Web & API
Caido
Modern intercepting proxy for manual web and API testing with a workflow-oriented UI.
What it is
Caido is an alternative to Burp for intercept, replay, and organized manual testing. Community covers core proxy work; paid tiers add workflows. Useful when several operators share a remote instance on the jump box.
Reach for it when
Manual web/API testing where you want a fast intercept/replay loop and shared projects, without a scanner-first workflow.
Watch-outs
Same RoE as any proxy: scope filter on, no automatic fuzzing of state-changing routes, and no saving of ePHI or PAN in local history. Check whether the client allows a hosted Caido instance.
Typical invocation
Point the browser at the local Caido proxy, set in-scope hosts, replay access-control cases in Replay.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.
- OWASP ZAP
Open-source intercepting proxy and scanner for web and API assessments.
- ffuf
Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.