NahamSec Connects Claude to Caido for AI-Assisted Web App Testing
· 20:20 · Watch on YouTube ↗
Summary
NahamSec demonstrates routing web-testing traffic through Caido on a VPS and connecting it to Claude via MCP and skills. In a training lab, Claude maps API routes from JavaScript, creates replay requests, and checks for possible exposed data and unauthenticated access.
Key points
- The presenter sets up Caido on a VPS and routes web-testing traffic through it, with access via an SSH tunnel.
- Claude connects to Caido's HTTP history through MCP; Caido skills provide additional workflow and SDK capabilities.
- In a training lab, Claude examines JavaScript files, identifies API routes, and creates replay tabs for testing requests.
- The demo checks captured traffic for possible secrets and personal information, and tests whether API endpoints respond without authentication.
- Claude flags possible secrets and personal information, but the presenter says he cannot determine whether the data should have been accessible; no confirmed exposure is established.
- The presenter enables a permission-skipping option for the demonstration and cautions viewers against doing so unless they understand the risks.
Article Details
- Topics
- [00:00] AI-driven hacking agents and automated reconnaissance
- [01:04] Deploying Caido on a VPS and routing testing traffic
- [08:06] Connecting Claude to Caido with MCP and skills
- [11:03] Applying the setup in a free training lab
- [12:20] Extracting API routes from JavaScript and creating replay requests
- [15:49] Searching captured traffic for personal information, secrets, and unauthenticated endpoints
- [18:22] Productivity potential, limitations, and possible next steps