Corb3nik Introduces His Tool: Caido

So, who is Corb3nik?

My name is Ian, also known as Corb3nik on social media. I’m a long time CTF enthusiast and bug bounty hunter. Currently, I’m the co-founder for a web security toolkit called Caido!

Tell me about the moment Caido was conceptualized. What was the Catalyst for, “Yeah, this needs to change.”

Starting a business has always been a goal of mine. As for finding the right idea, the inspiration came mostly from my own experience as a bug bounty hunter, as well as comments from friends in the security industry.
When talking to people, the common theme was the lack of options when it came to choosing web testing tools. That was pretty much the “This needs to change moment”: it was clear that there’s opportunity for a modern take in this space.

Love to see this was created in Rust! Was it your first choice, or were there any other languages that stood as contenders? What made it your go to? 

Rust was my immediate choice for this project. The fact that the language offered similar performances to a low level language like C, but offered the memory safety of a high level language like Java fascinated me.

We wanted Caido to be as fast and memory efficient as possible, so it made sense to go for a language like Rust.

The Go language was another option, but I was more familiar with Rust’s reputation (Rust being the one of the most loved languages on StackOverflow). 

It was a language I had never played with before, therefore a great learning opportunity too.

I remember we spoke about the identity of Caido being a collaborative tool? Can you tell me more about that? 

A fun part of starting a project from scratch is the opportunity to innovate. 

In the case of Caido, we went for a client-server design instead of a monolithic desktop app. This enables us to do things like hosting the tool on a VPS, automating in headless mode with a GraphQL API, and having multiple users work together on the same project.

This allows us to tackle interesting challenges like collaboration, whether it’s pentesters working together to create a report, or bug bounty hunters wanting to share interesting endpoints. 

We haven’t figured out the details on how we want to integrate it all yet, but we’ve laid the groundwork for some really cool collaboration ideas!

What features does Caido currently include? What would you like there to be in the future? 

These past few months, we’ve been working on the features most used by the community so far: intercepting, replaying, filtering and scoping requests; generating sitemaps; and automating requests.

As for the near future, we have a lot of features we’re looking forward to: 

• An easy-to-use plugin system that would allow users to make plugins without prior programming experience
• An evidence box to share requests/notes between users
• An OOB service for DNS/HTTP exfiltration

What utility does Caido have for those in the bug-hunting space? How can they use it? Can you provide an example? 

The fact that Caido uses a client-server architecture opens up many different approaches on how to use the tool. 

We expose a GraphQL API allowing users to integrate Caido in their automation pipeline (starting scans automatically for example). 
Users can also host Caido on a VPS. Allowing them to do things like starting automation tasks on their laptop, checking the status of the task on their mobile device, leaving the task running overnight without having to keep your laptop open, etc.

Caido was designed to be as flexible as possible, so there’s no “right way” to use it :)

A note from Corb3nik:

Caido has been the culmination of almost two years of work by @TheSytten, @Christos1771 and I. Our goal is to make security tooling as accessible and easy-to-use as possible.

We’re looking forward to releasing it to the public in the next few months and hearing the feedback from the security community.

You can find more information about Caido at their website/beta registration form, Twitter, and view their roadmap on Github.