Repository files navigation

Trickest platform is an IDE tailored for bug bounty hunters, penetration testers, and SecOps teams to build and automate workflows from start to finish.

Current workflow categories are:

• Vulnerability Scanning
• Misconfiguration Scanning
• Container Security
• Web Application Scanning
• Asset Discovery
• Network Scanning
• Fuzzing
• Static Code Analysis
• ... and a lot more

Trickest Library is a collection of public tools, Trickest scripts, and Trickest workflows available on the platform.

Binaries are available in thelatest release.

docker run quay.io/trickest/trickest-cli

You can find your authentication token on theToken page inside the Trickest platform.

The authentication token can be provided through either a string flag--token, a file--token-file, or an environment variableTRICKEST_TOKEN.

The token supplied as--token or--token-file will take priority over the environment variable if both are present.

Use thelist command to list all of your spaces along with their descriptions.

trickest list

Use thelist command with the--space or--url flag to list the content of your particular space; its projects and workflows, and their descriptions.

trickest list --space <space_name>

Use thelist command with the--project or--url option to list the content of your particular project; its workflows, along with their descriptions.

trickest list --project <project_name> --space <space_name>

Use theget command to get details of a particular workflow (current status, node structure, etc.).

trickest get --workflow <workflow_name> --space <space_name> [--watch]

The get command provides:

• Workflow status and run information
• Node structure and execution details
• Task group analysis with statistics
• Average duration and run insights
• JSON output with detailed information

Use theexecute command to execute a particular workflow.

trickest execute --workflow <workflow_name> --space <space_name> --config <config_file_path> --set-name "New Name" [--watch]

Use config.yaml file provided using--config flag to specify:

• inputs values
• execution parallelism by machine type
• outputs to be downloaded.

You can useexample-config.yaml as a starting point and edit it according to your workflow.

More example workflowconfig.yaml files can be found in theTrickest Workflows repository. (Coming Soon ✨)

You can find the GitHub Action for thetrickest-cli athttps://github.com/trickest/action and the Docker image athttps://quay.io/trickest/trickest-cli.

Theexecute command can be used as part of a CI pipeline to execute your Trickest workflows whenever your code or infrastructure changes. Optionally, you can use the--watch command inside the action to watch a workflow's progress until it completes.

The--output,--output-all, and--output-dir commands will fetch the outputs of one or more nodes to a particular directory, respectively.

Example GitHub action usage

    - name: Trickest Execute      id: trickest      uses: trickest/action@main      env:        TRICKEST_TOKEN: "${{ secrets.TRICKEST_TOKEN }}"      with:        workflow: "Example Workflow"        space: "Example Space"        project: "Example Project"        watch: true        output_dir: reports        output_all: true        output: "report"

Use thehelp command to get detailed information about a workflow, including its inputs, outputs, and example usage.

trickest help --workflow <workflow_name> --space <space_name>

The help command provides:

• Workflow description and author information
• Example command with all available inputs and outputs
• List of inputs with their types and default values
• List of outputs
• Past run statistics including duration and machine usage
• Author's notes and additional documentation

Use thestop command to stop a running workflow or node

trickest stop --workflow <workflow_name> --space <space_name> [--run <run_id>] [--all] [--nodes <node_name_or_id>] [--child <child_task_index>]

Use theoutput command to download the outputs of your particular workflow execution(s) to your local environment.

trickest output --workflow <workflow_name> --space <space_name> [--nodes <comma_separated_list_of_nodes>] [--config <config_file_path>] [--runs <number>] [--output-dir <output_path_directory>]

When using theoutput command, trickest-cli will keep the local directory/file structure the same as on the platform. All your spaces and projects will become directories with the appropriate outputs. If a module is among the downloaded outputs, a file will be created for each of its outputs.

Use theinvestigate command to analyze a workflow run's execution details within a specific time range.

trickest investigate --workflow <workflow_name> --space <space_name> [--run <run_id>] [--from <start_time>] [--to <end_time>]

The investigate command provides:

• Active sub-jobs during the specified time range
• Sub-job execution durations
• IP addresses used by sub-jobs

Use thelibrary command to get more info about Trickest workflows and public tools available in theTrickest Library.

Uselibrary list command to list all public workflow, modules, and tools available in thelibrary, along with their descriptions.

trickest library list

Uselibrary search to search all Trickest workflow, modules, and tools available in thelibrary, along with their descriptions.

trickest library search subdomain takeover

Interact with the Trickest file storage

Use theget command with the--file flag to retrieve one or more files

trickest files get --file my_file.txt --output-dir out

Use thecreate command with the--file flag to upload one or more files

trickest files create --file targets.txt

Use thedelete command with the--file flag to delete one or more files

trickest files delete --file delete_me.txt

Use thelist command with the optional--query flag to list or search for files

trickest files list

Manageprivate tools

⚒️ Learn how to add your first tool integrationhere.

trickest tools create --file tool.yaml

trickest tools update --file tool.yaml [--id <tool_id>] [--name <tool_name>]

trickest tools list [--json]

trickest tools delete [--id <tool_id>] [--name <tool_name>]

Manage private scripts

name:hello-worlddescription:Write "Hello, world!" to the outputscript_type:bashscript:echo "Hello, world!" | tee out/output.txt

trickest scripts create --file script.yaml

trickest scripts update --file script.yaml [--id <script_id>] [--name <script_name>]

trickest scripts list [--json]

trickest scripts delete [--id <script_id>] [--name <script_name>]

We look forward to any feedback you want to share with us or if you're stuck with a problem you can contact us atsupport@trickest.com.

You can also create anIssue in the GitHub repository.