1TWA(1) User Commands TWA(1)
2
3
4
6 twa - tiny web auditor with strong opinions
7
8
10 twa [-wvcV] DOMAIN
11
12
14 twa takes a DOMAIN hosting a website and performs a short security
15 audit. It can be used to detect HTTP(S) issues, missing security head‐
16 ers, information-leaking headers, and other potential security hazards.
17
18 twa takes only one DOMAIN at a time. If you need to audit multiple
19 sites, run the program again.
20
21
23 -v Verbose mode.
24
25 -w Perform the audit on the main DOMAIN and the www. subdomain.
26
27 -c Emit output in CSV.
28
29 -V Print the version and exit.
30
31 -h Print a help message and exit.
32
33
35 NO_COLOR
36 Don't colorize output, even when on a TTY.
37
38 TWA_TIMEOUT
39 The maximum length, in seconds, for internal curl calls.
40
41 TWA_USER_AGENT
42 The User-Agent to use for all curl calls.
43
44 TWA_CURLOPTS
45 Any additional options to pass to curl calls.
46
47
49 Each line of output describes the result of a single test, and follows
50 the "RESULT(DOMAIN): explanation" format, where RESULT is one of the
51 following:
52
53 PASS The test passed with flying colors.
54
55 MEH The test passed, but with one or more things that could be
56 improved.
57
58 FAIL The test failed, and should be fixed.
59
60 UNK The server gave us something we didn't understand.
61
62 SKIP The server gave us something we understood, but that we don't
63 handle yet.
64
65 FATAL A really important test failed, and should be fixed immediately.
66
67
69 None known. File issues at: https://github.com/trailofbits/twa
70
71
73 twa is maintained by William Woodruff (<william @ trailofbits.com>).
74
75
76
771.8.0 2019-02-17 TWA(1)