TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Show HN: Pākiki Proxy – An intercepting proxy for penetration testing

97 pointsby pipeline_tuxover 1 year ago
Hey HN, I&#x27;ve been working on an intercepting proxy for penetration testing over the last few years in my spare time.<p>Some points of difference from the existing tools:<p>* The UIs are built using the native platform frameworks, meaning they look and behave like other applications on the desktop.<p>* It has a fully embedded and integrated Python scripting engine.<p>* It’s fully native meaning it’s nicer on system resources.<p>* It has a number of built in scripts to automate reconnaissance, content discovery, authorisation checks, etc.<p>* The core of it is open source.<p>I&#x27;m really keen to get any feedback!

15 comments

robocatover 1 year ago
Pākiki is a māori verb meaning to probe: <a href="https:&#x2F;&#x2F;maoridictionary.co.nz&#x2F;search?keywords=pakiki" rel="nofollow noreferrer">https:&#x2F;&#x2F;maoridictionary.co.nz&#x2F;search?keywords=pakiki</a><p>The macron (āēīōū) lengthens the vowel sound (Latin has this too) otherwise pronounce the vowels the same as Spanish. Lengthened vowels are harder for most American speakers to get right: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;tPi2jtU7Tl4?t=6m23" rel="nofollow noreferrer">https:&#x2F;&#x2F;youtu.be&#x2F;tPi2jtU7Tl4?t=6m23</a> Vowel length matters in New Zealand (e.g. pronunciation of can&#x27;t causes problems).<p>Perhaps could be added to the docs?
评论 #38043171 未加载
Goofy_Coyoteover 1 year ago
Love it, specially the python scripting engine.<p>Also, don&#x27;t listen to those who say things like &quot;soo, like Burp?&quot; (the ones who do it to belittle the effort).<p>People used to say (and still do) Postman is &quot;just a wrapper around curl&quot;, and I was like, &quot;So is Operating systems, they&#x27;re a wrapper around hardware, and C is a wrapper around assembly, and Python is a wrapper around &quot;I don&#x27;t want to manage memory, let&#x27;s make a web app instead&quot;, What&#x27;s your point?&quot; lol Postman is now worth couple of billions btw.<p>You&#x27;re doing a great job - keep at it. Ping me if you needed testers (I work in AppSec&#x2F;Red teaming).
评论 #38045590 未加载
Syttenover 1 year ago
Hi there! Co-founder of Caido (<a href="https:&#x2F;&#x2F;caido.io" rel="nofollow noreferrer">https:&#x2F;&#x2F;caido.io</a>) here.<p>Glad to see more competition in the space, we also went the route of using an API (built in Rust). We decided to focus only on a web UI in vue.js I will look how you are storing data and all, we went the sqlite way to save on RAM.<p>Looks like we are both going after Burp, it&#x27;s not going to be an easy ride for sure. What we found is it is very hard to make people in enterprise switch and the 100$&#x2F;y pricing really isn&#x27;t enough to build a serious business without enterprise clients at a higher price point.<p>Anyway, best of luck!
评论 #38043128 未加载
评论 #38045671 未加载
评论 #38043326 未加载
ping00over 1 year ago
Hi, just wanted to say that I walked through this and it&#x27;s really neat. I&#x27;m running it all through WSL on a reasonably powerful laptop (ASUS G14) and performance has been buttery so far. I especially want to commend you on the clear, simple-to-use UX and UI. This will definitely fill a niche for me at work if I have to use an underpowered jumpbox to test internal web applications.<p>One UX point: I may have missed this, but when I start an injection attack, it would be nice to see a real-time table of the output so that I can see which injections have been tried (kind of like how you can see it in Burp Suite with Logger++ or the sub-window that opens up when you start an Intruder attack). Totally respect a conscious choice to not go down this (potentially) resource-intensive &#x27;view&#x27;, but curious if that&#x27;s on the roadmap. Right now I just get a spinning animation after I hit Run, and I don&#x27;t see any output in the sidebar where it says &quot;Scans will be shown here once they have started&quot;.<p>In all honesty, I probably will stick with Burp Suite for my bread-and-butter web app testing flow (also helps that my org pays for a Pro license), but I want to thank you for the effort put into this and the courage to explore a new modality (web app testing without a resource-heavy proxy tool like Burp).
评论 #38044058 未加载
pizzalifeover 1 year ago
Looks interesting. What would be the main benefits of switching to this from BurpSiute?
评论 #38040898 未加载
sneakover 1 year ago
I’m exactly the target market for this.<p>I won’t pay for subscriptionware. I switched from Premiere to Resolve just to avoid having to be someone’s MRR and I now pirate Lightroom pending its replacement.<p>It’s a terrible, user-hostile model.<p>I don’t think developers should be entitled to payment in perpetuity for work they did once.
评论 #38046219 未加载
dur-randirover 1 year ago
Requiring Sonoma seems... weird? It&#x27;s still pretty much unstable for serious work. Especially if you build with GTK, not with native frameworks. Both Burp and Caido are much more lax, working on HS&#x2F;EC.
Cupprumover 1 year ago
Cool project!<p>I have one question though, how do you intercept TLS. Let’s say i would connect my phone to your proxy, and try to search something on the web. Wouldn&#x27;t the connection not be trusted?
评论 #38042063 未加载
评论 #38042076 未加载
ValtteriLover 1 year ago
Looks good!<p>Cross platform native GUI and you are doing this all alone? Feels very ambitious.<p>Are you planning to go full time on this?<p>What kind of stack are you using?
评论 #38042722 未加载
sumedhover 1 year ago
Does it work if you have a work vpn like Cisco Anyconnect or Cato. Proxyman does not with those Vpns :(
评论 #38046754 未加载
drewcooover 1 year ago
All proxies intercept.<p>This one fuzzes, so it&#x27;s also an injecting proxy.
hrrsnover 1 year ago
Awesome - love the te reo name!
KomoDover 1 year ago
So like burp suite...?
评论 #38042343 未加载
评论 #38042960 未加载
m3047over 1 year ago
Briefly reviewed your product. Seems like OWASP ZAP is your competition: <a href="https:&#x2F;&#x2F;www.zaproxy.org&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.zaproxy.org&#x2F;</a><p>It runs entirely in the browser so it uses the browser &quot;native&quot; frameworks.
评论 #38040992 未加载
评论 #38041379 未加载
grezqlover 1 year ago
Does this work on applications with SSL pinning?
评论 #38042397 未加载