Github   •   Documentation   •   Discord

---

Shift

Shift is an AI plugin that integrates state-of-the-art LLMs directly into Caido's UI. It allows for LLM-powered free-form HTTP modification in Replay, automatic contextualization of queries, and supports many tools that AI can use to interface with Caido. .

Use Cases include:

• Build out this JSON request body in Replay [Paste Obfuscated JS Code]
  • Result: AI automatically builds the JSON request body from the JS code.
• Match and Replace this to true (with a feature flag boolean selected)
  • Result: AI creates Match & Replace rule to turn on the feature
• Add this to scope
  • Result: AI adds the current request to scope
• Generate a wordlist with all HTTP Verbs
  • Result: AI generates a wordlist with all HTTP verbs and adds it to your hosted files
• Capitalize the 2nd letter of all query parameters
  • Result: AI uses a Replay search and replace tool to capitalize all 2nd letters of query params
• Remove all the spaces from the path
  • Result: AI updates the path to reflect the same path but without spaces
• Add 3 more tags to the JSON request body
  • Result: AI reads the current JSON body and adds 3 more tag objects to the "tags" array.

Shift Agents

Shift Agents, the new micro-agent framework for Caido users.

Build personalized micro-agents for tasks like XSS exploitation, WAF bypassing, or anything you can think of.

Demos

Shift Core, Shift Memory, Shift Rename Demo - Watch Video

Shift Agents Demo

https://github.com/user-attachments/assets/20853016-cc60-4d49-b4f5-ec7a53eb86e7

Shift New Float Demo

https://github.com/user-attachments/assets/88a25f77-3eba-457a-927c-721abb70d759

Installation

From Plugin Store

1. Install this plugin via the Caido Plugin Store
2. Press shift + <space>

Manual Installation

1. Install dependencies:

   pnpm install
   

2. Build the plugin:

   pnpm build
   

3. Install in Caido:

   • Upload the dist/plugin_package.zip file in Caido by clicking on the "Install Package" button in-app

Disclosures

Per the Caido Developer Policy, we are required to inform you that, for this plugin:

• External services are required for full access.
• Server-side telemetry is collected (Opt-in - see Privacy Policy)

External services

Shift is an AI-powered plugin, so it will be communicating with our backend and SOTA AI models to accomplish the user's intent.