Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

pakikiproxy.com

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#31

Post by Fnoord »

Sytten wrote: post #21
KomoD wrote: post #11

So like burp suite...?

If I could get a dollar for each time people tell me Caido is like Burp Suite

Because Burp Suite is the defacto tool for web pentesting. So that is what people know.

I've never liked Burp. Java, requires GUI, and subscription costing 365 USD/year. Where without a license you cannot even do trivial automated stuff (forcing you to click 'OK' all the time; easily circumvented with e.g. AHK).

At the very least a personal license for Pākiki is only 100 USD/year. Which is a lot less barrier of entry for amateurs (if you're a for-profit web pentester /care). How does Caido and Pākiki compare to mitmproxy?

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#32

Post by RockRobotRock »

Fnoord wrote: post #30
pipeline_tux wrote: post #9

Earlier quoted context omitted.

Thanks! The tool has a built in certificate authority (CA) to generate TLS certificates. So to intercept TLS traffic from a phone, you export the CA's root certificate and import it onto your phone. If you're on PC, you can also launch a browser preconfigured to intercept traffic. This is the standard pattern for these kinds of tools. As it's not always a straightforward process for people who haven't done it before,…

Won't work with certificate pinning. Although if you have root, you can even work around that. See this recently on HN mentioned article by Kaspersky [1], using mitmproxy. [1] https://news.ycombinator.com/item?id=38034269

Using Frida has worked well for me in the past :)

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#34

Post by Sytten »

Fnoord wrote: post #31
Sytten wrote: post #21

Earlier quoted context omitted.

If I could get a dollar for each time people tell me Caido is like Burp Suite

Because Burp Suite is the defacto tool for web pentesting. So that is what people know. I've never liked Burp. Java, requires GUI, and subscription costing 365 USD/year. Where without a license you cannot even do trivial automated stuff (forcing you to click 'OK' all the time; easily circumvented with e.g. AHK). At the very least a personal license for Pākiki is only 100 USD/year. Which is a lot less barrier of entry…

We are also at 100USD/y. We both use a client / server architecture. We are both closer to burp suite in terms of functionality (aka focus on finding vulnerabilities, replay (invalid) traffic, mapping sites, etc compared to mitmproxy that is more a developper tool.

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#35

Post by allanrbo »

pipeline_tux wrote: post #17
ValtteriL wrote: post #16

Looks good! Cross platform native GUI and you are doing this all alone? Feels very ambitious. Are you planning to go full time on this? What kind of stack are you using?

Thanks! Yeah, it was definitely an ambitious choice, but I think it results in a better product, and I'm really happy with how it's turning out. For now it's just me part time, but I'm hoping to go full time or near full time next year. In terms of stack, there's an open source core written in Go which exposes an HTTP API. The UIs then use that API. There's a cut down web frontend written in VueJS (useful for forward…

Nice with native desktop UIs! It's like a lost art these days.

Did a desktop app some years back using wxWidgets. Slightly less ambitious than doing separate native UIs for each platform like you're doing here, but still gave me a native enough feel that I was happy with the compromise.

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#37

Post by ping00 »

Goofy_Coyote wrote: post #25

Love it, specially the python scripting engine. Also, don't listen to those who say things like "soo, like Burp?" (the ones who do it to belittle the effort). People used to say (and still do) Postman is "just a wrapper around curl", and I was like, "So is Operating systems, they're a wrapper around hardware, and C is a wrapper around assembly, and Python is a wrapper around "I don't want to manage memory, let's make…

this actually feels like a lightweight feature-rich wrapper, unlike Burp (which I really love btw, not hating on it) which can cause my computer to slow down noticeably with extensions loaded. This is an unfair comparison though, because I derive a lot of value from Burp's BApps and choose to have quite a few of them loaded. The performance hit is worth it to me in this case, but I think it's fantastic to see more lightweight, WYSIWYG (dare I say frugal) alternatives to what's grown into a bulkier tool (Burp). Kind of like XFCE vs GNOME.

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#38

Post by ping00 »

Sytten wrote: post #20

Hi there! Co-founder of Caido ( https://caido.io ) here. Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM. Looks like we are both going after Burp, it's not going to be an easy ride for sure. What we found is it is very hard to make people…

Hi, I took some time to use Caido. I really like it, especially the ability to switch between projects. I also thought the UX that introduces users to the application was well-done. Tbf, I have years of experience with Burp, but I think anyone would have been able to follow along. Nice, clean UI and installation was breezy. Great job! Looking forward to seeing how this project develops, and I wish you success in your competition with the incumbent.

This may be a really broad question, but would you mind touching on why you developed this in Rust? Is that the reason why this application feels snappier than Burp (JVM), or is it just less taxing on system resources? Please feel free to tl;dr it if that's easier :)

Also, the coolest looking feature is the AI assistant undoubtedly -- is there any chance that customers can BYOT in the future and supply a personal OpenAI API token for example?

Re: Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

#40

Post by sneak »

I’m exactly the target market for this.

I won’t pay for subscriptionware. I switched from Premiere to Resolve just to avoid having to be someone’s MRR and I now pirate Lightroom pending its replacement.

It’s a terrible, user-hostile model.

I don’t think developers should be entitled to payment in perpetuity for work they did once.

Post reply on HN