mirror of
https://github.com/usestrix/strix.git
synced 2026-08-17 01:29:42 +02:00
135 lines
4.5 KiB
Plaintext
135 lines
4.5 KiB
Plaintext
---
|
|
title: "HTTP Proxy"
|
|
description: "Caido-powered proxy for request interception and replay"
|
|
---
|
|
|
|
Strix includes [Caido](https://caido.io), a modern HTTP proxy for security testing. Strix routes browser traffic through Caido, so the agent can inspect and modify requests and responses.
|
|
|
|
## Capabilities
|
|
|
|
| Feature | Description |
|
|
| ---------------- | -------------------------------------------- |
|
|
| Request Capture | Log all HTTP/HTTPS traffic automatically |
|
|
| Request Replay | Repeat any request with modifications |
|
|
| HTTPQL | Query captured traffic with powerful filters |
|
|
| Scope Management | Focus on specific domains or paths |
|
|
| Sitemap | Visualize the discovered attack surface |
|
|
|
|
## HTTPQL Filtering
|
|
|
|
Query captured requests using Caido's HTTPQL syntax
|
|
|
|
## Request Replay
|
|
|
|
The agent can take any captured request and replay it with modifications:
|
|
|
|
- Change path parameters (test for IDOR)
|
|
- Modify request body (test for injection)
|
|
- Add/remove headers (test for auth bypass)
|
|
- Alter cookies (test for session issues)
|
|
|
|
## Python Integration
|
|
|
|
Proxy helpers are available to sandbox Python scripts through the image-baked `caido_api` module. This enables powerful scripted security testing:
|
|
|
|
```python
|
|
import asyncio
|
|
|
|
from caido_api import list_requests, repeat_request, view_request
|
|
|
|
|
|
async def main():
|
|
# List recent POST requests
|
|
post_requests = await list_requests(
|
|
httpql_filter='req.method.eq:"POST"',
|
|
first=20,
|
|
)
|
|
|
|
# View a specific request
|
|
request_details = await view_request("req_123", part="request")
|
|
|
|
# Replay with modified payload
|
|
response = await repeat_request(
|
|
"req_123",
|
|
modifications={"body": '{"user_id": "admin"}'},
|
|
)
|
|
print(response["status"], request_details is not None, len(post_requests.edges))
|
|
|
|
|
|
asyncio.run(main())
|
|
```
|
|
|
|
### Available Functions
|
|
|
|
| Function | Description |
|
|
| ---------------------- | ------------------------------------------ |
|
|
| `list_requests()` | Query captured traffic with HTTPQL filters |
|
|
| `view_request()` | Get full request/response details |
|
|
| `repeat_request()` | Replay a request with modifications |
|
|
| `list_sitemap()` | Browse the request-tree view of discovered surface |
|
|
| `view_sitemap_entry()` | Inspect one sitemap entry + its related requests |
|
|
| `scope_rules()` | Manage proxy scope (allowlist/denylist) |
|
|
|
|
For one-off requests, use shell tools such as `curl`.
|
|
The sandbox routes traffic through Caido with the `HTTP_PROXY` variable.
|
|
Caido then adds each request to `list_requests` for replay through `repeat_request`.
|
|
|
|
### Example: Automated IDOR Testing
|
|
|
|
```python
|
|
import asyncio
|
|
|
|
# Get all requests to user endpoints
|
|
from caido_api import list_requests, repeat_request
|
|
|
|
|
|
async def main():
|
|
user_requests = await list_requests(httpql_filter='req.path.cont:"/users/"')
|
|
|
|
for edge in user_requests.edges:
|
|
req = edge.node.request
|
|
scheme = "https" if req.is_tls else "http"
|
|
for test_id in ["1", "2", "admin", "../admin"]:
|
|
url = f"{scheme}://{req.host}{req.path.replace('/users/1', f'/users/{test_id}')}"
|
|
response = await repeat_request(
|
|
req.id,
|
|
modifications={"url": url},
|
|
)
|
|
print(req.id, test_id, response["status"])
|
|
if response["status"] == "DONE":
|
|
print(f"Replay completed for candidate {test_id}")
|
|
|
|
|
|
asyncio.run(main())
|
|
```
|
|
|
|
## Human-in-the-Loop
|
|
|
|
Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar.
|
|
|
|
### Accessing Caido
|
|
|
|
1. Start a scan as usual
|
|
2. Find the **Caido** URL in the sidebar stats panel, such as `localhost:52341`
|
|
3. Open the URL in Caido Desktop
|
|
4. Click **Continue as guest** to access the instance
|
|
|
|
### What You Can Do
|
|
|
|
- **Inspect traffic:** Browse HTTP/HTTPS requests that the agent makes
|
|
- **Replay requests:** Resend captured requests after you modify them
|
|
- **Intercept and modify:** Pause requests, edit them, and forward them
|
|
- **Explore the sitemap:** Review the attack surface that the agent discovered
|
|
- **Manual testing:** Use Caido tools to test reported findings or unexplored areas
|
|
|
|
Strix supports collaborative testing. The agent performs automated work while you investigate important areas.
|
|
|
|
## Scope
|
|
|
|
Create scopes to filter traffic to relevant domains:
|
|
|
|
```
|
|
Allowlist: ["api.example.com", "*.example.com"]
|
|
Denylist: ["*.gif", "*.jpg", "*.png", "*.css", "*.js"]
|
|
```
|