Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

Hey HN, I've been working on an intercepting proxy for penetration testing over the last few years in my spare time.

Some points of difference from the existing tools:

* The UIs are built using the native platform frameworks, meaning they look and behave like other applications on the desktop.

* It has a fully embedded and integrated Python scripting engine.

* It’s fully native meaning it’s nicer on system resources.

* It has a number of built in scripts to automate reconnaissance, content discovery, authorisation checks, etc.

* The core of it is open source.

I'm really keen to get any feedback!

Show HN: Pākiki Proxy – An intercepting proxy for penetration testing
pakikiproxy.com

Looks interesting. What would be the main benefits of switching to this from BurpSiute?

Thanks! There's a few points of difference in terms of approach/philosophy.

Firstly, I really wanted to focus on usability. So there's a native UI on each platform, using GTK on Linux, and SwiftUI on MacOS. This means that we can integrate fully with the desktop, and adhere more easily to the human interface guidelines on each platform. I'm also not necessarily trying to go for 1-1 feature parity with Burp, so that I can keep the UI simpler (especially where good standalone tools exist).

I'm trying to target it to be more resource-friendly. Some of my pentesting colleagues at work struggle to run all of their tools in less than 32GB of RAM, and most need 16GB of RAM, and Burp is a not insignificant contributor to that. By comparison, I've been primarily testing this in a Kali VM with 2GB of RAM allocated, and while it doesn't always run smoothly, it often runs pretty well.

Lastly, there's embedded automation with Python scripts. There's a number which are built in, but it's also easy to expand on those and create your own. You can use those for reconnaissance, custom discovery of vulnerabilities or exploitation. I've got plans to expand that engine and capability even further.

Thanks! The tool has a built in certificate authority (CA) to generate TLS certificates. So to intercept TLS traffic from a phone, you export the CA's root certificate and import it onto your phone. If you're on PC, you can also launch a browser preconfigured to intercept traffic.

This is the standard pattern for these kinds of tools.

As it's not always a straightforward process for people who haven't done it before, there's instructions for a variety of platforms in the documentation: https://docs.pakikiproxy.com/#/getting_started/intercepting