Web Application Analysis

caido

caido is the newer take on the intercepting proxy. It does the same essential job as Burp — sit between your browser and the target, let you inspect, tamper with, and replay traffic — but it’s built to be fast and uncluttered, with a clean interface and a workflow that a lot of testers find quicker to move around in. Where Burp is a deep, heavy platform, Caido is deliberately lean. Having both installed means you can reach for whichever fits the job.

Caido is a graphical application, so Oniomarchy launches it straight into its window from Security → Web Application Analysis → caido. Installed from the AUR.

Getting started

  1. Launch Caido and create or open a project.
  2. Route your browser through it. Caido’s proxy also listens on port 8080 by default — which collides with Burp, so if you run both, point one of them at a different port. Your hardened Firefox ships with a FoxyProxy entry ready for Caido.
  3. Trust Caido’s CA the same way as Burp — Trigger → Pentest → Trust Proxy CA imports it into the system trust store. See Quick Attack Actions.
  4. Browse the target, then work the captured requests in Caido’s Replay and automation tabs.

Where it fits

Caido and Burp are interchangeable for the core intercept-and-replay loop — pick the one you like living in. Both feed the same downstream tools: hand a captured request to sqlmap, or fuzz a discovered parameter with ffuf.