Comprehensive Caido web security testing proxy commands and workflows for penetration testing and bug bounty hunting.
Installation
| Command | Description |
|---|
brew install caido | Install Caido on macOS via Homebrew |
curl -fsSL https://caido.io/install.sh | sh | Install Caido on Linux |
caido --version | Show Caido version |
caido | Launch Caido (opens web UI at 127.0.0.1:8080) |
caido --port 9090 | Launch Caido on custom port |
caido --listen 0.0.0.0 | Launch Caido listening on all interfaces |
Proxy Configuration
| Setting | Description |
|---|
Proxy Address: 127.0.0.1:8080 | Default proxy listener address |
Browser → Settings → Proxy → 127.0.0.1:8080 | Configure browser to use Caido proxy |
export http_proxy=http://127.0.0.1:8080 | Set proxy via environment variable |
export https_proxy=http://127.0.0.1:8080 | Set HTTPS proxy via environment variable |
curl -x http://127.0.0.1:8080 https://target.com | Route curl through Caido |
Install CA Certificate from http://127.0.0.1:8080/ca | Trust Caido’s CA for HTTPS interception |
Intercept Mode
| Action | Description |
|---|
>> Forwarding button | Switch to Queuing mode for interception |
|| Queuing button | Currently intercepting requests |
| Forward button | Forward intercepted request to server |
| Drop button | Drop intercepted request |
| Edit request in intercept view | Modify request before forwarding |
| Toggle response interception | Also intercept responses from server |
HTTPQL Query Language
| Query | Description |
|---|
host eq "target.com" | Filter by exact hostname |
host cont "target" | Filter by hostname containing string |
resp.status_code eq 200 | Filter by response status code |
resp.status_code gte 400 | Filter by status code >= 400 |
req.method eq "POST" | Filter by HTTP method |
req.path cont "/api/" | Filter by URL path containing string |
resp.body cont "password" | Filter responses containing text |
req.header cont "Authorization" | Filter by header presence |
resp.length gt 1000 | Filter by response size |
host eq "target.com" AND req.method eq "POST" | Combine filters with AND |
req.path cont "/admin" OR req.path cont "/api" | Combine filters with OR |
Keyboard Shortcuts
| Shortcut | Description |
|---|
Ctrl + R | Send request to Replay |
Ctrl + Shift + R | Send to Automate |
Ctrl + I | Toggle intercept mode |
Ctrl + F | Open search/filter |
Ctrl + P | Open command palette |
Ctrl + K | Quick navigation |
Tab | Switch between panels |
Escape | Close current dialog |
Replay (Request Editor)
| Action | Description |
|---|
| Right-click → Send to Replay | Send any request to Replay tab |
Ctrl + R on selected request | Quick send to Replay |
| Modify headers in Replay | Edit request headers |
| Modify body in Replay | Edit request body |
| Send button in Replay | Execute modified request |
| Create new tab in Replay | Maintain multiple replay sessions |
| Rename replay tab | Organize testing sessions |
Automate (Fuzzing)
| Action | Description |
|---|
Ctrl + Shift + R | Send request to Automate |
| Select text → Insert placeholder | Mark injection point with § |
| Add payload list | Configure wordlist for fuzzing |
| Set payload type: Simple List | Use a list of values |
| Set payload type: Sequence | Use numbered sequence |
| Set payload type: Recursive | Recursive payload generation |
| Configure rate limiting | Control request speed |
| Start automation | Begin automated testing |
| Sort results by status code | Analyze responses |
| Filter results by response length | Find anomalies |
Scope Configuration
| Action | Description |
|---|
| Settings → Scope → Add host | Add target to testing scope |
*.target.com | Wildcard scope for all subdomains |
target.com:443 | Scope with specific port |
| Enable scope filtering | Only show in-scope traffic |
| Exclude out-of-scope hosts | Filter noise from proxy history |
Workflow Automation
| Action | Description |
|---|
| Create new workflow | Build custom automation pipeline |
| Add Passive node | Trigger on matching traffic |
| Add Active node | Modify requests/responses in-flight |
| Add Convert node | Transform data between formats |
| Chain workflow nodes | Build multi-step automation |
| Export workflow | Share workflow configuration |
| Import workflow | Load shared workflow |
Assistant (AI Integration)
| Action | Description |
|---|
| Open Assistant panel | Access AI-powered analysis |
| Ask about request/response | Get AI insights on traffic |
| Generate attack suggestions | AI-recommended test vectors |
| Analyze vulnerability patterns | AI-assisted vulnerability detection |
| Explain response behavior | Understand application logic |
Project Management
| Action | Description |
|---|
| File → New Project | Create new testing project |
| File → Open Project | Open existing project |
| File → Save Project | Save current project state |
| Export findings | Export discovered issues |
| Import requests from file | Load saved requests |
| Tag requests | Organize with custom tags |
| Add notes to requests | Document findings |
Sitemap
| Action | Description |
|---|
| View → Sitemap | Open sitemap panel |
| Expand domain tree | View discovered endpoints |
| Filter by response type | Show specific content types |
| Export sitemap | Save discovered structure |
| Identify hidden endpoints | Review auto-discovered paths |
Plugin System
| Action | Description |
|---|
| Settings → Plugins | Manage installed plugins |
| Browse plugin store | Find community plugins |
| Install plugin | Add new functionality |
| Create custom plugin | Build with Caido SDK |
caido plugin init <name> | Scaffold new plugin project |
caido plugin build | Build plugin for distribution |
Tips and Best Practices
| Tip | Description |
|---|
| Use scope filtering | Reduce noise by focusing on targets |
| Tag interesting requests | Mark findings for later review |
| Use HTTPQL filters | Efficiently search large traffic history |
| Chain workflows | Automate repetitive testing tasks |
| Export findings regularly | Back up discovered vulnerabilities |
| Use keyboard shortcuts | Speed up testing workflow |
| Configure CA cert first | Ensure HTTPS interception works |
| Use Replay for manual testing | Iterate on requests efficiently |
