number of saved queries grows. Selecting an entry from the list sets both the query text and the column visibility to what was saved.
## Updating a Saved Query
To update an existing saved query, adjust the query or column selection, click **Save**, and use the same **Name** in the dialog. This overwrites the previous version.
## Tips
* **Use folders to separate concerns.** Group saved queries by purpose (e.g., `Triage`, `Monitoring`, `Reporting`) to make them easier to find.
* **Add descriptions for shared use.** A short description in the **Description** field helps teammates pick the right saved query without re-reading the filter.
## Next Steps
Download the results of a view for use in external tools and reports.
# Exporting
Source: https://trickest.com/docs/using-the-app/database-management/exporting
Export Live Table query results to CSV for use in external tools and reports.
## Overview
Any query result can be exported to CSV directly from the Query tab. The export reflects the current query filter, so you can export a specific subset of your data rather than the full table.
## Exporting to CSV
In the **Query** tab, write and run the filter you want to export. If you want to export the full table, leave the query empty and run.
Click the **download** icon (tooltip **Export to CSV**) in the query toolbar, or use the same icon in the results header above the rows. The **Export to CSV** modal opens.
The modal shows progress as the export is generated. Larger tables may take a moment to process.
Once the modal switches to **Export ready**, click **Download** to save the CSV to your machine. Click **Close** when done.
> **Tip** While the export is in progress you can click **Cancel** to stop it. Closing the modal before the export completes also cancels it.
# Querying
Source: https://trickest.com/docs/using-the-app/database-management/querying
Filter Live Table data using the Trickest Query Language.
## Overview
The **Query** tab lets you write and run filters against any Live Table. Queries use the Trickest Query Language, a concise syntax built for filtering large structured datasets with exact matches, comparisons, regex patterns, and logical operators.
## Writing a Query
Open a Live Table and click the **Query** tab. Click **New Query** to create a query, then type your filter in the text editor that opens.
### Operators
| Operator | Description | Applicable types |
| -------- | ---------------------------- | ---------------------------- |
| `=` | Exact match | Strings, numbers, dates, IPs |
| `!=` | Does not match | Strings, numbers, dates, IPs |
| `>` | Greater than | Numbers, dates |
| `<` | Less than | Numbers, dates |
| `~` | Matches regex pattern | Strings |
| `!~` | Does not match regex pattern | Strings |
| `AND` | Both conditions must be true | |
| `OR` | Either condition can be true | |
### Basic examples
Exact value:
```text theme={null}
status_code = 200
```
Numeric comparison:
```text theme={null}
response_time > 1000
```
Exclude a value:
```text theme={null}
port != 80
```
Regex match:
```text theme={null}
hostname ~ ".*staging.*"
```
Multiple conditions:
```text theme={null}
port = 22 AND banner ~ "OpenSSH" AND last_seen > "2024-01-01"
```
Quote strings and dates. Leave numbers unquoted. When using regex, escape special characters with a backslash (e.g., use `\\.` to match a literal period).
## Grouping Conditions with Parentheses
Use parentheses to control how `AND` and `OR` are evaluated when combining multiple conditions:
```text theme={null}
(port = 80 OR port = 443) AND status_code = 200
```
```text theme={null}
(severity = "critical" AND status = "open") OR (severity = "high" AND last_seen > "2024-01-01")
```
Nested parentheses are not supported. Each group must be a flat list of conditions joined by a single logical operator.
Valid:
```text theme={null}
(cond1 AND cond2) OR (cond3 AND cond4)
```
Invalid:
```text theme={null}
((cond1 AND cond2) OR cond3) AND cond4
```
## Running a Query
Click **Run** to execute the query against the current Live Table. Results are displayed in the table below the editor. The row count updates to reflect how many records match your filter.
To clear the filter and return to the full table, remove the query text and run again.
### Selecting a dataset and columns
Two dropdowns sit next to the **Run** button:
* **Live Table** — selects which Live Table in the current database to query. Switch between tables without leaving the Query tab.
* **Columns** — toggles which columns are visible in the results. Use this to focus on the fields relevant to your current filter. This does not affect the underlying data or other team members' views.
## Tips
* **Start broad, then refine.** Begin with a single condition and add more until you isolate exactly what you need.
* **Use parentheses for mixed logic.** When combining `AND` and `OR`, always use parentheses to make evaluation order explicit.
## Next Steps
Save queries and column layouts as named views for quick reuse.
Download filtered results for use in external tools and reports.
# Using the App
Source: https://trickest.com/docs/using-the-app/introduction
Step-by-step guides for the main features of the Trickest platform.
This section covers how to use the Trickest platform day-to-day. Each guide is focused on a specific task, with step-by-step instructions and no assumed prior knowledge.
Build, run, and manage workflows in the workflow editor.
Create Live Tables from workflow output and query, view, and export your data.
Invite users, manage teams, and configure role-based access control.
Add private tools, connect container registries, and run workflows on self-hosted machines.
# Adding Private Tools
Source: https://trickest.com/docs/using-the-app/private-execution-networking/adding-private-tools
Import custom Docker-based tools into your Vault and use them in workflows like any public tool.
Private tools are available exclusively for [Enterprise](https://trickest.com/pricing/) users with the private tooling feature enabled on their Vault. To learn more, [contact us](https://trickest.com/talk-with-us/).
## Overview
Private tools let you bring your own Docker-based CLI tools into the platform and use them in workflows alongside public Library tools. They are visible only within your Vault and never exposed publicly.
## Importing a Tool
Navigate to **Library**, click **Create** and choose **Tool**.
Fill in the tool details in the form that appears. See the field reference below for what each field expects.
Define the input parameters the tool accepts. At least one parameter is typically needed. See [Input Parameters](#input-parameters) below.
Click **Save** to import the tool. It will appear in the Library and can be added to any workflow in your Vault.
## Tool Fields
### Required
| Field | Description |
| ---------------- | --------------------------------------------------------------------------- |
| **Name** | Display name for the tool as it appears in the Library and workflow editor. |
| **Docker Image** | The Docker image to run, without the tag (e.g., `quay.io/myorg/mytool`). |
| **Output Flag** | The CLI flag the tool uses to specify its output path (e.g., `-o`). |
| **License URL** | URL pointing to the tool's license file. |
### Optional
| Field | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Docker Tag** | The image tag to use (e.g., `v1.2.0`). Defaults to `latest` if not set. Pinning a specific tag is recommended for stability. |
| **Category** | Library category the tool belongs to (e.g., `Recon`, `Network`). |
| **Description** | Short description of what the tool does. |
| **Output Type** | Whether the tool outputs a `file` or a `folder`. Defaults to `file`. |
| **Command** | Overrides the Docker image entrypoint. Use this when you need to call a specific binary or subcommand (e.g., `/bin/mytool scan`). Leave blank to use the image's default entrypoint. |
| **Source URL** | URL to the tool's source code or repository. |
| **Docs URL** | URL to the tool's documentation. |
## Input Parameters
Each input parameter corresponds to a CLI flag the tool accepts. Add one entry per parameter.
| Field | Description |
| --------------- | -------------------------------------------------------------------------------------------------------- |
| **Name** | Label shown in the workflow editor for this input. |
| **Flag** | The CLI flag passed to the tool (e.g., `-d`, `--target`). |
| **Type** | Data type for this input: `string`, `file`, `folder`, or `bool`. |
| **Description** | Short explanation of what this input controls. |
| **Required** | When enabled, the tool cannot be executed in a workflow unless this input is connected or given a value. |
Parameters marked as required will block workflow execution if left unset. Use this to enforce mandatory inputs such as a target domain or an input file.
