Alternatives to Caido
Web security testing proxy for auditing web applications. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Caido
Web security testing proxy for auditing web applications.
Replacements
Listings that take over the same core job as Caido.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Burp Suite Community Edition offers the standard intercepting proxy and repeater with free Web Security Academy training, but it is Java-based, memory heavy and rate-limits Intruder.
ZAP
Open-source web application security scanner and intercepting proxy.
ZAP is an open-source Apache-2.0 proxy with automated scanning and a CI automation framework included for free, though it is a Java application with a heavy interface.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP pairs manual request inspection with automated scanning tools under an open-source licence, so automation is not held back behind a paid edition.
mitmproxy
An intercepting proxy that decrypts, displays and lets you modify HTTP and HTTPS traffic, with a console, a web interface and a scriptable command-line version.
mitmproxy is an MIT-licensed proxy with console, web and Python scripting interfaces, aimed more at inspecting and modifying app traffic than at structured web auditing.
Similar software
Related functionality, not a direct replacement.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
Dalfox
Check web applications for cross-site scripting issues.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Interactsh
Collect external callbacks during authorized security tests.
SecLists
Find reusable test data for authorized security assessments.
