Skip to content
Deepak Gupta markRecon Atlas

URL and endpoint discovery

cariddi

Crawls a list of domains and scans the pages it fetches for endpoints, secrets, API keys, error messages and notable file types.

ActiveScope a pentestAudit your own exposure

3.8k stars · last push November 5, 2026 · v1.4.6 · GPL-3.0

GitHub repository

What it finds

cariddi crawls each URL piped to it and runs pattern checks over the responses. Separate flags hunt for secrets, interesting endpoints, error messages, useful information and file extensions ranked by interest level. Custom regex and endpoint lists extend the built-in rules.

  • URLs
  • endpoints
  • secrets
  • API keys
  • tokens
  • error messages
  • notable file extensions

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

README tagline: "Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more." It sends requests to the target's hosts; -intensive widens the crawl to "resources matching 2nd level domain".

API keys: The README documents no API keys or external services.

Install

Install with brew
brew install cariddi

From the project's documentation

Install with go
go install -v github.com/edoardottt/cariddi/cmd/cariddi@latest

From the project's documentation

Install with package
sudo snap install cariddi

From the project's documentation

Install with package
pacman -Syu cariddi

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Crawl a single target
echo https://example.com/ | cariddi

From the project's documentation

Hunt for secrets in crawled pages
cat urls.txt | cariddi -s

From the project's documentation

Hunt for interesting endpoints
cat urls.txt | cariddi -e

From the project's documentation

Hunt for notable files (level 2 of 7)
cat urls.txt | cariddi -ext 2

From the project's documentation

Output formats: stdout (plain), TXT file (-ot), HTML file (-oh), JSON (-json)

Limits the project documents

  • On Windows the executable works only inside the cariddi folder.
  • Media and font extensions (png, jpg, mp4, woff and others) are ignored by default when scanning for secrets, info and errors.
  • Using it through Burp Suite's proxy requires trusting Burp's CA certificate system-wide, not only in the browser.

Deepak's take

Analysis, not documentation

Use it when
Use it on sites you are authorised to test when you want crawling and a first-pass secrets and endpoint check in one run.
Skip it when
Skip it for auditing your own code repositories; TruffleHog and Gitleaks scan git history directly. Skip it too when no traffic to the target is allowed.
What it will miss
It only inspects responses it crawled, so secrets in unlinked files, private repositories or old commits are out of reach.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. cariddi is a trademark or project name of its owners; this library is not affiliated with it.