## Finding Private Tools in the Library
In **Library > Tools**, use the **Visibility** dropdown to filter by:
* **Public** — tools from the Trickest public Library.
* **Private** — tools imported into your Vault.
Private tools can be added to workflows the same way as any public tool.
# Connecting a Private Container Registry
Source: https://trickest.com/docs/using-the-app/private-execution-networking/connecting-private-registry
Connect a private Docker registry to your Vault so private images can be used in your tools.
Private container registry integration is available exclusively for [Enterprise](https://trickest.com/pricing/) users. To learn more, [contact us](https://trickest.com/talk-with-us/).
## Overview
Connecting a private container registry lets the platform pull Docker images from it when running private tools. Once connected, images from that registry can be referenced in your [private tool configurations](./adding-private-tools) without any extra authentication steps.
## Obtaining Credentials
Before connecting a registry, you will need a username and an access token or password. The exact steps depend on your provider:
* [Docker Hub](https://docs.docker.com/security/for-developers/access-tokens/)
* [GitHub Packages](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry)
* [AWS ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html#registry-auth-token)
For any other registry that supports the Docker Registry HTTP API, use the username and password or token that grants read access to the relevant images.
## Adding a Registry
Go to **Settings > Infrastructure > Container Registry**.
Click **Add registry** in the top-right of the page. A dropdown opens listing the supported registry types: **Docker Registry**, **Docker Hub**, and **GitHub**.
Select the type that matches your provider. The form for that type opens. See the field reference below for what each type requires.
Enter the required fields, then click **Add registry** at the bottom of the form to save the new registry. When editing an existing registry the same button reads **Save changes**.
### Docker Registry
Use this for any self-hosted registry or a registry that supports the Docker Registry HTTP API (including AWS ECR).
| Field | Description |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Name** | Display name for this registry within the platform. |
| **Registry URL** | Full URL of the registry, including any namespace (e.g., `aws_account_id.dkr.ecr.region.amazonaws.com/namespace`). |
| **Username** | Registry username. |
| **Password / Token** | Registry password or access token. |
### Docker Hub
| Field | Description |
| ----------------------- | ------------------------------------------------------------------ |
| **Name** | Display name for this registry within the platform. |
| **Docker Hub Username** | Your Docker Hub username. |
| **Access Token** | A Docker Hub access token with read access to the relevant images. |
### GitHub
| Field | Description |
| ------------------------- | -------------------------------------------------------------- |
| **Name** | Display name for this registry within the platform. |
| **GitHub Username** | Your GitHub username. |
| **Personal Access Token** | A GitHub personal access token with the `read:packages` scope. |
## Managing Connected Registries
All connected registries are listed on the **Container Registry** page. Click an entry to open its details panel; the **`...`** menu in the panel header offers **Rename** and **Delete**. Deleting a registry will prevent the platform from pulling images that depend on it.
# Managing IP Addresses
Source: https://trickest.com/docs/using-the-app/private-execution-networking/extracting-ip-addresses
View static IP addresses for your fleet, and export the IP addresses used during workflow runs and individual jobs.
## Overview
Trickest provides two ways to work with IP addresses: **static IPs** that are assigned to your fleet in advance, and **run/job IP exports** for auditing which addresses were used during execution.
## Static IP Addresses
Static IP addresses are an enterprise feature. Contact your account team to have them enabled for your organization.
When static IPs are enabled, your fleet has a pool of static IP addresses available -- one per machine. These addresses are fixed and known ahead of time, so you can whitelist them in your external systems before any run takes place.
Static IPs are opt-in per execution. When starting a run, you can choose whether to use static IPs or not. If static IPs are not selected, fleet machines will use random IP addresses as usual.
To view your fleet's static IP addresses, navigate to the **Fleet** page and open the **Static IPs** tab. All available static IP addresses are listed there. Use the **Copy All** button to copy the full list to the clipboard.
## Extracting IPs for an Entire Run
### From the Runs Page
Navigate to the **Runs** page, open the **`...`** action menu on any run, and select **Export IPs**. A popup appears listing all IP addresses used during that run. From there you can copy the addresses to the clipboard or download them directly as a file.
### From the Workflow Editor
Open the workflow in the editor and go to the **Runs** section. Open the action menu on the run and select **View Details**. The run details panel displays the IP addresses used, which can be copied from there.
## Extracting IPs for an Individual Job
To see the IP address used by a specific job, open the workflow in the editor and click on a node to open its **Job Details** modal. Next to the **Settings** button, click **Export data** and select **Export IP Addresses**. A modal will open showing the IP address used by that job.
# Using Self-Hosted Machines
Source: https://trickest.com/docs/using-the-app/private-execution-networking/using-self-hosted-machines
Create a self-hosted fleet and attach your own machines to run workflows on your infrastructure.
## Overview
Self-hosted machines are servers, virtual machines, or cloud instances that you connect to the platform to execute workflows on your own infrastructure. They are organized into **fleets**, and any fleet you create can be selected as the execution target when running a workflow.
Trickest supports the following machine types:
* Virtual machines
* Cloud instances
* Bare-metal machines
* macOS devices
## Creating a Self-Hosted Fleet
Navigate to **Settings > Infrastructure > Fleet** and open the **Self-Hosted** tab. Click **Create Self-Hosted Fleet** to create a new fleet. It is ready to have machines assigned to it immediately.
## Adding a Machine to a Fleet
Once a fleet exists, open it and click **Add Machine** to launch the machine connection wizard.
Enter a unique, recognizable name for the machine. This name identifies it within the fleet.
The wizard generates a **Client ID** and **Client Secret** for this machine, along with the commands to run on the target machine to install and start the Trickest Agent.
The Client ID and Client Secret are shown only once. Copy and store them securely before proceeding.
Execute the provided commands on your external machine. The agent will install, authenticate using the credentials, and establish a connection to the platform.
Once the agent is running, the machine appears as **Active** in the fleet. It is now available for workflow execution.
If you lose the Client ID or Client Secret, delete the machine entry and create a new one. There is no limit on how many times machines can be created or deleted.
# Deactivating Users
Source: https://trickest.com/docs/using-the-app/users-access-management/deactivating-users
Deactivate and reactivate users in your Vault.
Only users with the [Super Admin](./teams-and-roles) role can deactivate and reactivate users.
## Deactivating a User
To deactivate a user, go to **Settings > Workspace > Users**, locate the user in the **Active Users** list, and select **Deactivate** from their **`...`** actions menu. A confirmation dialog (**Deactivate users?**) appears; click **Deactivate** to confirm.
Deactivated users:
* Cannot log in to the platform.
* No longer count towards the Vault's user limit, freeing up a slot for a new invitation.
* Remain visible in the **Inactive Users** section as a permanent record.
## Reactivating a User
Deactivated users appear in the **Inactive Users** section on the same page (or under the **Inactive** status filter). To bring a user back, select **Reactivate** from their **`...`** actions menu and confirm in the **Activate users?** dialog. Reactivation requires that the Vault has not reached its user limit. Reactivated users regain access to the platform with the same roles and team memberships they had before deactivation.
Deactivated users cannot be re-invited. To restore access for a deactivated user, use the **Reactivate** action rather than sending a new invitation.
# Inviting Users
Source: https://trickest.com/docs/using-the-app/users-access-management/inviting-users
Invite new users to your Vault, manage pending invitations, and view active users.
Only users with the [Super Admin](../../key-concepts/roles-and-permissions) role can invite and manage users.
## Inviting Users
Go to **Settings > Workspace > Users**.
Click **Invite User** in the top-right corner of the page. The **Invite users** dialog opens.
