National Cyber Warfare Foundation (NCWF)

Welcome back, hacker novitiates! In this lesson, we’re diving into Caido, a modern and lightweight web security auditing toolkit designed to simplify your web application security testing. Let’s walk through what Caido is, how to get started, and what powerful features it offers. Step 1: What Is Caido? Caido is a web security auditing toolkit […]

The post Web App Hacking: Getting Started with Caido first appeared on Hackers Arise.

Welcome back, hacker novitiates!

In this lesson, we’re diving into Caido, a modern and lightweight web security auditing toolkit designed to simplify your web application security testing.

Let’s walk through what Caido is, how to get started, and what powerful features it offers.

Step 1: What Is Caido?

Caido is a web security auditing toolkit that acts as an interception proxy between your browser (or other HTTP client) and your target web applications. It allows you to inspect, manipulate, and replay HTTP/S and WebSocket traffic in real-time, making it easier to discover and exploit security vulnerabilities. Sounds similarly like Burp Suite or ZAP, isn’t it?

Here is a brew overview of Caido, Burp Suite and ZAP:

Tool	Caido	Burp Suite	ZAP
Purpose	Web security testing	Web security testing	Web security testing
Intercept Proxy	Yes	Yes	Yes
Repeater/Editor	Yes	Yes	Yes
Scanner	(Not built-in yet)	(Pro version)	Yes
Open Source	Proprietary	Proprietary	Open-source
Platform	Cross-platform (Docker/native)	Cross-platform	Cross-platform

Why people choose Caido:

Modern and lightweight

Easier for beginners

Ideal for manual testing and request manipulation

Actively developed and responsive to community feedback

Step 2: Installing Caido

Getting Caido up and running is straightforward:

Download the latest installer or packagefor your OS from Caido’s official website or GitHub releases.

Install .deb file via terminal:

kali> sudo dpkg -i caido-desktop-v[version].deb

Launch Caido and start the instance.

Optionally create an account or proceed in guest mode.

After that, you will be greeted by a screen like below.

Next, to intercept requests, we need to install a proxy in the browser. I’ve shown how to do this in my article about ZAP.

Step 3: Navigation

On the left-hand side of Caido is a navigation menu that contains the different feature interfaces. Clicking on a listed feature will present its own page.

Step 4: Using Caido

The Intercept, Replay, and Automate feature interfaces allow you to view, modify, and control web traffic.

Intercept

With Caido running and the proxy settings enabled, clicking the >> Forwarding button will switch Caido to || Queuing mode. In this mode, you can intercept requests before they are sent to the server or intercept responses before they are sent to your browser.

From the Intercept interface, you can choose to intercept requests, responses, or both by clicking the corresponding buttons. A pause icon will appear when intercept is enabled, and two right-facing carets will appear when it is disabled.

As web traffic accumulates, you can view all intercepted requests and responses in the Intercept traffic tables.

Replay

By clicking on a request, you can send it to Replay using the keyboard shortcut Ctrl + R, or by right-clicking and selecting Send to Replay from the context menu.

Here, we can manipulate our requests and view the responses from the server.

Step 5: Caido vs Burp Suite

Up to this point, we’ve covered the basic functionality of Caido, similar to what’s available in tools like Burp Suite. Now, let’s look at some features that make it unique.

Project Management

Caido’s built-in project management system helps keep your work organized and makes managing targets effortless. You can easily switch between different targets as needed.

Intuitive Filtering

With HTTPQL, you can easily search and filter requests using a simple, user-friendly query language.

Built for Speed

While Burp Suite struggles with resource efficiency, Caido is built from the ground up in Rust to deliver a fast experience with low memory usage and unparalleled performance.

Summary

At this point, you might think that Caido doesn’t offer anything significantly different from Burp Suite. However, I highly recommend installing Caido and trying it out for yourself—experiment with it. This article only scratches the surface of what Caido has to offer. It might just become your next go-to tool for web app hacking.

If you want to start learning web hacking, check out our Web App Hacking course — it covers everything you need to know to begin.