Which Tool to Use When Web App Pentesting?
Honestly, after doing a few web app pentests, I started researching a classic tool, Burp Suite Community. However, during one course, I was introduced to Caido Community. Honestly, after using Burp for so long and switching to Caido for a few training sessions, I got the hang of this tool, and I like some of its features over Burp's. Though I started using Burp at the beginning of my training on Web Apps. I honestly had to think, which one is better? So, like any weirdo like me, I made a pros-and-cons list of the free version.
Pros for Burp Suite: it's a Swiss Army Knife for all web app pentesting. It’s a well-known tool, and it's brought up in almost, if not all, interviews. You practically need to know the tool like the back of your hand. Which isn’t really that bad to learn. Both tools have their learning curve anyway. Like sending to a repeater or an intruder.
Con: What really got me sold on Caido over Burp is that you’re limited to your thread count. Some things take longer to respond to during a cluster bomb or sniper attack. So when it came to brute-force login, I really wished I had Caido during the test; however, it would probably take just as long.
Pro: Burp is pre-installed with Kali Linux; Caido is not. However, installing Caido didn’t take long, and we didn't really run into issues.
Con: Not really a bad con, but with Cadio, I could use it right away, and it was much quicker to use the Chromium browser than to set up Foxy Proxy in Firefox or wait on the built-in browser. It still had the same functions, but once installed and a project started, I was able to get going instead of waiting a few moments for the browser to warm up.
Huge Con: Burp Community, you can’t save your projects; however, if you sign up with Cadio for free, you can!! This was huge for me since I wanted to save a project I was working on, and that’s what sold me on using that tool as well.
The differences in look:
So the look and the ability to check on the side made the page a bit less busy. That also sold me a bit.
File uploads are the same as well.
You can also intercept traffic much more smoothly than Burp.
But a huge pro of Burp is that you can do a lot more than with Caido. Like a decoder and other tools.
So, which one was better for me, honestly? Keeping both as tools is extremely helpful. For me, with more focused API checks, brute-force logins, and quick website checks, along with saving projects, Caido was the perfect tool. For more tools and reliability, Burp won that one. However, it's still limited.
What about Zap? I tried that in the early stages of my learning, and I may revisit it. However, it did have a much steeper learning curve than Burp. Also, Burp Suite was mostly taught in my classes, where I was learning, like the PNPT.
Also, ffuf and Hydra are good tools too. With curl, you can learn a lot, but my go to’s are now Caido and Burp. It’s based on my own muscle memory. Plus, for me, Caido I picked up with in 5 minutes of using it, and the things I learned from Burp applied quickly to Caido. Like most tools, it takes time to pick up, but if you use a certain tool over time, picking up a new one is probably pretty easy. Also, this is just the surface level of what I've experienced so far. Thank you for reading, and keep hacking!!