Three prongs. One strike. TRIDENT ingests your Burp Suite URLs, triages every page with AI, audits each parameter with verified payloads, and writes submission-ready reports — all in a single pipeline.
Paste your Burp Suite URL dump into urls.txt.
TRIDENT fetches every page, extracts forms, endpoints, and
parameters, then asks an LLM to score each one for potential
risk and business-logic weight.
python cli.py ingest urls.txt
Each scanner loads its payloads/<script>.yaml,
injects every payload into every parameter, and matches
responses against responses/<script>.yaml
signatures. Only reproducible hits survive.
python cli.py audit --modules sqli,ssrf
Every verified finding is rendered through
templates/default_<script>.md — severity,
reproduction cURL, response snippet, remediation guidance.
Copy, paste, submit to HackerOne or Bugcrowd.
python cli.py report --out reports/
Error-based, blind boolean, blind time, UNION, and stacked queries across MySQL, PostgreSQL, MSSQL, Oracle, SQLite, MongoDB, and Redis.
Context-aware routing across HTML body, attributes, JS strings, template literals. Includes mXSS, CSP bypass, and DOM clobbering.
Cloud metadata extraction, protocol abuse (gopher, dict, file, ldap, smb), IPv6 transition addresses, and blind OOB confirmation.
Protocol-relative, backslash, userinfo, encoding, scheme abuse, CRLF, HPP, and OAuth redirect_uri chains.
Traversal via ../, encoded, unicode, overlong UTF-8, and PHP stream wrappers. Detects /etc/passwd, .env, AWS creds, and K8s tokens.
Convert Burp Suite URL exports into curated workspaces. Filter by host, exclude CDNs, build clean scan targets in one command.
TRIDENT doesn't lock you to one brain. Six hosted providers today, a self-hosted Ollama rack tomorrow. Fall through the chain automatically — if Gemini runs out of tokens, Claude picks up the context. If every cloud is down, the local model takes over.
Reads each crawled page and assigns a 0–100 exploitability score based on parameters, auth state, and reflected content.
Identifies multi-step flows — "this IDOR feeds that SSRF" — that a signature scanner would miss entirely.
Rewrites a near-miss payload for the specific WAF and backend it just observed. Adapts instead of giving up.
Turns raw request/response pairs into a professional HackerOne submission — impact narrative, CVSS vector, remediation.
This is the story we're building TRIDENT for: the solo hunter grinding through HackerOne with nothing but Burp and patience, who plugs in TRIDENT and watches the trajectory bend.
SSRF chained into cloud metadata → IAM credential theft → full account takeover. This is the bug class that pays $10K–$50K+ on mature programs.
SQLi and path traversal exposing user records, tokens, and config files. Regulatory exposure for the target — $5K–$25K typical range.
Stored XSS in an authenticated context, OAuth redirect abuse. $500–$5K per verified finding, stacked with chain amplification.
Five verified scanners, 896 payload templates, JSON workspace output, Markdown reporting.
Gemini, ChatGPT, DeepSeek, Claude, Groq, Hugging Face. Automatic fallback chain.
Open-source release on GitHub, public landing page, documentation site, and issue tracker.
Return to home base. Stable footing is the prerequisite for everything that follows.
Local Ollama inference. 32GB+ VRAM. Zero API costs. Full offline capability. Context windows measured in hundreds of thousands of tokens, not per-request budgets.
Turn the CLI into a hosted service. Subscription tiers, private scan workspaces, org accounts, direct report export to HackerOne and Bugcrowd.