Paste one or more email addresses into the **Email addresses** field. The field accepts multiple addresses at once, separated by commas or new lines.
Click **Send invites**. Each address receives an invitation email with a link to register.
Invitations can only be sent if your Vault has not reached its user limit. If the limit is reached, existing users must be deactivated before new ones can be invited.
## Invitations
Sent invitations that have not yet been accepted, or have expired, are listed in the **Invitations** section on the Users page. The **Status** filter at the top of the page lets you switch between **All Status**, **Active**, **Inactive**, and **Invitations**; selecting **Invitations** shows only invitations.
To cancel an invitation before it is accepted, open the row's **`...`** menu and select **Revoke**. A confirmation dialog (**Revoke invitations?**) appears; click **Revoke** to confirm.
## Active Users
Once a user registers using their invitation link, they appear in the **Active Users** section. The section header shows the current usage against your seat limit, for example **Active Users (12/25)**. For each active user, the teams they are a member of are shown alongside their account details.
From this page you can also assign or change the global and workspace roles for any active user. See [Teams and Roles](./teams-and-roles) for details on available roles and what each one grants.
# Teams and Roles
Source: https://trickest.com/docs/using-the-app/users-access-management/teams-and-roles
Assign roles to users, create teams, and manage permissions across your Vault.
Role-based access control (RBAC) is available exclusively for [Enterprise](https://trickest.com/pricing/) users. To learn more, [contact us](https://trickest.com/talk-with-us/).
For an explanation of what each role allows, see [Roles & Permissions](/docs/key-concepts/roles-and-permissions).
## Assigning Roles to Users
Go to **Settings > Workspace > Users** and click on a user to open their details drawer.
* **Vault Role**: select the user's global role from the dropdown.
* **Workspace Access**: manage which workspaces the user can access and with what role. Click **Add access** to select a workspace and assign a workspace role to it. You can add access for multiple workspaces. To change a role on an existing workspace, update it inline. To remove access to a workspace, delete the entry.
***
## Managing Teams
Go to **Settings > Workspace > Teams** to create and manage teams.
### Creating a Team
Click **Create team** in the top-right of the Teams page to open the **Create team** dialog. Team creation is a four-step wizard with a stepper at the top of the dialog.
Enter a **Team name** and an optional **Description**. Click **Continue**.
Search for and select users to add to the team. The list shows how many users are available and how many are currently selected. You can add more members later. Click **Continue**.
Set the team's default workspace access. For each workspace you want the team to have, pick the workspace and a workspace role. You can add multiple assignments, or skip this step and grant access later. Click **Continue**.
The review step summarizes the **Team Name**, **Description**, **Members** count, and **Workspace Access** assignments. Click **Create** to create the team. Use **Back** at any earlier step to revise.
### Editing and Deleting a Team
Click a team in the list to open its details panel. In the panel header, open the **`...`** menu to:
* **Edit team** to rename the team or update its description.
* **Delete team** to delete it entirely. Deletion requires confirmation. It does not deactivate the team's members or remove their directly assigned roles.
### Managing Members
The team's details panel has a **Members** section. Click **Add users** in that section to add members; a user can be a member of multiple teams simultaneously. To remove a member, hover the entry in the list and use the remove action that appears.
## Assigning Workspace Access to Teams
In the team's details panel, the **Workspace Access** section lists the workspaces the team can access and the role granted on each. Click **Add workspace** to grant access to another workspace and pick the workspace role. You can update an existing role inline or remove access entirely from the same row. All team members inherit the resulting permissions in addition to any directly assigned roles.
# Building and Debugging a Workflow
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/building-and-debugging-a-workflow
Add a node to the canvas, configure it, run it, and inspect inputs/outputs to validate behavior before you connect additional steps.
## Overview
Workflows are built incrementally. Start with a single node, verify it behaves as expected, and then expand the workflow by connecting additional nodes.\
This guide covers single-node execution and basic debugging using the node run view.
***
## 1. Add a Node on the Canvas
Workflows are made of **nodes**. Each node is a **tool** (a packaged binary like `subfinder` or `httpx`), a **script**, or a **module** (a reusable mini-workflow). For this guide you will use **subfinder**, a passive subdomain enumeration tool, as the first node, then add **httpx** to probe the discovered subdomains.
Click **Add node** in the top-right of the canvas. A search panel opens listing tools, scripts, and modules.
Type `subfinder` in the search box, then click the result (or drag it onto the canvas). A new **subfinder** node appears.
***
## 2. Configure and Run a Single Node
You can run any node on its own to verify it works before connecting it to anything else. This is the fastest way to iterate on a single step.
Double-click the **subfinder** node on the canvas. The node run view opens. The left panel lists the node's parameters; the center area shows the generated command, run controls, and (after the node runs) the inputs and outputs of that run.
In the parameter list, find `domain` and enter `trickest.com` (or any domain you are authorized to scan). For `subfinder`, `domain` is the only required input; everything else can stay at its defaults.
Click **Run** at the top of the node run view. The node enters the running state, and the **Command** preview shows the actual command that will execute (for example, `subfinder -d trickest.com`).
While the node is running and after it finishes, you can monitor in the same view:
* The **Command** generated from your parameters
* The **Inputs** resolved for the run
* The **Outputs** produced. For `subfinder`, this is a list of discovered subdomains, one per line.
> **Note** Parameters can have one of several types: **String** (text input), **File** (upload, paste a URL, or pick a file you uploaded earlier), **Folder** (a folder of files), or **Flag** (boolean toggle). Required parameters are marked; optional ones can be skipped.
> **Note** You can close the node run view at any time. The execution state is preserved, and you can reopen the view by double-clicking the node again.
***
## 3. Validate Results and Iterate
Use the **Outputs** panel to confirm the node behaved as expected before you build on top of it.
For the `subfinder` example, you should see one or more subdomains listed. For `trickest.com`, expect entries like `app.trickest.com`, `docs.trickest.com`, and similar. If the output is empty or much smaller than you expected:
* Double-check that the `domain` value is spelled correctly and has no extra whitespace
* Confirm the domain has discoverable subdomains (some private domains return nothing)
* Adjust optional flags (for example, sources to use) and re-run
> **Tip** When iterating on configuration, change one parameter at a time so it is clear what affected the output.
***
## 4. Add and Connect a Downstream Node
Once a node produces the output you expect, add a second node and connect it to the first one. Here you will add `httpx` to take the subdomains discovered by `subfinder` and probe which ones respond over HTTP.
Click **Add node** again, search for `httpx`, and add it to the canvas next to the **subfinder** node.
Drag from the output handle of the **subfinder** node to the input handle of the **httpx** node. A picker appears asking which input parameter on **httpx** should receive the upstream output.
Pick `-list` from the picker. `httpx` reads its targets from the file passed to `-list`, so the subdomains produced by `subfinder` flow into it as a file input.
Double-click the **httpx** node to open its run view. The `-list` parameter is now bound to the upstream node's output, and the **Command** preview reflects this (for example, `httpx -list `).
Click **Run**. The **Outputs** panel will show the responding hosts, typically with status codes such as `200`, `301`, or `403`.
> **Note** The platform supports memoization. If a node's configuration and inputs are unchanged from a previous run, the platform can reuse the previous result instead of re-executing.
***
## 5. Continue Building
At this point you have a working two-step workflow:
1. `subfinder` generates subdomains
2. `httpx` processes the discovered subdomains
You can continue building in the same way:
* Add another node, run and validate outputs incrementally
* Configure inputs/parameters
* Execute (or Schedule) workflow to get fresh run of the whole workflow
***
## 6. Restore a Past Run's Version
While iterating, you may want to revert the live workflow to the version that produced a previous run (for example, a known-good run before a change broke something). Use **Restore** to replace the live workflow with the version recorded for that run.
