Cariddi

Cariddi is a Go command-line crawler for bug-bounty / pentest attack-surface recon: feed it a list of domains, and it crawls the URLs it finds, then scans everything it fetches for endpoints, secrets, API keys, tokens, and interesting file extensions. Apache-2.0, Go, ~3.7k★, actively maintained (pushed 2026-07-15).

Graded T3 at ingest, superseded 2026-08-20 → T1 — a first-party project repo with self-reported capabilities and no independent benchmark, matching how this spoke tiers swaggerspy and gitsint.

What it does

Cariddi's pipeline is crawl → collect → scan:

• Crawl every reachable URL under the given domain list (its own crawler, not a wrapper around an external one).
• Extract juicy targets along the way: endpoints, subdomains, parameters, file extensions worth a second look (.env, .sql, .zip, config files).
• Scan for secrets with regex/entropy checks — API keys, tokens, credentials left in JS bundles, config files, or exposed pages.

It ships as a single Go binary (go install, Homebrew, Snap, Pacman), fitting the same "install once, point at a scope, get a text report" shape as swaggerspy and gitsint.

Where it sits in the spoke

Cariddi is the spoke's second crawl-for-secrets tool after swaggerspy, but broader: SwaggerSpy is scoped to one platform (SwaggerHub API docs), Cariddi crawls the live domain itself — any site, not one corpus — and adds endpoint/subdomain/parameter discovery on top of the secrets scan. Non-AI, single-binary, like the rest of this spoke's classic-recon cluster (swaggerspy, gitsint, cloakquest3r) rather than the AI-OSINT pole (llm-osint, kallisto-osinter).

Related

swaggerspy · gitsint · cloakquest3r · osint · synthesis

Re-tiered 2026-08-20 → T1. Under the corpus rule adopted this day (../QUALITY.md → tier by the claim, not the URL), this page rests on what the crawler does: take domains, crawl URLs, match endpoints, secrets, keys and extensions. A project is the primary source for its own design, and the earlier grade tiered the URL rather than the claim.