Caido v0.58.0 released

By SecBurg

Caido keeps building on its Rust foundation as a lean, fast alternative to Burp Suite and OWASP ZAP for web security testing.

The new release 0.58.0 brings a notable set of features: a new Replay session type called “Pipeline” for race condition testing, new header and body fields in HTTPQL, a reworked Plugin page, and a customizable sidebar.

Replay sessions now come in three types: HTTP Request, WebSocket, and Pipeline. A Pipeline session groups several requests together and sends them as one run - exactly what you need to test race conditions and other timing-dependent behavior. Two strategies are available: Sequential sends requests one after another, while Last Byte Synchronization holds back the final byte of every request and releases them together so they land on the server at the same moment.

HTTPQL also gets more powerful with dedicated header and body fields on both the request and response namespace, so matching no longer requires scanning the entire raw field:

req.header.name.eq:"Authorization"
req.header["Authorization"].cont:"Bearer"
req.body.regex:"password=[^&]+"
resp.body.cont:"stack trace"

Changelog

Features

Replay Pipeline

Replay sessions now come in three types: HTTP Request, WebSocket, and Pipeline. A Pipeline session groups several requests together and sends them as one run, which is what you need to test race conditions and other timing-dependent behavior.

Create one with New Session and pick Pipeline. Add your requests, choose a Pipeline strategy, then hit Run. Two strategies are available:

  Sequential sends the requests one after the other, in order.
  Last Byte Synchronization holds back the final byte of every request and releases them together, so they land on the server at the same moment.

Header and Body Fields in HTTPQL

HTTPQL now has header and body fields on both the request and response namespace. Until now, matching on either section meant querying raw and scanning the entire request or response.

req.header.name.eq:"Authorization"
req.header["Authorization"].cont:"Bearer"
req.body.regex:"password=[^&]+"
resp.body.cont:"stack trace"

Reworked Plugin Page

The Plugin page has been reworked to make plugins easier to browse and judge before you install them. Plugins now carry an Official badge when maintained by Caido, plus a quality rating, and the list shows author, downloads, and version. You can filter to Official or Community plugins and install or update several at once.

Customizable Sidebar

You can now move sidebar items around. Click Customize to drag pages and plugins into a different order, pin the ones you reach for most, hide what you never use, or add your own categories.

QoL Improvements

Along with bug fixes, we also have a few QoL improvements worth mentioning:

  The editors are now faster when working with large requests and responses.
  Pages and plugins can now be reached with "Go to" in the command palette.
  The same shortcut can now be set on multiple commands.
  Shift clicking a Sitemap element now fully expands it.

Issues

This release also includes other bug fixes and improvements. View the full list of changes at the milestone page.

View the full list of changes.

Happy web-hacking! :-)