Cariddi

What it is

Cariddi is a command-line recon tool written in Go by Edoardo Ottavianelli. You pipe in a list of URLs, it crawls each target, and it reports interesting findings from the pages it visits. It is open source under GPL-3.0 and is installable through Homebrew, Snap, or go install.

What it helps with

- Crawling a list of URLs to map reachable pages and resources
- Hunting for leaked secrets such as API keys and tokens with built-in or custom regexes
- Finding juicy endpoints and specific file extensions during reconnaissance
- Spotting error messages and useful information in responses
- Tuning crawl depth, delay between requests, and subdomain coverage with the intensive mode

Who it's for

Bug bounty hunters, penetration testers, and application security teams who need fast recon on web targets they are allowed to test.

Worth knowing

Use Cariddi only against websites you own or have written permission to test, since it actively crawls targets and searches their content. Set a delay between requests to avoid overloading a site. It can send traffic through a proxy such as Burp Suite for deeper review.

Can I add my own secret patterns?
Yes, you can pass a text file of custom regexes for secrets or endpoints, one per line.

How does it compare with katana and httpx?
In our view katana is the stronger general-purpose crawler and httpx is for probing which hosts are live, while Cariddi stands out for scanning crawled content for secrets and endpoints in one pass.

Does it only scan the domains I give it?
By default it stays on the given targets, and the intensive flag widens the crawl to resources on the same second-level domain.