Open the run from the **Runs History** sidebar in the editor, or from the **Workspace Runs page** (see [Working with Runs](./working-with-runs)).
The **Viewing run** banner appears at the top of the canvas. If the run uses a different workflow version than the live one, **Restore** is shown next to **Back to editor**.
Click **Restore**. A confirmation dialog appears: *"Restore to this version? This will replace the current workflow with the version from this run. Any unsaved changes will be lost."*
Click **Restore** to apply, or **Cancel** to keep the current workflow.
> **Note** Restore only appears when the run's workflow version differs structurally from the live workflow. Position-only changes (moving nodes on the canvas) do not trigger it.
> **Note** Restore replaces the **workflow definition**. It does not re-run the workflow and does not copy the run's input values onto the live workflow.
> **Tip** Unsaved local changes are discarded by Restore. If you want to keep them, save or duplicate the workflow first.
***
## Next Steps
Once you are happy with the single-node results, you can continue by connecting additional nodes to build a full workflow.
# Copying Workflows
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/copying-workflows
Duplicate an existing workflow from the Workflows page and move the copy into a workspace or project.
## Overview
Use workflow duplication to create a new workflow based on an existing one. This is useful when you want to iterate safely, create variants, or reuse a workflow across projects.
***
## Duplicate a Workflow
To create a copy:
From the global menu, open the **Workflows** page.
Locate the workflow you want to copy in the workflows list. Click the **three dots** (`...`) next to the workflow and select **Duplicate**.
A new workflow is created as a duplicate of the original.
> **Note** Duplication creates a new workflow entry. Make sure you update the name and any environment-specific configuration before running it in production.
***
## Move the Duplicated Workflow to a Workspace or Project
If you want the duplicated workflow to live under a specific Workspace or Project:
Open the duplicated workflow or locate it in the workflows list.
Use the **Move to workspace** or **Move to project** action to select the destination workspace or project.
After moving it, the workflow will appear under the selected project.
> **Tip** Keep a consistent naming convention for duplicates (for example: `Workflow name (copy)` or `Workflow name - `), especially in shared enterprise workspaces.
# Creating and Using Modules
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/creating-and-using-modules
Create custom modules from the Modules page, define their inputs and outputs in the Module I/O panel, and use them as nodes in other workflows.
## Overview
Modules are reusable subgraphs that appear as a single node in a workflow. You create and manage your modules from the **Modules** page in the platform scope. From there you can create a new module, build its internal workflow, expose inputs and outputs via the **Module I/O** panel, and then use the module in any workflow like any other node. For an introduction to what modules are and how they fit with workflows and the Library, see [Modules](/docs/key-concepts/building-blocks/modules) in Key Concepts.
## Where to Find Your Modules
All of your modules are listed on the **Modules** page. In the sidebar, under the **PLATFORM** section, click **Modules**. The page shows a grid of your modules with search and filters. Use **+ Create Module** in the top right to create a new one.
## Creating a Module
On the Modules page, click **+ Create Module** in the top right. A dialog opens asking for the module name and an optional description.
Enter a **Name** for the module. You can add a **Description (optional)** to explain what the module does (up to 140 characters). The dialog also links to the Trickest documentation for more guidance.
Click **Create Module**. You are redirected to the module editor, where you can start building the module.
## Building the Module
Build the module like any other workflow. Add and connect nodes (tools, scripts, and optionally other modules) on the canvas. The **Module I/O** panel appears to the left of the canvas. When the module is new, it shows **No inputs exposed yet** and **No outputs exposed yet**; the module does not expose any inputs or outputs until you define them.
You must **run the module** (click **Execute** in the top bar) at least once before you can define its inputs and outputs. Until then, the **Available** section in the Module I/O panel will be empty or will not show the inputs and outputs from your nodes. If the list looks empty or confusing, run the module first.
## Defining Module Inputs and Outputs
After the module has been executed, the Module I/O panel shows an **Available** section that lists:
* **Inputs** from the nodes in the module that can be exposed as module inputs.
* **Outputs** from the nodes in the module that can be exposed as module outputs.
If you do not see any inputs or outputs under Available, run the module once using **Execute**, then check the panel again.
To expose an input or output:
In the Module I/O panel, find the input or output you want under **Available** and click the **+** button next to it (for outputs, the tooltip may say "Expose as module output").
Give the input or output a custom name (recommended) or keep the default. A custom name makes the module easier to use when you add it to other workflows.
Click the checkmark to confirm. The input or output is then part of the module's interface and appears when you use the module in another workflow.
You can repeat this for as many inputs and outputs as you need. Only the inputs and outputs you expose in the Module I/O panel are visible when the module is used as a node elsewhere.
## Using a Module in a Workflow
When you build or edit a workflow, you can add a module like any other node. Open the **Node Library**, search for your module by name, and add it with the **+** button. The module appears on the canvas as a single node. In the workflow's **Inputs** panel you can set values for the module's exposed inputs, and you can connect the module's exposed outputs to downstream nodes.
The module's **Execution** tab describes it as a reusable workflow and shows its inputs and outputs. To change the module's internal workflow or its exposed inputs and outputs, use **Open Editor** to open the module in its own editor. From the module editor you can also view the module's full execution history, including runs started directly from the module and runs triggered when the module is invoked as a node in other workflows.
## Next Steps
Learn the workflow editor layout and how to move between workflows and modules.
Add nodes, connect them, and run and debug workflows.
Understand what module nodes are and how they relate to workflows and the Library.
# Distributing and Scaling Jobs
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/distributing-and-scaling-jobs
Split a file or folder coming from an upstream node into many parallel jobs, so the destination node runs once per line, per file, or per batch.
## Overview
When a node receives a file or folder from an upstream node, you can **distribute** that input so the destination node runs as many parallel jobs instead of a single job. Each job receives one slice of the input (a line, a file, or a batch of lines), and the platform runs the jobs in parallel across the run's machines.
Distribution is configured per node from the destination node's modal. The available modes depend on the input type and the destination's parameter type.
***
## Where Distribution Applies
Distribution is available when:
* An upstream node produces **file** or **folder** output, and
* That output is connected to an input on the destination node, and
* The destination node has at least one input that can accept the distributed form.
When these conditions hold, a **Distribute** button is available on the destination node's modal.
If they do not hold, opening the dialog shows *"No inputs available to distribute."*
If an upstream node is already configured to distribute the same data, the dialog blocks new configuration with *"Already distributed by an upstream node."*
***
## The Three Modes
Distribution has three user-facing modes. Which one applies depends on the type of the upstream output and the type of the destination input:
| Mode | When it's offered | What each job receives |
| --------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------- |
| **One job per line** | Upstream is a **file**; destination has a **string** parameter | One line of the file as a string value |
| **One job per batch** | Upstream is a **file**; destination has a **file** parameter | A chunk of the file (lines grouped into roughly equal batches) |
| **One job per file** | Upstream is a **folder**; destination has a **file** or **folder** parameter | One file from the folder |
When the input is a file and both **One job per line** and **One job per batch** apply, the dialog asks you to pick. In all other cases the mode is selected automatically.
> **Note** Folder distribution always runs in the "one job per file" form. There is no separate folder-batch mode.
***
## Opening the Distribute Dialog
Double-click the destination node on the canvas to open its modal.
Click **Distribute** in the modal action bar. The Distribute dialog opens.
