Cariddi — Crawl Websites, Hunt Secrets, Find Attack Surface

By Prahlad Menon Published 2026-08-11 2 min read

Bug bounty hunters and pentesters spend hours manually reviewing page sources, looking for leaked API keys, exposed endpoints, and error messages that reveal too much. Cariddi automates all of that.

What It Does

Feed it a list of domains, and Cariddi crawls every URL while scanning for:

Secrets — API keys, tokens, credentials leaked in source/responses
Endpoints — Juicy paths worth investigating
Errors — Debug messages, stack traces, misconfigurations
File extensions — Config files, backups, sensitive documents
Info leaks — Useful metadata in headers and responses

It handles the tedious recon work so you can focus on actual testing.

Quick Start

# Install
brew install cariddi
# or
go install -v github.com/edoardottt/cariddi/cmd/cariddi@latest

# Single target
echo https://target.com | cariddi -s -e -err

# Hunt for secrets, endpoints, and errors
cat urls.txt | cariddi -s -e -err -info

Key Flags

Flag	Purpose
`-s`	Hunt for secrets (API keys, tokens)
`-e`	Hunt for juicy endpoints
`-err`	Hunt for error messages
`-info`	Hunt for useful information
`-ext 2`	Find sensitive files (1=juicy, 7=less juicy)
`-intensive`	Crawl subdomains too
`-proxy http://127.0.0.1:8080`	Route through Burp Suite
`-c 200`	Set concurrency level
`-oh report`	Export as HTML report

Burp Suite Integration

Cariddi plays nicely with Burp. Set -proxy http://127.0.0.1:8080 and watch requests flow through your proxy. The README includes steps for trusting Burp’s certificate system-wide.

Why It’s Useful

Fast — Written in Go, handles high concurrency
Comprehensive — Secrets, endpoints, errors, files, info — all in one pass
Flexible output — TXT, HTML, or JSON
Proxy support — HTTP and SOCKS5
Custom patterns — Bring your own regex for secrets or endpoints

For bug bounty hunters mapping attack surface or pentesters doing recon, this replaces a lot of manual grep work.

GitHub: edoardottt/cariddi