Trickest OffSec

Technical summary

Trickest OffSec connects to the Trickest REST API to orchestrate security scanners (Nuclei, httpx, subfinder, naabu, katana) on managed fleets. Dashboard with workflows/runs/fleets, findings with severity filter and JSON/CSV export, NEXUS task creation from CVEs, and fleet management. Auto-detected JWT/Token authentication. Intel Hub enricher (priority 38) processes IPs, domains and URLs in tasks and comments.

Executed scope

• plugin.php (55 lines): "Trickest" tab under "Threat Intel" with zap icon, doc, modal, Intel Hub enricher (types ip, domain, url, priority 38), 13 API actions.
• backend.php (875 lines): config in admin_configs, trickest_request() with 45s curl, auto JWT/Token auth, dashboard (workflows/runs/fleets), workflow execution with configurable fleet/machines, run monitoring with subjobs, findings with severity filter and CSV export, task creation (priority by severity), lightweight Intel Hub enricher (no API call), target extraction (URLs, domains, IPv4).
• tab.php (546 lines): Alpine.js 6-tab UI (Dashboard, Workflows, Runs, Findings, Fleet, Configuration), lime theme, KPI cards (runs today, total, active, fleets), toast feedback, password API token input, enrichment toggles.
• modals.php (2 lines): plugin modal registration.
• fastr.json: /trickest slash command listing recent findings via trickest_findings.
• doc.md (70 lines): author's technical documentation (PT).
• icon.svg: Trickest brand icon.