***
## Filling Out the Wizard
The dialog has up to three steps: **Input**, **How to split**, and **Parameter**. Steps with only one valid choice are resolved automatically and shown as a read-only summary with an **Auto** pill. Steps with more than one option always require a selection.
Pick which connected input to distribute. The input picker is a dropdown listing every distributable connection on the node, including multiple connections that feed the same input port (each entry shows the source node name). If only one input is distributable, this step is auto-resolved.
Pick a mode (**One job per line**, **One job per batch**, or **One job per file**). The two file modes are presented as two cards separated by an **OR** divider, since the choice is binary. Modes that do not apply to the chosen input are not offered. If only one mode applies, this step is auto-resolved.
Only shown when the mode is **One job per line**. Pick the string parameter on the destination node that will receive each line. If the destination has only one matching string parameter, this step is auto-resolved.
After you pick an input, a **Preview** appears at the bottom of the dialog showing the first few lines from the source so you can sanity-check what will be split.
When all steps are complete, an outcome summary explains what will happen (for example, "your file input will fan out one line per job, spawning one parallel job per line").
Click **Distribute** to apply, or **Cancel** to close without changes.
***
## After Distribution
Once distribution is applied, the destination node is marked as distributed on the canvas. When the workflow runs, the platform creates one job per slice of the input and runs them in parallel up to the run's machine cap (see [Resource Allocation on Managed Fleets](/docs/key-concepts/machines-and-fleet#resource-allocation-on-managed-fleets)).
In the run view, each distributed task shows up as its own row with its own inputs, console output, and produced files.
To remove distribution, open the destination node's modal and use the undistribute action.
***
## Next Steps
Learn the workflow editor layout and how to select and inspect nodes.
Add nodes, connect inputs and outputs, and run workflows.
Encapsulate workflows as reusable module nodes.
# Executing and Scheduling Workflows
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/executing-and-scheduling-workflows
Run a workflow with Execute, Smart Execute, or Advanced Execute, and schedule recurring runs from the editor.
## Overview
Workflows can be run **once on demand** or **on a recurring schedule**. Both controls live in the **top-right of the canvas** in the Workflow Editor.
For a one-off run, the editor offers three entry points:
* **Execute**: a one-click full run that re-executes every node.
* **Smart Execute**: an optimized run that reuses cached results from a previous run for nodes whose configuration and inputs have not changed.
* **Advanced Execute**: opens a configuration dialog where you can set fleet, parallelism, timeout, static IPs, and override workflow inputs before running.
For recurring runs, use **scheduling** to start a workflow at a fixed time and repeat it at a fixed interval.
***
## Executing a Workflow
The execute control is the **Execute** button in the top-right of the canvas. The chevron next to it opens a dropdown with **Smart Execute** and **Advanced...**.
> **Note** Execution is disabled while a workflow has unsaved changes, while a save is in progress, while another run is starting, or while the workflow is scheduled. Save your changes (or cancel the schedule) before running.
### Execute (Fresh Run)
Clicking **Execute** starts a fresh run that re-executes every node in the workflow, regardless of what previous runs produced.
Use **Execute** when:
* You want a clean slate, for example before a comparison
* An external dependency changed (a remote source, a credential) that the optimizer cannot detect
The fleet and parallelism for the run come from the workflow's saved defaults. To pick different values for one run, use **Advanced Execute** (see below).
### Smart Execute
**Smart Execute** sits in the dropdown next to **Execute**. It re-executes only the nodes whose configuration or inputs changed since the last run. Nodes that are unchanged are served from cache (memoization), which is faster and cheaper than a full fresh run.
Use **Smart Execute** when:
* You are iterating on a downstream node and do not want to re-run expensive upstream steps
* You expect most of the workflow to be unchanged from the previous run
The platform indicates how many nodes will execute and how many will be served from cache, for example: *"Executing 3 of 7 nodes (4 cached)"*.
> **Note** **Smart Execute** needs a previous run to compare against. If there is no prior run, or if every node has changed, the run effectively becomes a fresh execution.
### Advanced Execute
**Advanced...** sits below **Smart Execute** in the same dropdown. It opens a configuration dialog where you can override the defaults for this run.
In the dialog you can configure:
* **Fleet**: which fleet the run executes on (Managed or a self-hosted fleet)
* **Parallelism**: maximum number of parallel jobs, up to the fleet's available capacity
* **Job Timeout Default**: a global timeout applied to nodes that do not have a custom timeout
* **Static IPs**: enables static IP egress for the run (only available on Managed fleets when the feature is enabled)
To start the run with the chosen settings, click **Execute** at the bottom of the dialog.
> **Tip** Use **Advanced Execute** the first time you run a new workflow to set the right fleet and parallelism, then enable **Save as Default**. Subsequent **Execute** and **Smart Execute** runs will use those defaults automatically.
### Stopping an Active Run
While a run is active, **Stop Run** appears at the bottom of the Execute dropdown. Selecting it stops the run; nodes that are still in flight are wound down.
***
## Scheduling Workflows
Scheduling automates execution at a specific time or at regular intervals. The scheduler is available from the **top-right of the canvas**, next to the **Version history** button.
To open the scheduling dialog:
Open the workflow in the Workflow Editor.
Click the **calendar** icon in the top-right of the canvas. The schedule dialog opens; here you can configure the first run time, repeat interval, fleet, and parallelism. The icon's tooltip reads **Schedule** when no schedule is set, and **Edit Schedule** when one is already active.
In the dialog you configure when and how the workflow runs; the summary at the bottom updates as you change the options.
***
## Scheduling Options
In the schedule dialog, you can configure the following:
* **First Run** - Choose the date and time for the first scheduled run. The first run must be in the future.
* **Repeat** - Choose how often the workflow runs as **Every *N*** minutes, hours, or days.
* **Parallelism** - Set maximum parallelism for your scheduled execution.
* **Fleet** - Choose the fleet where the workflow will execute.
As you update these values, the scheduling summary at the bottom of the dialog updates.
To apply the schedule, click **Schedule**.
> **Note** Scheduling a workflow makes it read-only. You must cancel the schedule before making edits.
***
## Schedule Constraints
When scheduling workflows, keep the following constraints in mind:
* **Workflow execution time vs interval**\
The workflow execution time should be shorter than the repeat interval. If a workflow takes longer than the interval, subsequent runs will start based on the previous run's completion.
* **Fleet capacity and queuing**\
Parallelism and fleet capacity must be available at runtime. If capacity is not available, the workflow will queue until resources are available.
* **Workflow editing**\
A scheduled workflow becomes read-only. To modify the workflow, cancel the schedule first.
***
## Unscheduling Workflows
When a schedule is active, a **Scheduled** pill appears at the top of the canvas. The pill shows the repeat frequency (for example, **Hourly**, **Every 2 days**) and the next run date. The calendar icon in the top-right of the editor remains as an entry point to **Edit Schedule**, but cancelling is done from the pill.
To cancel an active schedule:
Open the workflow in the Workflow Editor.
Click **Cancel Schedule** in the **Scheduled** pill at the top of the canvas.
Once the schedule is cancelled, the pill disappears and the workflow becomes editable again.
# Managing Variables
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/managing-variables
Learn how to create and use variables in Trickest workflows and nodes
## Overview
Variables allow you to create dynamic, reusable workflows by parameterizing values instead of hardcoding them. Use variables to store API keys, target domains, configuration values, and other parameters that change between runs or environments.
