diff --git a/.vitepress/components/Lab.vue b/.vitepress/components/Lab.vue new file mode 100644 index 00000000..9f17158e --- /dev/null +++ b/.vitepress/components/Lab.vue @@ -0,0 +1,58 @@ + + + + + diff --git a/.vitepress/theme/index.ts b/.vitepress/theme/index.ts index ced7f6f7..282f6132 100644 --- a/.vitepress/theme/index.ts +++ b/.vitepress/theme/index.ts @@ -6,6 +6,7 @@ import DefaultTheme from "vitepress/theme"; import Icon from "../components/Icon.vue"; import Mermaid from "../components/Mermaid.vue"; import ProContainer from "../components/Pro.vue"; +import LabContainer from "../components/Lab.vue"; import "./custom.css"; import Layout from "./Layout.vue"; @@ -18,5 +19,6 @@ export default { app.component("ProContainer", ProContainer); app.component("Mermaid", Mermaid); app.component("Icon", Icon); + app.component("LabContainer", LabContainer); }, } satisfies Theme; diff --git a/src/app/guides/assistant_csrf.md b/src/app/guides/assistant_csrf.md index ea41a8e4..4aefe9d7 100644 --- a/src/app/guides/assistant_csrf.md +++ b/src/app/guides/assistant_csrf.md @@ -5,9 +5,11 @@ description: "A step-by-step guide to using Caido's AI Assistant to generate Cro # Generating CSRF PoCs -The Assistant are only available to users with Individual or Team tier subscriptions. +The Assistant is only available to users with Individual or Team tier subscriptions. + + ::: warning Submitted data is sent to a third-party (OpenAI) and can be stored for up to 30 days. Due to this, **anonymize sensitive data** when using the Assistant. Sensitive data may be unintentionally submitted when using the Assistant context menu options. Before using any context menu option, manually review all content to ensure no sensitive data is included. For more information, review: diff --git a/src/app/guides/assistant_explain.md b/src/app/guides/assistant_explain.md index e25df78c..d940b5ec 100644 --- a/src/app/guides/assistant_explain.md +++ b/src/app/guides/assistant_explain.md @@ -5,7 +5,7 @@ description: "A step-by-step guide to using Caido's AI Assistant to explain HTTP # Prompting the Assistant to Explain Requests -The Assistant are only available to users with Individual or Team tier subscriptions. +The Assistant is only available to users with Individual or Team tier subscriptions. ::: warning diff --git a/src/app/guides/assistant_model.md b/src/app/guides/assistant_model.md index 137b0b54..0e610993 100644 --- a/src/app/guides/assistant_model.md +++ b/src/app/guides/assistant_model.md @@ -5,7 +5,7 @@ description: "A step-by-step guide to changing the LLM model in Caido's AI Assis # Changing the LLM Model -The Assistant are only available to users with Individual or Team tier subscriptions. +The Assistant is only available to users with Individual or Team tier subscriptions. ::: warning diff --git a/src/app/guides/automate_multiple.md b/src/app/guides/automate_multiple.md index 90a529a4..af5805f6 100644 --- a/src/app/guides/automate_multiple.md +++ b/src/app/guides/automate_multiple.md @@ -86,3 +86,7 @@ The Matrix strategy will test all the possible combinations of payload values ac | 7 | username=`chriscremesure`&password=`password` | | 8 | username=`chriscremesure`&password=`admin` | | 9 | username=`chriscremesure`&password=`123` | + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/automate_null.md b/src/app/guides/automate_null.md index ed8fd660..e1dbcaa7 100644 --- a/src/app/guides/automate_null.md +++ b/src/app/guides/automate_null.md @@ -17,3 +17,7 @@ This option will present a `Number of payloads to generate` input field that all Once the number has been specified, **click** on the `Run` button to launch the Automate session. A new tab will be generated that contains a traffic table of the requests. To view the results of the session, **click** on this paired tab. The traffic table of Automate session requests. + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/automate_numerical.md b/src/app/guides/automate_numerical.md index 4057ae28..91591c2f 100644 --- a/src/app/guides/automate_numerical.md +++ b/src/app/guides/automate_numerical.md @@ -21,3 +21,7 @@ To account for multi-digit numbers, ensure to set an appropriate value for the ` Once the configuration has been made, **click** on the `Run` button to launch the Automate session. A new tab will be generated that contains a traffic table of the payload requests. To view the results of the session, **click** on this paired tab. The traffic table of Automate session requests. + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/automate_preprocessors.md b/src/app/guides/automate_preprocessors.md