scanner - Vulnerability scanner for Caido

项目说明

<di="center">
<img width="1000" alt="image" src="

<br />
<br />
<a href=" target="_blank">Github</a>
<span>&nbsp;&nbsp;•&nbsp;&nbsp;</span>
<a href=" target="_blank">Documentation</a>
<span>&nbsp;&nbsp;•&nbsp;&nbsp;</span>
<a href=" target="_blank">Discord</a>
<br />
<hr />
</div>

Scanner

A web scanner plugin for Caido.

About Scanner

Scanner is a detection plugin that brings automated security testing capabilities to Caido. Scanner provides a user-friendly interface for identifying common web application .

<video src="docs/demo.mp4" controls preload></video>

🚀 Getting Started

Installation [Recommended]

1. Open Caido, na to the Plugins sidebar page and then to the Community Store tab
2. Find Scanner and click Install
3. Done! 🎉

Installation [Manual]

1. Go to the Scanner Releases tab and download the latest plugin_package.zip file
2. In your Caido instance, na to the Plugins page, click Install and select the downloaded plugin_package.zip file
3. Done! 🎉

💚 Community

Join our Discord community and connect with other Caido users! Share your ideas, ask questions, and get in in discussions around Caido and security testing.

🧑‍💻 De Documentation

Scanner Structure

The project is organized into distinct packages: backend, frontend, engine, and shared. The engine package is responsible for all the logic related to executing checks. All checks are located within the packages/backend/src/checks/ directory.

Check Definition

To define your own check, use the defineCheck function as shown below. The check metadata contains static information about the check, some fields, such as id, are always required, while others are used for filtering.

Check Metadata

The CheckMetadata type is a crucial part of defining a check, as it contains all the static information about the check. Here's a breakdown of its components:

Steps

Steps let you break your check into smaller parts. Each step should be simple and quick. End a step with done(...) or go to the next step with continueWith({ state, nextStep: '...' }).

State allows you to pass data from one step to another within your check. When you define a state for your check, you must also provide an initState function in your return statement that sets the initial value for your state. Context gives you access to the Caido Backend SDK, the scanner engine runtime SDK (which will be explained later), as well as the target request and response.

Checks Engine

The checks engine is built around a step-based execution model that allows responsive and interruptible scans. Each check is composed of sequential steps that can pass data through state, send requests, and produce findings.

Steps

Steps are the fundamental building blocks of a check in the engine. Steps are executed sequentially, and each execution of a step is called a "tick".

Keeping each tick short is important. After every tick, the engine checks if the scan has been aborted. If a step were to perform multiple long-running actions (like sending several requests in a loop), the user would have to wait for all of them to finish. By designing checks so that each step only sends one request or performs a small piece of logic, we ensure that the engine remains responsive and can quickly react to user actions or scan interruptions.

When you need to perform multiple actions (such as sending several requests), structure your check so that each action happens in its own step. This way, each tick is short, and the engine can efficiently manage scan flow and user interactions.

A common pattern in checks is to create loops by reusing the same step in nextStep. This allows you to perform iterati like testing multiple paths or parameters. Once your loop condition is met, you can either return done() to complete the check or continue() to proceed to subsequent steps.

Context

Context provides access to:

Runtime SDK

The runtime SDK is a set of utilities specifically scoped to the current scan.

Dependencies

Use dependencies to pass outputs from one check to another.

Example: provider check that exposes an output

Example: consumer check that depends on the provider

#### Notes

Utilities

The engine provides helper utilities you can use inside checks. Two commonly used ones are redirection detection and URL bypass payload generation.

Redirection detection

Detects whether a response leads to a redirect and extracts its destination. It covers HTTP 3xx with Location header, Refresh header, HTML meta refresh/location, base tag, and Ja redirects.

URL bypass payload generator

Generates a sequence of URL payload recipes that attempt to bypass nai. Each recipe can produce a payload string value and that a resulting redirect points to the attacker host. You can filter techniques or limit the number of generated recipes.

Filter or cap techniques:

#### Example: iterate payloads and a redirect

🤝 Contributing

Feel free to contribute! If you'd like to request a feature or report a bug, please create a GitHub Issue.

Ways to Contribute

Add a New Check

> [!NOTE]
> All checks live in packages/backend/src/checks. Each check uses a folder with two files: index.ts and index.spec.ts. As the logic gets more complicated, you can spread it into multiple files within the same folder.

#### 1) Scaffold

Create a new folder and add your implementation and tests:

Follow the check patterns in the existing checks. Implement your check with the engine step model and add unit tests in index.spec.ts.

#### 2) Register the Check

Open packages/backend/src/checks/index.ts and:

#### 3) Add to Presets

Open packages/backend/src/stores/config.ts and include your check in default presets. Always add it to the Hea as enabled. Depending on aggressivity and type, you may also add it to Light or Balanced.

Decide whether your check belongs to active or passive based on metadata.type in your check.

#### 4) Locally

Run formatting, types, tests, and a build from the repo root:

项目信息

开发语言：TypeScript

Star 数：57

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Vulnerability scanner for Caido展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。