## Variable Scopes
Trickest supports two variable scopes:
**Global (Vault-level) Variables**
* Accessible across all workspaces in your organization
* Managed by [Super Admins](/docs/key-concepts/roles-and-permissions) only
* Ideal for organization-wide credentials and shared configuration
**Workspace Variables**
* Scoped to a specific workspace
* Managed by [Workspace Owners](/docs/key-concepts/roles-and-permissions#owner) only
* Ideal for workspace-specific targets and team credentials
When a variable exists at both levels with the same name, the workspace variable takes precedence.
### Platform-Provided Variables
Trickest automatically provides several dynamic variables. These are maintained by the platform and can be referenced the same way as user-defined variables.
**Global Variables (Available everywhere)**
| Variable | Description | Usage |
| :--------------- | :------------------------------------------ | :------------------------- |
| `TRICKEST_TOKEN` | Your platform authentication token (secret) | `${{vars.TRICKEST_TOKEN}}` |
| `USER_ID` | Your user ID | `${{vars.USER_ID}}` |
| `USERNAME` | Your username | `${{vars.USERNAME}}` |
| `VAULT_ID` | Your organization/vault ID | `${{vars.VAULT_ID}}` |
| `VAULT_NAME` | Your organization/vault name | `${{vars.VAULT_NAME}}` |
**Workspace Variables (Workspace-specific)**
| Variable | Description | Usage |
| :-------------- | :--------------------------- | :------------------------ |
| `SPACE_ID` | Current workspace/space ID | `${{vars.SPACE_ID}}` |
| `SPACE_NAME` | Current workspace/space name | `${{vars.SPACE_NAME}}` |
| `WORKFLOW_NAME` | Current workflow name | `${{vars.WORKFLOW_NAME}}` |
***
## Creating Variables
Create variables from the Variables area in the platform, then reference them in node parameters and scripts.
### Create a global or workspace variable
In the global menu, open **Variables** under Workspace or Platform (Global), depending on the scope you want.
Click **New** (or **Create variable**).
Set **Scope** to **Global** or Workspace as needed. Enter a **Name** (for example, `TARGET_DOMAIN`) and a **Value** (for example, `trickest.com`).
Save the variable.
Variable names are case-sensitive. Use consistent naming conventions across teams (for example, `UPPER_SNAKE_CASE`).
***
## Using Variables
You can reference variables in any node parameter that accepts a value (for example, string inputs, flags, URLs, and tool parameters). The platform substitutes the values before execution, so treat them as string literals in your code.
### Use variables in tool/module parameters
In a tool node parameter field, enter the variable expression directly.
Example: set a domain input to a variable instead of a hardcoded value:
* `domain`: `${{vars.TARGET_DOMAIN}}`
This is the recommended approach for values you expect to reuse or change over time.
### Use variables in scripts
Variables can also be used inside script content. In the current editor, scripts do **not** provide a variable dropdown - type the variable reference directly.
Example (Bash):
```markdown theme={null}
# Access variables
TARGET="${{vars.TARGET_DOMAIN}}"
# Use in commands
echo "Scanning target: $TARGET"
curl "https://api.example.com/scan?domain=$TARGET"
```
Example (Python):
```
#!/usr/bin/env python3
# Access variables
target = "${{vars.TARGET_DOMAIN}}"
threads = int("${{vars.MAX_THREADS}}")
# Use in your code
print(f"Scanning: {target}")
```
# Navigating the Editor
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/navigating-the-editor
Learn how to navigate the Workflow Editor, switch between execution views, and inspect workflow runs and data.
## Overview
The Workflow Editor is where you design, execute, and review workflows.\
This guide explains how to navigate the editor layout, switch between execution contexts, move around the canvas, and inspect node-level execution data.
***
## Understanding the Editor Layout
The Workflow Editor consists of five primary areas:
1. **Top Bar (Context & Execution Controls)**
2. **Left Sidebar (Runs History)**
3. **Canvas and Nodes**
4. **Bottom Execution Panel (Inputs & Outputs)**
Each area supports a different part of the workflow lifecycle: design, execution, and inspection.
***
## Top Bar
The top bar determines what context you are working in and how the workflow is executed.
### Workflow Tab
The **Workflow** tab is the primary working view.
Use this view to:
* Design and modify workflow structure
* Execute workflows
* Review execution state directly on the canvas
* Inspect node inputs and outputs
This is the default mode for workflow operations.
### Database Tab
The **Database** tab allows you to use workflow-generated data to build structured datasets for querying and analysis.
> **Note** The Database view does not change workflow structure. It provides a way to organize and query data produced by workflows.
(Details about database modeling and querying are covered in the Database documentation.)
### Execute Button
In the top-right corner, use **Execute** to run or schedule the workflow.
Depending on configuration, you can:
* Run the workflow immediately
* Schedule recurring execution
***
## Working with the Canvas
The canvas is a visual representation of your workflow graph.
Here you can:
* Drag nodes to reposition them
* Connect node outputs to inputs
* Select individual or multiple nodes
* Organize branches for readability
* View execution status directly on nodes
Node state (success, failed, partial, etc.) is reflected visually after execution.
### Panning the Canvas
To move around the editor, you can use your mouse or trackpad.
**Using Mouse:**
* Click and drag empty canvas space (left or middle click).
* Scroll the wheel to pan up and down. Hold **Shift** while scrolling to pan left and right.
**Using Trackpad:**
* Use two fingers to swipe and pan in any direction.
* Click and drag empty canvas space.
### Zooming In and Out
Use zoom controls to manage large or complex workflows.
**Using Mouse**
* Hold **CMD/CTRL** and scroll to zoom in and out.
**Using Trackpad**
* Use pinch gestures
**Using Canvas Controls**
On the canvas:
* `+` — Zoom in
* `–` — Zoom out
* Fit icon — Fit workflow to screen
> **Tip** Use “Fit to screen” after reorganizing nodes to re-center the workflow.
***
### Adding and Deleting Nodes
To add a new step to your workflow:
Click **Add node** in the top-right corner of the canvas.
Select a tool, script, or module. It will appear on the canvas.
Connect it to the appropriate upstream or downstream nodes.
You can reposition nodes at any time by dragging them, and delete them by selecting and pressing **Backspace** (keyboard).
### Undo and Redo
You can undo or redo changes made on the canvas (for example, adding, deleting, or moving nodes).
* **Keyboard:** **Cmd+Z** (Mac) or **Ctrl+Z** (Windows/Linux) to undo; **Cmd+Shift+Z** (Mac) or **Ctrl+Shift+Z** (Windows/Linux) to redo.
* **Canvas controls:** In the bottom-left of the canvas, a vertical toolbar shows an undo and a redo icon. Use these to step backward or forward through your changes.
### Working with Multiple Nodes
* You can select multiple nodes with **Shift+Click**. While multiple nodes are selected, you can group them into one (and ungroup them later).
* You can also click on the "Section" CTA and add a modifiable section to organize and move nodes visually without breaking connections
> **Note** Organizing your canvas improves debugging and long-term maintainability.
### Disable or Enable nodes
You can temporarily disable one or more nodes in a workflow without deleting them.\
Nodes are enabled by default, but when a node is **disabled**, it stays in the workflow and **will not execute** as part of the run. This is useful when you want to:
* test or debug only part of a workflow
* temporarily exclude an optional or experimental branch
* isolate a problematic node without removing its configuration
* compare workflow behavior with and without specific nodes
**Disable a single node** - you can disable a node in either of these ways:
* **From the canvas:** hover over the node and click on **Disable button**
* **From the node modal:** open the node, go to **Node Settings**, and select **Disable Node**
**Re-enable a single node** - you can turn a disabled node back on in either of these ways:
* **From the canvas:** hover over the node and click **⏻**
* **From the node modal:** open the node and click **⏻ Enable** at the top of the modal, where **Run** normally appears **OR** open Node Settings, and Enable from there.
