strix/docs/tools/proxy.mdx

---
title: "HTTP Proxy"
description: "Caido-powered proxy for request interception and replay"
---

Strix includes [Caido](https://caido.io), a modern HTTP proxy for security testing. Strix routes browser traffic through Caido, so the agent can inspect and modify requests and responses.

## Capabilities

| Feature          | Description                                  |
| ---------------- | -------------------------------------------- |
| Request Capture  | Log all HTTP/HTTPS traffic automatically     |
| Request Replay   | Repeat any request with modifications        |
| HTTPQL           | Query captured traffic with powerful filters |
| Scope Management | Focus on specific domains or paths           |
| Sitemap          | Visualize the discovered attack surface      |

## HTTPQL Filtering

Query captured requests using Caido's HTTPQL syntax

## Request Replay

The agent can take any captured request and replay it with modifications:

- Change path parameters (test for IDOR)
- Modify request body (test for injection)
- Add/remove headers (test for auth bypass)
- Alter cookies (test for session issues)

## Python Integration

Proxy helpers are available to sandbox Python scripts through the image-baked `caido_api` module. This enables powerful scripted security testing:

```python
import asyncio

from caido_api import list_requests, repeat_request, view_request


async def main():
    # List recent POST requests
    post_requests = await list_requests(
        httpql_filter='req.method.eq:"POST"',
        first=20,
    )

    # View a specific request
    request_details = await view_request("req_123", part="request")

    # Replay with modified payload
    response = await repeat_request(
        "req_123",
        modifications={"body": '{"user_id": "admin"}'},
    )
    print(response["status"], request_details is not None, len(post_requests.edges))


asyncio.run(main())
```

### Available Functions

| Function               | Description                                |
| ---------------------- | ------------------------------------------ |
| `list_requests()`      | Query captured traffic with HTTPQL filters |
| `view_request()`       | Get full request/response details          |
| `repeat_request()`     | Replay a request with modifications        |
| `list_sitemap()`       | Browse the request-tree view of discovered surface |
| `view_sitemap_entry()` | Inspect one sitemap entry + its related requests |
| `scope_rules()`        | Manage proxy scope (allowlist/denylist)    |

For one-off requests, use shell tools such as `curl`.
The sandbox routes traffic through Caido with the `HTTP_PROXY` variable.
Caido then adds each request to `list_requests` for replay through `repeat_request`.

### Example: Automated IDOR Testing

```python
import asyncio

# Get all requests to user endpoints
from caido_api import list_requests, repeat_request


async def main():
    user_requests = await list_requests(httpql_filter='req.path.cont:"/users/"')

    for edge in user_requests.edges:
        req = edge.node.request
        scheme = "https" if req.is_tls else "http"
        for test_id in ["1", "2", "admin", "../admin"]:
            url = f"{scheme}://{req.host}{req.path.replace('/users/1', f'/users/{test_id}')}"
            response = await repeat_request(
                req.id,
                modifications={"url": url},
            )
            print(req.id, test_id, response["status"])
            if response["status"] == "DONE":
                print(f"Replay completed for candidate {test_id}")


asyncio.run(main())
```

## Human-in-the-Loop

Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar. Click the URL to copy it, then open it in Caido Desktop.

### Accessing Caido

1. Start a scan as usual
2. Find the **Caido** URL in the sidebar stats panel, such as `localhost:52341`
3. Open the URL in Caido Desktop
4. Click **Continue as guest** to access the instance

### What You Can Do

- **Inspect traffic:** Browse HTTP/HTTPS requests that the agent makes
- **Replay requests:** Resend captured requests after you modify them
- **Intercept and modify:** Pause requests, edit them, and forward them
- **Explore the sitemap:** Review the attack surface that the agent discovered
- **Manual testing:** Use Caido tools to test reported findings or unexplored areas

Strix supports collaborative testing. The agent performs automated work while you investigate important areas.

## Scope

Create scopes to filter traffic to relevant domains:

```
Allowlist: ["api.example.com", "*.example.com"]
Denylist: ["*.gif", "*.jpg", "*.png", "*.css", "*.js"]
```