So like burp suite...?
Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
11–20 of 46 posts
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#12So like burp suite...?
Correct. Burp is the main competitor, but it's been around a long time and I wanted to develop something from scratch to address a number of the problems myself and other pentesters have had with it.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#13So like burp suite...?
Correct. Burp is the main competitor, but it's been around a long time and I wanted to develop something from scratch to address a number of the problems myself and other pentesters have had with it.
Nice to see another tool, but what exactly are some of those problems you/others are having?
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#14Does this work on applications with SSL pinning?
No, it doesn't unfortunately. In a professional testing world, we'd normally just ask clients nicely to disable that for our testing. If you're testing something where you don't have a relationship with the developers, then Frida is my go-to tool to get around that. Although once you've disabled SSL pinning, you can use Pākiki to intercept the traffic itself.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#15Earlier quoted context omitted.
Correct. Burp is the main competitor, but it's been around a long time and I wanted to develop something from scratch to address a number of the problems myself and other pentesters have had with it.
Nice to see another tool, but what exactly are some of those problems you/others are having?
Usability and performance (for example when deployed on lower-end customer machines) are two major ones. Admittedly they have been getting better over time.
It's also not uncommon to have sites behave a bit differently when running via Burp, so given it's not open source, it can be hard to diagnose/debug what's going on.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#16Looks good!
Cross platform native GUI and you are doing this all alone? Feels very ambitious.
Are you planning to go full time on this?
What kind of stack are you using?
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#17Looks good! Cross platform native GUI and you are doing this all alone? Feels very ambitious. Are you planning to go full time on this? What kind of stack are you using?
Thanks! Yeah, it was definitely an ambitious choice, but I think it results in a better product, and I'm really happy with how it's turning out. For now it's just me part time, but I'm hoping to go full time or near full time next year.
In terms of stack, there's an open source core written in Go which exposes an HTTP API. The UIs then use that API. There's a cut down web frontend written in VueJS (useful for forward deployments), a GTK frontend for Linux written in Vala, and the MacOS version is using Swift/SwiftUI (with some use of AppKit where that's not applicable).
Then (because this isn't ambitious enough) once those are polished, I plan on doing a native Windows frontend too (likely using C# with WinUI 3, but to be confirmed).
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#18Cool project! I have one question though, how do you intercept TLS. Let’s say i would connect my phone to your proxy, and try to search something on the web. Wouldn't the connection not be trusted?
I'm not entirely sure if it is the case here, but many tools that intercept TLS have you trust a certificate in the OS or browser level that they then use as a MITM on the proxy to be able to decrypt the requests
I previously used Proxyman [1] on iOS to the http requests send over TLS. It worked rather nicely. Proxyman in this case starts a VPN which handles all the traffic. It uses custom certificate to decrypt the messages.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#19Pākiki is a māori verb meaning to probe: https://maoridictionary.co.nz/search?keywords=pakiki
The macron (āēīōū) lengthens the vowel sound (Latin has this too) otherwise pronounce the vowels the same as Spanish. Lengthened vowels are harder for most American speakers to get right: https://youtu.be/tPi2jtU7Tl4?t=6m23 Vowel length matters in New Zealand (e.g. pronunciation of can't causes problems).
Perhaps could be added to the docs?
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#20Hi there! Co-founder of Caido (https://caido.io) here.
Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM.
Looks like we are both going after Burp, it's not going to be an easy ride for sure. What we found is it is very hard to make people in enterprise switch and the 100$/y pricing really isn't enough to build a serious business without enterprise clients at a higher price point.
Anyway, best of luck!