index 37137354..05905d19 100644 --- a/src/app/guides/automate_preprocessors.md +++ b/src/app/guides/automate_preprocessors.md @@ -57,3 +57,7 @@ By selecting either `Prefix` or `Suffix` from the Preprocessor type drop-down me Any added Preprocessors are displayed in the `Active preprocessors` list and are applied to payloads in ascending order. To reorder their application, **click** on a Preprocessor from the list and use the and buttons. The list of applied Preprocessors. + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/automate_rate_limiting.md b/src/app/guides/automate_rate_limiting.md index e345cd5d..dbf04b9c 100644 --- a/src/app/guides/automate_rate_limiting.md +++ b/src/app/guides/automate_rate_limiting.md @@ -7,3 +7,7 @@ description: "A step-by-step guide to configuring rate limiting and concurrency By **clicking** on the `Settings` tab of an Automate session, you can control the rate at which Automate sessions send requests via the `Delay (ms) between requests` and `# of workers` input fields. Concurrency settings for Automate sessions. + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/automate_wordlists.md b/src/app/guides/automate_wordlists.md index 26dfff47..fe8814c9 100644 --- a/src/app/guides/automate_wordlists.md +++ b/src/app/guides/automate_wordlists.md @@ -21,3 +21,7 @@ Once a placeholder has been marked, you will be presented with options in the `P Once a selection has been made, **click** on the `Run` button to launch the Automate session. A new tab will be generated that contains a traffic table of the payload requests. To view the results of the session, **click** on this paired tab. The traffic table of Automate session requests. + +::: info +If `Close Connection` is disabled in the `Settings` tab, the TCP connection is maintained through the session until it is terminated by the server. +::: diff --git a/src/app/guides/filters_httpql.md b/src/app/guides/filters_httpql.md index 10f0bdac..690a3d05 100644 --- a/src/app/guides/filters_httpql.md +++ b/src/app/guides/filters_httpql.md @@ -16,6 +16,8 @@ HTTPQL query statements filter either requests (`req`), responses (`resp`), or s These statements will serve as a starting point for your HTTPL queries. View the full [HTTPQL](/app/reference/httpql.md) reference to customize your query statements to achieve the intended results. ::: + + ## Filtering Requests by Host To filter requests made to `example.com`, use the `host` field. diff --git a/src/app/guides/http_history_filtering.md b/src/app/guides/http_history_filtering.md index 13d6e1ef..573dfeef 100644 --- a/src/app/guides/http_history_filtering.md +++ b/src/app/guides/http_history_filtering.md @@ -21,7 +21,7 @@ Actively applied advanced options are listed below the table. The applied filters list. ::: tip -View the [HTTPQL reference](/app/reference/httpql.md) to learn how to filter traffic based on certain traits. +View the [Writing HTTPQL Queries](/app/guides/filters_httpql.md) guide to learn how to filter traffic based on certain traits. :::
diff --git a/src/app/guides/replay_resending.md b/src/app/guides/replay_resending.md index 09dad38f..2dd81d9f 100644 --- a/src/app/guides/replay_resending.md +++ b/src/app/guides/replay_resending.md @@ -13,4 +13,6 @@ description: "A step-by-step guide to resending requests in Caido's Replay featu To resend a request, **click** on the `Send` button. You can resend requests as many times as you want, allowing you to test how modifications alter the response. + + The result of sending a request in Replay. diff --git a/src/app/guides/workflows_creating.md b/src/app/guides/workflows_creating.md index 34227f2d..c42e3728 100644 --- a/src/app/guides/workflows_creating.md +++ b/src/app/guides/workflows_creating.md @@ -4,10 +4,6 @@ description: "A step-by-step guide to creating new workflows in Caido including # Creating Workflows -::: tip -View the Tutorials section of the documentation for detailed walk-throughs on creating a variety of workflows. -::: - To create a new workflow, select a [workflow type](/app/concepts/workflows_intro.md) by **clicking** on either the `Passive`, `Active`, or `Convert` tabs and **click** the `+ New workflow` button. The workflow type tabs and + New workflow button. @@ -16,6 +12,12 @@ Once the workflow is created, you can edit its display name and provide an optio The workflow name and description input fields. +::: tip +View the Tutorials section of the documentation for detailed walk-throughs on creating a variety of workflows. +::: + + + ## Adding Nodes To add new nodes, **click** on the `+ Add Node` button and the `+ Add` button of a listed