Skip to content

caido-community/shift

Repository files navigation

image

Github   •   Documentation   •   Discord

Shift

Shift is an AI plugin that integrates state-of-the-art LLMs directly into Caido's UI. It allows for LLM-powered free-form HTTP modification in Replay, automatic contextualization of queries, and supports many tools that AI can use to interface with Caido. .

Use Cases include:

  • Build out this JSON request body in Replay [Paste Obfuscated JS Code]
    • Result: AI automatically builds the JSON request body from the JS code.
  • Match and Replace this to true (with a feature flag boolean selected)
    • Result: AI creates Match & Replace rule to turn on the feature
  • Add this to scope
    • Result: AI adds the current request to scope
  • Generate a wordlist with all HTTP Verbs
    • Result: AI generates a wordlist with all HTTP verbs and adds it to your hosted files
  • Capitalize the 2nd letter of all query parameters
    • Result: AI uses a Replay search and replace tool to capitalize all 2nd letters of query params
  • Remove all the spaces from the path
    • Result: AI updates the path to reflect the same path but without spaces
  • Add 3 more tags to the JSON request body
    • Result: AI reads the current JSON body and adds 3 more tag objects to the "tags" array.

Shift Agents

Shift Agents, the new micro-agent framework for Caido users.

Build personalized micro-agents for tasks like XSS exploitation, WAF bypassing, or anything you can think of.

Demos


Shift Agents Demo

agent-demo.mp4

Shift New Float Demo

float-demo.mp4

Installation

From Plugin Store

  1. Install this plugin via the Caido Plugin Store
  2. Press shift + <space>

Manual Installation

  1. Install dependencies:

    pnpm install
  2. Build the plugin:

    pnpm build
  3. Install in Caido:

    • Upload the dist/plugin_package.zip file in Caido by clicking on the "Install Package" button in-app

Disclosures

Per the Caido Developer Policy, we are required to inform you that, for this plugin:

  • External services are required for full access.
  • Server-side telemetry is collected (Opt-in - see Privacy Policy)

External services

Shift is an AI-powered plugin, so it will be communicating with our backend and SOTA AI models to accomplish the user's intent.