TWA(1)

📦 version 1.11.0, in fedora 43, fedora 44, nixos 26.05, nixpkgs unstable

💖 TWA(1) — user commands, bestie edition 💖

okay so you found the manual for twa, and it lives in section 1 (User Commands) of the manual pages. she's a tiny web auditor with strong opinions and honestly? same. let's get into it 🎀

✨ NAME ✨

twa — tiny web auditor with strong opinions 💅

🦋 SYNOPSIS 🦋

twa [-wvcsdV] DOMAIN

like. that's it. that's the whole vibe. one domain, a fistful of flags, go off 👑

🌸 DESCRIPTION 🌸

so here's the deal, bestie: twa takes a DOMAIN that's hosting a website and runs a short security audit on it. she's not doing a whole dissertation, she's doing a vibe check with receipts ✨

what she can sniff out:

  • HTTP(S) issues 👀
  • missing security headers 😭
  • information-leaking headers (the gossipy ones 💀)
  • and other potential security hazards, no cap

one domain at a time, though. twa takes only one DOMAIN per run. if you need to audit multiple sites, you just... run the program again. yes really. she's a one-website-at-a-time kind of girl and that's iconic of her 🫶

✨ OPTIONS ✨

  • -v — Verbose mode. she tells you everything 💬
  • -w — Perform the audit on the main DOMAIN and the www. subdomain. two for one, we love to see it 🎀
  • -c — Emit output in CSV. spreadsheet girlies rise 🍓
  • -s — Run testssl-based checks (skipped by default, so if you want them you gotta ask nicely) 🔥
  • -d — Disable scanning common development ports. bye dev ports 🙈
  • -V — Print the version and exit. short and sweet ⭐
  • -h — Print a help message and exit. your little safety net 🧚

🌈 ENVIRONMENT 🌈

these are the environment variables she reads, and yes they're all lowkey important:

  • NO_COLOR — Don't colorize output, even when you're on a TTY. (sad beige output, but make it your choice 💜)
  • TWA_TIMEOUT — The maximum length, in seconds, for internal curl calls. ⏱️
  • TWA_USER_AGENT — The User-Agent to use for all curl calls. dress her up however you want 💅
  • TWA_CURLOPTS — Any additional options to pass to curl calls. extra toppings, go wild 🦋

👑 TEST RESULTS 👑

every single line of output describes the result of one test, and it follows this format:

RESULT(DOMAIN): explanation

where RESULT is one of the following, and I need you to know all of them:

  • PASS — The test passed with flying colors. ate and left no crumbs 👑
  • MEH — The test passed, but with one or more things that could be improved. not a fail, just... meh 😬
  • FAIL — The test failed, and should be fixed. fix it bestie 🚨
  • UNK — The server gave us something we didn't understand. twa is confused, and so are we 💀
  • SKIP — The server gave us something we understood, but that we don't handle yet. not today, but acknowledged 🙈
  • FATAL — A really important test failed, and should be fixed immediately. like, drop everything. this one is not a drill 🚨🔥

💀 BUGS 💀

None known. 😌✨

but if you do find one, file issues at: https://github.com/trailofbits/twa 🫶

🌸 AUTHOR 🌸

twa is maintained by William Woodruff (<william @ trailofbits.com>). say thank you 💖

okay that's the whole page bestie, ily, go audit something 🌈💅

this was version 1.11.0, dated 2019-02-17 — mwah, signing off 🎀✨🦋

📦 where this page comes from