Cariddi is a web crawler and reconnaissance tool that discovers endpoints, secrets, API keys, and other sensitive information across a list of domains.
The tool addresses the need for automated reconnaissance during security assessments and bug bounty work. It operates by accepting a list of domains or URLs as input, crawling those targets, and scanning the discovered content against patterns for secrets, API keys, file extensions, error messages, and endpoints. Users can run it in basic mode or enable specialized scanning modes: intensive crawling to include subdomains, secret hunting, error detection, endpoint discovery, information gathering, and file extension filtering at configurable sensitivity levels. Custom patterns can be supplied via separate files for both endpoints and secrets, and specific file extensions can be excluded from scanning.
The tool suits security researchers, penetration testers, and bug bounty hunters who need to quickly identify reconnaissance data across multiple targets in a single pass. It works well for organizations conducting security assessments where rapid discovery of exposed endpoints and credentials is valuable. The project is written in Go, making it a compiled binary that runs on Linux, Windows, and macOS without runtime dependencies. Installation is available through multiple package managers or by building from source.
Development activity shows consistent engagement with the codebase through automated testing workflows and code quality checks. The project maintains an active changelog documenting updates and improvements. The tool accepts community contributions and has participated in community-driven development initiatives. The README provides comprehensive documentation including installation instructions across multiple platforms, detailed usage examples, and configuration options for different scanning scenarios.
