So like burp suite...?
If I could get a dollar for each time people tell me Caido is like Burp Suite
Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
21–30 of 46 posts
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#22Hi there! Co-founder of Caido ( https://caido.io ) here. Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM. Looks like we are both going after Burp, it's not going to be an easy ride for sure. What we found is it is very hard to make people…
Hi!
Yeah, it seems like we've identified similar problems and addressed them in reasonably similar ways. Likewise, I've went with SQLite as the project file format, with the files being compressed when saving so that users can transfer/share the project files easier.
Thanks for the insight on the pricing. I've been working under the assumption that if a few people on my team at work wanted to spend $100US each on tools, that they think would improve their productivity, it'd be a no-brainer and easy to justify.
I definitely think that more competition in this space is good for the industry as a whole, and likewise wish you the best of luck!
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#23Pākiki is a māori verb meaning to probe: https://maoridictionary.co.nz/search?keywords=pakiki The macron (āēīōū) lengthens the vowel sound (Latin has this too) otherwise pronounce the vowels the same as Spanish. Lengthened vowels are harder for most American speakers to get right: https://youtu.be/tPi2jtU7Tl4?t=6m23 Vowel length matters in New Zealand (e.g. pronunciation of can't causes problems). Perhaps could be ad…
Thanks for the suggestion. I've added it to the todo list.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#24Hi there! Co-founder of Caido ( https://caido.io ) here. Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM. Looks like we are both going after Burp, it's not going to be an easy ride for sure. What we found is it is very hard to make people…
Interesting, wasn't aware that there were Burp alternatives being worked on. I'm going to play with both of these to see how they compare. Thanks to both you and OP for sharing!
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#25Love it, specially the python scripting engine.
Also, don't listen to those who say things like "soo, like Burp?" (the ones who do it to belittle the effort).
People used to say (and still do) Postman is "just a wrapper around curl", and I was like, "So is Operating systems, they're a wrapper around hardware, and C is a wrapper around assembly, and Python is a wrapper around "I don't want to manage memory, let's make a web app instead", What's your point?" lol Postman is now worth couple of billions btw.
You're doing a great job - keep at it. Ping me if you needed testers (I work in AppSec/Red teaming).
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#26Hi there! Co-founder of Caido ( https://caido.io ) here. Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM. Looks like we are both going after Burp, it's not going to be an easy ride for sure. What we found is it is very hard to make people…
Hi! Yeah, it seems like we've identified similar problems and addressed them in reasonably similar ways. Likewise, I've went with SQLite as the project file format, with the files being compressed when saving so that users can transfer/share the project files easier. Thanks for the insight on the pricing. I've been working under the assumption that if a few people on my team at work wanted to spend $100US each on too…
We don't currently compress data but we might at some point. We found that the most significant speed increase is by splitting the data into multiple files. Otherwise it becomes very slow at 10-20GB range.
Yes and your 400$ plan is a good idea. But we did the math at 100$ (Port Swigger financial records are public) and it is not easy to make them work as a full time gig. And it's not really possible to get funded just for that market, it would need to 10x to be VC viable.
If you ever want to talk further, do shot me an email (emile [@] caido.io).
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#27Hi, just wanted to say that I walked through this and it's really neat. I'm running it all through WSL on a reasonably powerful laptop (ASUS G14) and performance has been buttery so far. I especially want to commend you on the clear, simple-to-use UX and UI. This will definitely fill a niche for me at work if I have to use an underpowered jumpbox to test internal web applications.
One UX point: I may have missed this, but when I start an injection attack, it would be nice to see a real-time table of the output so that I can see which injections have been tried (kind of like how you can see it in Burp Suite with Logger++ or the sub-window that opens up when you start an Intruder attack). Totally respect a conscious choice to not go down this (potentially) resource-intensive 'view', but curious if that's on the roadmap. Right now I just get a spinning animation after I hit Run, and I don't see any output in the sidebar where it says "Scans will be shown here once they have started".
In all honesty, I probably will stick with Burp Suite for my bread-and-butter web app testing flow (also helps that my org pays for a Pro license), but I want to thank you for the effort put into this and the courage to explore a new modality (web app testing without a resource-heavy proxy tool like Burp).
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#28All proxies intercept.
This one fuzzes, so it's also an injecting proxy.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#29Hi, just wanted to say that I walked through this and it's really neat. I'm running it all through WSL on a reasonably powerful laptop (ASUS G14) and performance has been buttery so far. I especially want to commend you on the clear, simple-to-use UX and UI. This will definitely fill a niche for me at work if I have to use an underpowered jumpbox to test internal web applications. One UX point: I may have missed this…
Thanks for the kind words and feedback!
There should be a real-time table when you're running a scan so that sounds like a bug. Having a real-time table is surprisingly light on resources. I haven't done a huge amount of testing on WSL, so I'll take a look and fix it in the next release.
Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
#30Cool project! I have one question though, how do you intercept TLS. Let’s say i would connect my phone to your proxy, and try to search something on the web. Wouldn't the connection not be trusted?
Thanks! The tool has a built in certificate authority (CA) to generate TLS certificates. So to intercept TLS traffic from a phone, you export the CA's root certificate and import it onto your phone. If you're on PC, you can also launch a browser preconfigured to intercept traffic. This is the standard pattern for these kinds of tools. As it's not always a straightforward process for people who haven't done it before,…
Won't work with certificate pinning. Although if you have root, you can even work around that. See this recently on HN mentioned article by Kaspersky [1], using mitmproxy.