Trickest

Visualize, operate & scale everything offensive security in one-platform.

[Nenad Zaric @ZaricNenad_]

One weak password. Full control.

Earlier this year, attackers opened a dam valve for hours. The press called it “sophisticated.”

The reality: an exposed admin panel and weak credentials.

Once you understand the process, execution is trivial.

https://t.co/6dMhyBefr5

[André Baptista @0xacb]

If you need a list of trusted resolvers, e.g. to be used with puredns for active enumeration, @trick3st has a great one.

Just run this: 
⌨️ curl https://t.co/qRAi2eIwYn -O

More stuff at👇
https://t.co/oaiALPCrh9

[Trickest @trick3st]

Tools aren't enough. Trickest modules combine multiple techniques into complete workflows.

Our admin panel scanner finds exposed admin interfaces across various technology stacks.

[Trickest @trick3st]

Check it out here 👇
https://t.co/zLRUC5i25H

[Trickest @trick3st]

ToolShell coverage has been all over the place.

We held off publishing until we could reconcile the discrepancies between the original exploit reports, Microsoft’s advisories, public PoCs, and vendor writeups.

Appendix breaks down the CVE mixups and variant exploits

[Trickest @trick3st]

Why spend hours building in-house security workflows when you can deploy proven ones instantly?

Trickest's workflow library lets you copy and run comprehensive attack chains on your targets with just a few clicks. From web server discovery to credential hunting - battle-tested automations ready for immediate deployment. Security testing shouldn't require reinventing the wheel every time.

[Trickest @trick3st]

Modern attack surface management means having your security data at your fingertips.

Query, filter, and analyze your external footprint in real-time to stay ahead of threats and maintain visibility across your entire digital infrastructure.

Learn more: https://t.co/a0SFY1BFK0

[Trickest @trick3st]

Which of these checks will you add to your workflow first?

[Trickest @trick3st]

6/ SAST-type scans

Do a quick pass for known bad patterns and dangerous functions using static analysis.

This won't replace manual review, but it gives you a starting point, especially useful when you’re short on time or scanning large codebases.

[Trickest @trick3st]

5/ Secret scanning

Scan for hardcoded secrets, tokens, and credentials in JS files. The frontend might be handling things it shouldn't, or something was left behind during development.

Hardcoded "Authorization" headers with high privileges pop up more often than you'd expect

[Trickest @trick3st]

Your JavaScript analysis automation should do these 6 things before handing you the code 🧵👇

[Trickest @trick3st]

4/ Component scanning

Your automation should extract all imported packages, then for each one, check:
🔵 is it outdated and potentially vulnerable?
🔵 is it unclaimed in a way that allows takeover?

[Trickest @trick3st]

Your automation should extract all endpoints from JS code, but also log where each one was found (filename, line number, etc). That context helps you track down how an endpoint is used and what parameters it needs.

[Trickest @trick3st]

3/ API endpoint extraction

A lot of app logic lives in JS calling APIs. You won’t catch everything through the UI because a feature might:
🔵 be behind a feature flag, admin access, or a user tier
🔵 trigger after a specific interaction you missed
🔵 not be fully developed yet

[Trickest @trick3st]

2/ Resolve source maps

What looks like one giant code blob may have started as a dozen source files bundled by a JS build tool.

Before trying to prettify or de-obfuscate code, check for source maps. If available, they can help you reconstruct the original source files.

[Trickest @trick3st]

Your automation should:
✅ mirror the output directory structure to match the live website
✅ keep track of which pages referenced which JS file

That way, you can hop around quickly without needing to search your proxy history over and over again.

[Trickest @trick3st]

1/ Download the code while maintaining context

You want the full JS codebase in one folder so you can navigate, search, and build context quickly.

But you also don't want to waste time later figuring out:
❓ where a file came from
❓ which page loaded it

[Trickest @trick3st]

Trickest ASM demo
https://t.co/jM1D3CXxSi

[Trickest @trick3st]

High per-asset fees? Rigid scans? Legacy ASM can’t keep up.

Trickest ASM gives you:
🔵 Zero per-asset fees ➡️ map every asset with no surprise costs
🔵 Drag-and-drop builder ➡️ easily customize discovery logic
🔵 Scale for 100K+ assets in parallel ➡️ no blind spots

Check out the demo ⬇️

[Trickest @trick3st]

Which pitfall has tripped you up before?

[Trickest @trick3st]

Subdomain DNS brute force isn't just blasting "word + domain" DNS queries

Here are six common pitfalls and how to avoid them:

[Trickest @trick3st]

🚩Traffic saturation

Flooding DNS queries too fast can overwhelm your local resources and lead to inaccurate results. Benchmark your setup, understand how your tool manages concurrency and sockets, and if speed is critical, distribute the workload across multiple machines.