Crawl URLs and scan for endpoints, secrets, file extensions

Install • Usage • Get Started • Changelog • Contributing • License

You need Go (>=1.23)

One-liner: git clone https://github.com/edoardottt/cariddi.git && cd cariddi && go get ./... && make linux

Note that the executable works only in cariddi folder.

If you want to scan only a single target you can use

With multiple targets you can use a file instead, e.g. urls.txt containing:

For Windows:

• use powershell.exe -Command "cat urls.txt | .\cariddi.exe" inside the Command prompt
• or just cat urls.txt | cariddi.exe using PowerShell

• cariddi -version (Print the version)
• cariddi -h (Print the help)
• cariddi -examples (Print the examples)

• cat urls.txt | cariddi -intensive (Crawl searching also subdomains, same as *.target.com)
• cat urls.txt | cariddi -s (Hunt for secrets)
• cat urls.txt | cariddi -err (Hunt for errors in websites)
• cat urls.txt | cariddi -e (Hunt for juicy endpoints)
• cat urls.txt | cariddi -info (Hunt for useful informations in websites)
• cat urls.txt | cariddi -ext 2 (Hunt for juicy (level 2 out of 7) files)
• cat urls.txt | cariddi -e -ef endpoints_file (Hunt for custom endpoints)
• cat urls.txt | cariddi -s -sf secrets_file (Hunt for custom secrets)
• cat urls.txt | cariddi -ie pdf,png,jpg (Ignore these extensions while scanning)

Default: png, svg, jpg, jpeg, bmp, jfif, gif, webp, woff, woff2, ttf, tiff, tif are ignored while scanning for secrets, info and errors.

• cat urls.txt | cariddi -proxy http://127.0.0.1:8080 (Set a Proxy, http and socks5 supported)
• cat urls.txt | cariddi -d 2 (2 seconds between a page crawled and another)
• cat urls.txt | cariddi -c 200 (Set the concurrency level to 200)
• cat urls.txt | cariddi -i forum,blog,community,open (Ignore urls containing these words)
• cat urls.txt | cariddi -it ignore_file (Ignore urls containing at least one line in the input file)
• cat urls.txt | cariddi -cache (Use the .cariddi_cache folder as cache)
• cat urls.txt | cariddi -t 5 (Set the timeout for the requests)
• cat urls.txt | cariddi -headers "Cookie: auth=admin;type=2;; X-Custom: customHeader"
• cat urls.txt | cariddi -headersfile headers.txt (Read from an external file custom headers)
• cat urls.txt | cariddi -ua "Custom User Agent" (Use a custom User Agent)
• cat urls.txt | cariddi -rua (Use a random browser user agent on every request)

• cat urls.txt | cariddi -plain (Print only results)
• cat urls.txt | cariddi -ot target_name (Results in txt file)
• cat urls.txt | cariddi -oh target_name (Results in html file)
• cat urls.txt | cariddi -json (Print the output as JSON in stdout)
• cat urls.txt | cariddi -sr (Store HTTP responses)
• cat urls.txt | cariddi -debug (Print debug information while crawling)
• cat urls.txt | cariddi -md 3 (Max 3 depth levels)

cariddi -h prints the help.

Normally you use Burpsuite within your browser, so you just have to trust the burpsuite's certificate in the browser and you're done.
In order to use cariddi with the BurpSuite proxy you should do some steps further.

If you try to use cariddi with the option -proxy http://127.0.0.1:8080 you will find this error in the burpsuite error log section:

To make cariddi working fine with Burpsuite you have also to trust the certificate within your entire pc, not just only the browser. These are the steps you have to follow:

Go to Proxy tab in Bupsuite, then Options. Click on the CA Certificate button and export Certificate in DER format

Source: Trust Burp Proxy certificate in Debian/Ubuntu

After these steps, in order to use cariddi with Burpsuite you have to:

1. Open Burpsuite, making sure that the proxy is listening.
2. Use cariddi with the flag -proxy http://127.0.0.1:8080.
3. You will see that requests and responses will be logged in Burpsuite.

Detailed changes for each release are documented in the release notes.

Just open an issue/pull request.

Before opening a pull request, download golangci-lint and run

If there aren't errors, go ahead :)

Test using https://edoardottt.github.io/cariddi-test/

Help me build this!

Special thanks to: go-colly, ocervell, zricethezav, projectdiscovery, tomnomnom, RegexPassive and all the contributors.

This repository is under GNU General Public License v3.0.
edoardottt.com to contact me.