**Enable or disable multiple nodes** - you can also update multiple nodes at once - helpful when you want to quickly exclude or restore a whole section of the workflow. Here's how:
1. Select multiple nodes in the workflow with **Shift+Click**
2. Click **Disable** or **Enable**
Tips:
* Disabling a node does **not** delete it or remove its configuration
* Disabled nodes remain visible in the workflow
* Re-enable a node at any time to include it in future runs again
***
## Execution Visibility on the Canvas
After execution:
* Node states are visually updated.
* You can quickly identify running or failed steps.
* Selecting a node loads detailed execution data in the bottom panel.
This visual feedback enables faster troubleshooting without leaving the editor.
***
### Bottom Execution Panel and Inspecting Node Execution Data
The bottom execution panel displays detailed runtime information.
It shows:
* **Inputs**
* **Outputs**
* Execution data per node
* Timeline or node list view (if available)
You can load data in two ways:
* Click a node on the canvas
* Select a node from the execution list
The panel updates automatically to display the selected node’s data.
> **Note** The bottom panel reflects the currently selected run from the left sidebar.
***
## Left Sidebar: Runs History
The left sidebar displays a list of workflow runs.
Each entry shows:
* Run status
* Run ID
* Who ran it
* Duration
* If it's partial (the whole workflow was not executed), it will have a "Partial" flag
* How long ago it was executed
* Additional details
You can:
* Click a run to load it
* View run details
* Review partial or completed executions
* Collapse or expand the sidebar for more canvas space
> **Tip** When debugging, select a previous run to compare inputs and outputs without modifying the current workflow.
### Switching Between Runs
To inspect a previous run:
Select a run from the left sidebar.
The canvas updates to reflect that run’s execution state.
Click individual nodes to inspect their inputs and outputs.
This allows you to analyze failures, compare outputs, and verify workflow behavior.
When a run is selected, a **Viewing run** banner appears at the top of the canvas. The banner shows the run's status, a **Back to editor** button, and a **Restore** button when the run's workflow version differs from the live one.
For the full overview of runs, the Run list page, and the editor's run view, see [Working with Runs](./working-with-runs). For the steps to revert the live workflow to a past run's version, see [Restore a Past Run's Version](./building-and-debugging-a-workflow#6-restore-a-past-runs-version).
***
# Uploading Files
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/uploading-files
Upload and organize files in storage, then use them as inputs in your workflows.
## Overview
You can upload files in two ways: from the **Files** page (to manage and organize storage) or from a workflow node when configuring a **File** parameter. Uploaded files are stored in your workspace and can be reused across workflows.
## Upload files from the Files page
Use the **Files** page to upload, manage, and organize files in your storage.
From the global menu, open **Files**.
Click **New Folder** to create a folder for better organization.
Click **Upload Files** and select the file(s) you want to upload.
Uploaded files are stored in your workspace storage and can be reused across workflows.
## Upload files from a workflow node
If a workflow node has a **File** parameter, you can upload a file directly while configuring that node.
Open the workflow in the Editor and double-click the node that contains a **File** parameter.
For the file parameter, choose **Select file**, then **Upload file**.
Files uploaded this way are also stored in your global Files storage, so you can reuse them in other workflows.
# Using Scripts
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/using-scripts
Add a script node to a workflow, configure its arguments and inputs, run it, and create private scripts in the Library.
## Overview
A **script node** is a containerized environment that runs code you provide as part of a workflow. Scripts are useful when no built-in tool fits, when you need to glue tools together, or when you want to parse, filter, or reshape data between steps. For an introduction to what script nodes are and how they relate to other building blocks, see [Scripts](/docs/key-concepts/building-blocks/scripts) in Key Concepts.
This page covers the day-to-day use of scripts in the editor: how to add one, how to configure its arguments and inputs, how to run it, and how to create your own **private scripts** in the Library.
***
## Adding a Script Node
You can add a script node from the Workflow Editor in two ways: from the **Add node** menu (any time) and from the **Quick create** shortcuts (only on an empty canvas).
Click **Add node** in the top-right of the canvas. The node library panel opens with a search box and lists tools, scripts, and modules you can add.
Search by name (for example, `bash`, `python`, `go`, `node`) or by what the script does. Click an entry, or drag it onto the canvas, to add the script node.
On a new, empty canvas the editor also offers a **Quick create** shortcut block with one button per language: **Python**, **Bash**, **Go**, and **Node.js**. Clicking one drops a starter script of that language at the center of the canvas.
> **Note** Trickest supports four script languages: **Bash**, **Python**, **Go**, and **Node.js**.
***
## Configuring a Script Node
Double-click the script node on the canvas to open its **node modal**. The modal has two main areas:
* **Left panel: Inputs.** This panel is split into **Arguments**, **Files & Folders**, and **Connected Nodes**. Each section is described below.
* **Center panel: Code editor.** A read-write code editor showing the script source, with syntax highlighting for the script's language. While a node is running or while you are viewing a past run, the editor switches to read-only.
A console below the code editor shows live execution output when the node runs.
***
## Working with Script Arguments
Script arguments are CLI-style flags and values passed to the script when it runs. They are managed in the **Arguments** section of the Inputs panel.
### Detected Arguments
When you write argument-parsing code in the script (for example, Python `argparse` or `click`, Bash `case` or `getopts`, Go `flag`, Node `commander` or `yargs`), the editor detects the argument definitions automatically and lists them under **Arguments**. A small sparkles indicator on the right shows how many were detected, with a tooltip that reads *"N arguments detected from script"*.
Each detected argument shows:
* The flag (for example, `--target`, `-t`)
* A value field, or a toggle when the argument is boolean
* An optional description, surfaced as a tooltip on the flag
To set a value, type it directly into the value field next to the flag. For boolean arguments, flip the toggle.
> **Tip** Detected arguments stay visible even when no value is set, so you always see what the script supports. Setting an empty value (or toggling a boolean off) removes that argument from the run command.
### Custom Arguments
You can also pass arguments that are not detected from the script source. To add one:
Click **Add argument** below the existing arguments. An inline row appears with a flag field and a value field.
Type the flag (for example, `--verbose`) in the left field and the value in the right field. Press **Enter** to save, or **Esc** to cancel.
A custom flag with no value is saved as a boolean toggle. A row entered as a value with no flag is saved as a positional argument and passed in order to the script.
### Removing an Argument
Hover an argument row and click the small **x** on the right. Removing a detected argument clears its value but keeps the row visible. Removing a custom argument deletes it from the list.
***
## Connecting Inputs (Files and Folders)
Script nodes consume **file** and **folder** inputs, either added directly or connected from upstream nodes.
### Add Files Directly
The **Files & Folders** section of the Inputs panel lets you bring data in without an upstream node:
* Paste a public URL to a file
* Paste a folder URL (for example, a remote bucket path the platform supports)
* Upload a file from your machine
* Pick a file you previously uploaded from the storage browser
### Connect From an Upstream Node
To use the output of another node as a script input, drag a connection from the upstream node's output handle onto the script node. The script's modal switches to **connect mode** and shows the available inputs. Pick the input you want the upstream output to feed into; the connection is established and the upstream node appears under **Connected Nodes**.
To remove a connection, open the script modal and click the disconnect action on the corresponding **Connected Nodes** entry.
For folder outputs and distributed inputs, the connect-mode picker may also offer a **distribution choice** (for example, "aggregate" vs. "continue"); pick the behavior you want and the connection is wired accordingly. For more on distribution, see [Distributing and Scaling Jobs](./distributing-and-scaling-jobs).
