Stop copy-pasting curl commands between Notepad and a terminal window.
Trapline runs them, flags the juicy output in real time, and generates the
full HackerOne report — CVSS vector, OWASP ref, impact statement — when you're done.
/// No account. No subscription. One price. ///
No config files. No API keys. Open the app, pick your target, start hunting.
Browse 215 commands across 30 categories or search by keyword. Start with Quickfire for the highest-ROI tests on any new target.
Hit run. Output streams live in the terminal panel. Every line scans against 94 detection rules as it arrives — no waiting for the command to finish.
Interesting output gets flagged automatically — ATO tokens, secrets, private IPs, CORS misconfigs — color-coded by severity before you finish reading.
Click the bug icon, fill in the program name, hit Generate. Complete HackerOne-ready report with CVSS vector, OWASP reference, and impact statement. Copy and paste.
Every command in this playbook was added because it found something on a live program. No CTF fluff, no outdated OWASP demos — just the workflows that actually pay.
Every command came from a real engagement. Quickfire fires the highest-ROI tests first — config.json sweep, CORS origin reflection, Kong portal UUID leak, idToken field scan. One of those four has paid out on every program I've tested seriously. 30 categories, live search, no fumbling through bookmarks.
94 patterns scan every output line as it prints. Not generic keyword matching — ATO token fields (idToken, access_token, oauth_token, auth_data), Stripe/Twilio/SendGrid keys, private IPs, MongoDB/Postgres connection strings, AWS ARNs. The kind of output most hunters scroll past gets lit up in red before you've finished reading the response.
Every hunter has lost a finding to a closed browser tab. Click 🐛 on any output card — title, severity, program, endpoint, PoC curl, impact, remediation. Everything persists to a local JSON file between sessions. No cloud sync, no account, no third party touching your draft reports. Your loot stays yours.
Hit Generate Report on any tracked finding. You get the exact HackerOne template: CVSS:3.1 vector + numeric score auto-calculated from your severity, OWASP reference matched from the title keywords, impact statement with the business-risk formula triagers actually reward. Copy to clipboard and paste. The part that takes most hunters 30 minutes takes 10 seconds.
Capture the output, fill a few fields, hit generate. The hard part is already done.
Free gets you the full tool on Windows. Pro unlocks every platform and every future update — for less than a coffee.
One-time payment. No subscription. No account required.