---
title: "HTTP Proxy"
description: "Caido-powered proxy for request interception and replay"
---

Strix includes [Caido](https://caido.io), a modern HTTP proxy for security testing. Strix routes browser traffic through Caido, so the agent can inspect and modify requests and responses.

## Capabilities

| Feature          | Description                                  |
| ---------------- | -------------------------------------------- |
| Request Capture  | Log all HTTP/HTTPS traffic automatically     |
| Request Replay   | Repeat any request with modifications        |
| HTTPQL           | Query captured traffic with powerful filters |
| Scope Management | Focus on specific domains or paths           |
| Sitemap          | Visualize the discovered attack surface      |

## HTTPQL Filtering

Query captured requests using Caido's HTTPQL syntax

## Request Replay

The agent can take any captured request and replay it with modifications:

- Change path parameters (test for IDOR)
- Modify request body (test for injection)
- Add/remove headers (test for auth bypass)
- Alter cookies (test for session issues)

## Python Integration

Proxy helpers are available to sandbox Python scripts through the image-baked `caido_api` module. This enables powerful scripted security testing:

```python
import asyncio

from caido_api import list_requests, repeat_request, view_request


async def main():
    # List recent POST requests
    post_requests = await list_requests(
        httpql_filter='req.method.eq:"POST"',
        first=20,
    )

    # View a specific request
    request_details = await view_request("req_123", part="request")

    # Replay with modified payload
    response = await repeat_request(
        "req_123",
        modifications={"body": '{"user_id": "admin"}'},
    )
    print(response["status"], request_details is not None, len(post_requests.edges))


asyncio.run(main())
```

### Available Functions

| Function               | Description                                |
| ---------------------- | ------------------------------------------ |
| `list_requests()`      | Query captured traffic with HTTPQL filters |
| `view_request()`       | Get full request/response details          |
| `repeat_request()`     | Replay a request with modifications        |
| `list_sitemap()`       | Browse the request-tree view of discovered surface |
| `view_sitemap_entry()` | Inspect one sitemap entry + its related requests |
| `scope_rules()`        | Manage proxy scope (allowlist/denylist)    |

For one-off requests, use shell tools such as `curl`.
The sandbox routes traffic through Caido with the `HTTP_PROXY` variable.
Caido then adds each request to `list_requests` for replay through `repeat_request`.

### Example: Automated IDOR Testing

```python
import asyncio

# Get all requests to user endpoints
from caido_api import list_requests, repeat_request


async def main():
    user_requests = await list_requests(httpql_filter='req.path.cont:"/users/"')

    for edge in user_requests.edges:
        req = edge.node.request
        scheme = "https" if req.is_tls else "http"
        for test_id in ["1", "2", "admin", "../admin"]:
            url = f"{scheme}://{req.host}{req.path.replace('/users/1', f'/users/{test_id}')}"
            response = await repeat_request(
                req.id,
                modifications={"url": url},
            )
            print(req.id, test_id, response["status"])
            if response["status"] == "DONE":
                print(f"Replay completed for candidate {test_id}")


asyncio.run(main())
```

## Human-in-the-Loop

Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar.

### Accessing Caido

1. Start a scan as usual
2. Find the **Caido** URL in the sidebar stats panel, such as `localhost:52341`
3. Open the URL in Caido Desktop
4. Click **Continue as guest** to access the instance

### What You Can Do

- **Inspect traffic:** Browse HTTP/HTTPS requests that the agent makes
- **Replay requests:** Resend captured requests after you modify them
- **Intercept and modify:** Pause requests, edit them, and forward them
- **Explore the sitemap:** Review the attack surface that the agent discovered
- **Manual testing:** Use Caido tools to test reported findings or unexplored areas

Strix supports collaborative testing. The agent performs automated work while you investigate important areas.

## Scope

Create scopes to filter traffic to relevant domains:

```
Allowlist: ["api.example.com", "*.example.com"]
Denylist: ["*.gif", "*.jpg", "*.png", "*.css", "*.js"]
```