Cariddi

What it is

Cariddi is installed and driven entirely from the shell, taking target URLs on stdin (echo url | cariddi or cat urls.txt | cariddi). The existing summary covers its purpose; what follows is the operational detail needed to actually run it.

Install

Multiple package channels exist, so you likely don't need to build from source:

brew install cariddi
sudo snap install cariddi
go install -v github.com/edoardottt/cariddi/cmd/cariddi@latest
pacman -Syu cariddi
nix-shell -p cariddi

Building from source requires Go >= 1.24.0. Note: a source build via make linux produces an executable that "works only in cariddi folder."

Key flags that shape scope

• -intensive — crawls subdomains matching the 2nd-level domain (i.e. *.target.com), materially widening scope beyond the seeded URLs.
• -md N — maximum crawl depth from the initial URL; -d N sets seconds of delay between pages; -c N sets concurrency (default 20).
• -ext N — juicy-file hunting on a 1 (most juicy) to 7 (least) scale, not a boolean.
• -s -sf secrets_file and -e -ef endpoints_file — swap in custom regex/parameter lists for secret and endpoint hunting.
• Scanning excludes a long default list of binary/media extensions (png, svg, jpg, woff, mp4, etc.) for secret/info/error hunts; -ie pdf,png extends the ignore list.
• Output: -json to stdout, -ot/-oh for TXT/HTML files, -sr to store raw HTTP responses, -plain for results only.

Burp Suite proxy caveat

The -proxy http://127.0.0.1:8080 flag supports HTTP and socks5, but pointing it at Burp does not work out of the box the way a browser does. The page states that trusting Burp's cert in your browser is insufficient; running cariddi through the proxy produces a Burp error-log entry:

Received fatal alert: bad_certificate

Extra setup steps are required on the cariddi side. (The fetched page text is truncated mid-instruction — "To make cariddi working fi…" — so the actual fix is not reproduced here; consult the "How to integrate cariddi with Burpsuite" section on the page before relying on Burp interception.)

What to do

If you plan to intercept cariddi traffic in Burp, budget time for the certificate workaround rather than assuming the -proxy flag alone suffices. For scoping, remember -intensive expands to sibling subdomains and -ext is a 1–7 granularity dial, not on/off — both affect how noisy and broad a run gets.