node. diff --git a/src/app/quickstart/automate.md b/src/app/quickstart/automate.md index ad56601c..6d9bf821 100644 --- a/src/app/quickstart/automate.md +++ b/src/app/quickstart/automate.md @@ -24,4 +24,6 @@ The `Automate` interface gives you the ability to send requests programatically. - [Avoiding Rate-Limiting Protections](/app/guides/automate_rate_limiting.md) ::: + + The Automate interface. diff --git a/src/app/quickstart/http_history.md b/src/app/quickstart/http_history.md index 5b9b53cd..a8975ba1 100644 --- a/src/app/quickstart/http_history.md +++ b/src/app/quickstart/http_history.md @@ -19,4 +19,6 @@ The `HTTP History` interface provides a table that contains all of the HTTP requ - [Viewing Modifications](/app/guides/http_history_modifications.md) ::: + + The HTTP History interface. diff --git a/src/app/quickstart/match_replace.md b/src/app/quickstart/match_replace.md index dab97d17..3117bea7 100644 --- a/src/app/quickstart/match_replace.md +++ b/src/app/quickstart/match_replace.md @@ -22,4 +22,6 @@ The `Match & Replace` interface gives you the ability to create rules that will - [Testing Rules](/app/guides/match_replace_testing.md) ::: + + The Match & Replace interface. diff --git a/src/app/quickstart/replay.md b/src/app/quickstart/replay.md index 78ccc3f6..6a587f4c 100644 --- a/src/app/quickstart/replay.md +++ b/src/app/quickstart/replay.md @@ -21,4 +21,6 @@ The `Replay` interface gives you the ability to create, modify, and send individ - [Using Environment Variables in Replay](/app/guides/replay_environment_variables.md) ::: + + The Replay interface. diff --git a/src/app/quickstart/workflows.md b/src/app/quickstart/workflows.md index 218d7604..513d07c1 100644 --- a/src/app/quickstart/workflows.md +++ b/src/app/quickstart/workflows.md @@ -33,4 +33,6 @@ Within the `Workflows` interface, you can construct multi-step processes to exec - [Resign AWS Requests Workflow](/app/tutorials/aws_signature.md) ::: + + The Workflows interface. diff --git a/src/app/troubleshooting/startup.md b/src/app/troubleshooting/startup.md index 90a1de55..9f15669f 100644 --- a/src/app/troubleshooting/startup.md +++ b/src/app/troubleshooting/startup.md @@ -73,3 +73,11 @@ Then, launch Caido through XWayland. ```bash env ELECTRON_OZONE_PLATFORM_HINT=x11 ./caido ``` + +## Blank Screen + + If you encounter a blank screen in the desktop application, launch Caido with the `--disable-gpu` command-line option. + +```bash +caido --disable-gpu +``` diff --git a/src/app/tutorials/autorize.md b/src/app/tutorials/autorize.md index 35b5b8e8..257bc5fa 100644 --- a/src/app/tutorials/autorize.md +++ b/src/app/tutorials/autorize.md @@ -6,7 +6,7 @@ description: "Learn how to configure and use the Autorize plugin for automated a [Autorize](https://github.com/caido-community/autorize) is Caido's official authorization/access control vulnerability testing plugin. -In this tutorial you will learn how to configure the plugin to conduct both passive and active scanning against a intentionally vulnerable application from Caido's Web Security Labs. +In this tutorial you will learn how to configure the plugin to conduct both passive and active scanning. ::: info Autorize is available for [installation](/app/guides/plugins_installing.md) in the `Official` tab of the Plugin interface. @@ -22,9 +22,11 @@ Autorize creates templates for proxied requests that are modified to simulate re By comparing the corresponding responses of these requests to each other, Autorize is able to determine if low-privilege or unauthenticated users are able to access the same resources or functionality available to the high-privilege user. -## Autorize Lab Walkthrough +## Autorize IDOR Testing Lab Walkthrough -The Autorize Lab features registered accounts for two users: John and Bob. + + +The Autorize IDOR Testing Lab features registered accounts for two users: John and Bob. By designating John as the low-privilege user and Bob as the high-privilege user, we will use Autorize passively test for authorization vulnerabilities against API endpoints that return sensitive account data based on the `user_id` query parameter: diff --git a/src/app/tutorials/shift.md b/src/app/tutorials/shift.md index 91755288..45429f10 100644 --- a/src/app/tutorials/shift.md +++ b/src/app/tutorials/shift.md @@ -44,6 +44,8 @@ Find similar requests to this. Shift is highly capable and should be able to carry out any task you could do with a well-written prompt. ::: + + ## Configuration To use Shift, register/login to [https://openrouter.ai/](https://openrouter.ai/) and obtain an [API key](https://openrouter.ai/settings/keys).