Hacker News Reader

Comment by KomoD | Hacker News Reader

So like burp suite...?

Correct. Burp is the main competitor, but it's been around a long time and I wanted to develop something from scratch to address a number of the problems myself and other pentesters have had with it.

Nice to see another tool, but what exactly are some of those problems you/others are having?

Usability and performance (for example when deployed on lower-end customer machines) are two major ones. Admittedly they have been getting better over time.

It's also not uncommon to have sites behave a bit differently when running via Burp, so given it's not open source, it can be hard to diagnose/debug what's going on.

If I could get a dollar for each time people tell me Caido is like Burp Suite

Because Burp Suite is the defacto tool for web pentesting. So that is what people know.

I've never liked Burp. Java, requires GUI, and subscription costing 365 USD/year. Where without a license you cannot even do trivial automated stuff (forcing you to click 'OK' all the time; easily circumvented with e.g. AHK).

At the very least a personal license for Pākiki is only 100 USD/year. Which is a lot less barrier of entry for amateurs (if you're a for-profit web pentester /care). How does Caido and Pākiki compare to mitmproxy?

We are also at 100USD/y. We both use a client / server architecture. We are both closer to burp suite in terms of functionality (aka focus on finding vulnerabilities, replay (invalid) traffic, mapping sites, etc compared to mitmproxy that is more a developper tool.

Reply on news.ycombinator.com