***
## Running a Script Node
Script nodes execute the same way as tool nodes:
* Click **Run** in the node modal to run the script on its own. The platform builds the command (script invocation plus the configured arguments and inputs) and runs it on a machine from the chosen fleet. The console shows live output and the **Outputs** section lists files and folders the script produced.
* Click **Execute** in the top-right of the canvas to run the whole workflow, including this script node, end to end. See [Executing and Scheduling Workflows](./executing-and-scheduling-workflows).
> **Note** The Trickest platform writes script outputs to a fixed conventional location inside the container (for example, `/hive/out/`). Output files written there are made available to downstream nodes when the script finishes.
***
## Private Scripts in the Library
A **private script** is a script you save to the Library so you (and your workspace) can reuse it across workflows like any other Library item. Private scripts live alongside public scripts, but only members of your vault can see and use them.
> **Note** Private scripts require the **Private Tooling** feature, available on Enterprise plans. If your account does not have the feature, the **Create Script** page shows an upgrade gate explaining what private scripts unlock.
### Creating a Private Script
From the sidebar, open **Library**. Filter to **Scripts** with **Visibility: Private** to see only your private scripts.
Click **+ Create** in the top-right and choose **Script**. The Create Script page opens.
Enter a **Name** (lowercase letters, numbers, and hyphens only) and choose a **Language** (Bash, Python, Go, or Node.js). A starter template is loaded into the code editor on the right; replace it with your script. Optionally fill in a **Description**, and expand **More** to add a **Source URL** or **Docs URL**.
Click **Create Script** in the top-right. You are returned to the Library, filtered to your private scripts, and the new script appears there. You can also press `Cmd+S` (or `Ctrl+S`) at any time to save.
### Editing or Deleting a Private Script
To edit, open the script in the Library and click **Edit**; the same editor reopens with the existing source loaded. The submit button reads **Save Changes** when editing.
To delete, click **Delete** in the script editor's top-right and confirm in the dialog. Deleting a script affects any workflows that use it, so check uses first.
### Using a Private Script in a Workflow
After it is saved, a private script behaves like any other Library item:
Open the workflow you want to use the script in.
Click **Add node**, search by the script's name, and add it to the canvas. The node modal looks the same as for any script node: code on the right, Inputs on the left.
Set arguments, connect inputs, and run the node (or run the workflow). Edits made inside the workflow's script node only affect that workflow's copy; to update the canonical version, open the script in the Library and edit it there.
***
## Next Steps
Add nodes, connect them, and run and debug workflows.
Split file and folder inputs into many parallel jobs.
Understand what script nodes are and how they relate to workflows and the Library.
# Using Workflows From the Library
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/using-workflows-from-the-library
Copy a workflow template from the Library into your workspace and project so you can customize and run it.
## Overview
The Library provides workflow templates you can copy into your workspace or project. After copying, you can customize and run the workflow like any other.
## Copy a Workflow From the Library
From the global menu, open **Library** and select **Workflows** from the available categories.
Find the workflow you want to use. Copy it by clicking the **Copy** icon next to the workflow, or open the workflow and click **Copy to workspace**.
In the **Copy workflow to workspace** dialog, select the destination **Workspace** (and optionally **Project**). If needed, click **+ New** to create a workspace.
Click **Copy to ...** to confirm.
After copying, review the workflow's required inputs and configuration (for example, parameters, file inputs, and variables) before running it in your environment.
# Working with Runs
Source: https://trickest.com/docs/using-the-app/workflow-and-executions/working-with-runs
Review workflow runs, navigate between the Run list and the Editor, and inspect a past run on the canvas.
## Overview
A **run** is a single execution of a workflow. Each run is recorded independently of the live workflow definition, so you can review past runs, re-run them, and (when the live workflow has diverged from the version that produced a run) restore the workflow to that earlier version.
This page covers where to find runs, the Run list page, and how a run opens in the Workflow Editor.
***
## Run Statuses
Each run has one of the following statuses:
| Category | Status | Meaning |
| -------- | ------------------- | ------------------------------------------- |
| Active | **Pending** | Run is queued and waiting to start. |
| Active | **Running** | Run is currently executing. |
| Active | **Stopping** | Stop was requested; run is winding down. |
| Active | **Scheduled** | Run is scheduled for a future time. |
| Terminal | **Completed** | All nodes finished successfully. |
| Terminal | **Partial Success** | Some nodes succeeded; some did not. |
| Terminal | **Failed** | Run finished with one or more failed nodes. |
| Terminal | **Stopped** | Run was stopped before completion. |
| Terminal | **Error** | Run ended due to a platform error. |
Active runs auto-refresh in the UI and are pinned to the top of run lists.
***
## Where to Find Runs
Runs surface in three places, each scoped differently:
* **Workspace Runs page** lists runs across all workflows in the current workspace.
* **Vault Runs page** lists runs across all workspaces in the vault.
* **Editor Runs sidebar** lists runs of the workflow you are currently editing. See [Navigating the Editor](./navigating-the-editor) for that view.
***
## The Run List Page
The Run list page (workspace or vault) displays one row per run.
Each row shows:
* **Run ID** and creation type (Manual, Scheduled, or API)
* **Status** with duration
* **Workflow name** (and workspace badge on the vault page)
* **Active machines** (only while the run is active)
* **Time** the run was created
* **Author**
* A **`...`** menu with per-row actions
You can filter and sort the list using:
* **Status tabs**: **All**, **Active**, **Completed**, **Failed**, **Stopped**
* **Recent Workflows**
* **Started By** (author)
* **Project**
* **Sort**: Newest first or Oldest first
### Per-Run Actions
Open the **`...`** menu on any row to:
* **View in Editor**: open the editor with this run loaded
* **View Details**: open a side panel with the run's metadata
* **Run Again**: start a new run using the same workflow version
* **Rename**: change the run name
* **Export IPs**: export the IP addresses used by the run
* **Create Workflow**: create a new workflow from the run's workflow version
* **Delete**: delete the run (only available for terminal runs)
***
## Opening a Run from the Run List
A run row has two distinct click targets that route you to the editor in different states:
* Clicking the **Run ID** opens the editor with this run loaded. The URL becomes `/editor/?run=`.
* Clicking the **Workflow name** opens the live editor for that workflow with no run context.
Use the Run ID when you want to inspect what a specific run produced. Use the workflow name when you want to continue editing the workflow.
> **Tip** The same routing applies to **View in Editor** in the `...` menu, which opens the editor with the run loaded.
***
## Viewing a Run in the Editor
When you open a run in the editor (from the Run list, the **Runs History** sidebar, or by selecting a run anywhere else), a **Viewing run** banner appears at the top of the canvas.
The banner contains:
* A **status pill** that reads **Loading...**, **Running**, **Viewing run**, or **Viewing module run** (when the run was a module execution opened in the module editor) depending on the state
* A **Back to editor** button to exit run view and return to the live workflow
* A **Restore** button (only when the run uses a different workflow version, see below)
The editor behaves differently based on whether the run's workflow version matches the live one:
* **Same version as the live workflow**: the canvas stays editable. Run statuses and outputs overlay the nodes so you can inspect what each node produced.
* **Different version**: the canvas shows the run's historical workflow snapshot in read-only mode. **Restore** appears in the banner so you can replace the live workflow with this version.
> **Note** A different version means the workflow structure changed since the run executed. Position-only changes (moving nodes on the canvas) do not count as a different version.
For the steps to restore a workflow to a past run's version, see [Restore a Past Run's Version](./building-and-debugging-a-workflow#6-restore-a-past-runs-version) in Building and Debugging a Workflow.