Chatio

Chatio copied to clipboard

An AI-powered assistant for hackers and security professionals built for Caido

Overview

Chatio is a comprehensive AI-powered security testing assistant that seamlessly integrates with Caido. Designed specifically for penetration testers, security researchers, and cybersecurity professionals, Chatio provides intelligent analysis, vulnerability assessment, and expert guidance across all aspects of security testing.

With support for multiple AI providers and specialized security-focused capabilities, Chatio transforms your Caido workflow into an intelligent security testing environment.

Features

Installation

1. Open Caido
2. Navigate to Settings > Plugins
3. Click the Plugin Store tab
4. Search for "Chatio"
5. Click Install

Quick Start

First-Time Setup

1. Configure Your First AI Provider:

   • For beginners: Start with Google Gemini (free tier) or Local LLMs
   • For professionals: OpenAI GPT-4o or Claude 3.5 Sonnet
   • Navigate to Settings tab and add your API key

2. Test Your Connection:

   • Click "Test Connection" for your chosen provider
   • Verify successful authentication

3. Start Your First Analysis:

   • Switch to Chat tab
   • Upload a code file or describe your testing scenario
   • Ask specific security-related questions

4. Explore Advanced Features:

   • Try file uploads for code review
   • Upload screenshots for visual analysis
   • Use quick prompt templates for common scenarios

AI Provider Setup

Recommended Models by Use Case

Usage

Basic Security Analysis

1. Ask Security Questions:

   "Explain SQL injection techniques for MySQL databases"
   "How to bypass WAF protection in XSS attacks"
   "Generate a phishing email template for IT security testing"
   

2. Upload Code for Review:

   • Drag & drop source code files
   • Get instant security vulnerability analysis
   • Receive specific fix recommendations

3. Visual Evidence Analysis:

   • Upload screenshots of applications
   • Analyze network topology diagrams
   • Get insights from error messages or logs

Advanced Security Testing

1. Structured Penetration Testing:

   • Use quick prompt templates for different phases
   • Maintain context across reconnaissance to post-exploitation
   • Generate detailed methodology documentation

2. Multi-File Analysis:

   • Upload entire codebases for comprehensive review
   • Analyze configuration files for misconfigurations
   • Process log files for security incidents

3. Custom Testing Scenarios:

   • Set specialized system prompts for specific environments
   • Integrate with Caido's intercept and modification features
   • Generate custom payloads and test cases

Quick Actions (Beta)

⚡ Intelligent automation at your fingertips! Press Ctrl+Space anywhere in Caido to access AI-powered Quick Actions that streamline your testing workflow.

How It Works

1. Activate: Press Ctrl+Space in any Caido tab
2. Describe: Use natural language to describe what you want to do
3. Execute: AI understands context and performs the action instantly

Core Capabilities

Quick Actions Examples

🎯 Scope Management:

"create scope for vulnbank.com but exclude admin.vulnbank.com"
"create scope for hackme[1-9].com pattern"  
"create scope for *.pentest-lab.org wildcard"

🔧 Request Manipulation:

"replace GET with POST and add JSON header"
"change request body to include XSS payload"
"add authorization header with Bearer token"

🔍 Smart Filtering:

"create filter for API endpoints"
"filter requests with 4xx status codes"
"create filter to dismiss all CSS and JS files"

📁 File Creation:

"create wordlist file with common passwords"
"generate payload file with SQL injection vectors"
"create subdomain enumeration wordlist"

Getting Started with Quick Actions

1. First Time: Open any request in Caido (Replay, Intercept, HTTP History)
2. Activate: Press Ctrl+Space to open Quick Actions
3. Try Examples: Start with simple commands like "change method to POST"
4. Get Creative: Use natural language - AI understands context and intent

Beta Notice

Quick Actions is in active development. Current limitations:

• Scope update/delete functions are temporarily disabled
• Best performance with GPT-4o, Claude 3.5 Sonnet
• Some complex commands may require refinement

Security Testing Workflows

Common Attack Scenarios

Professional Testing Methodologies

1. Reconnaissance Phase:

   • OSINT gathering strategies
   • Target profiling techniques
   • Attack surface enumeration

2. Vulnerability Assessment:

   • Automated scan result analysis
   • Manual testing guidance
   • False positive filtering

3. Exploitation Development:

   • Custom payload creation
   • Bypass technique development
   • Proof-of-concept scripting

4. Post-Exploitation:

   • Lateral movement strategies
   • Persistence mechanisms
   • Data exfiltration techniques

5. Reporting & Documentation:

   • Structured finding reports
   • Executive summary generation
   • Remediation recommendations

Advanced Features

Context Management

• Intelligent Memory: Maintains conversation context across multiple exchanges
• Session Organization: Separate chats for different testing phases
• Context Optimization: Configurable message history for optimal performance

Custom System Prompts

Example: "You are a penetration testing expert specializing in web applications. 
Focus on practical exploitation techniques and provide step-by-step methodologies."

File Processing Capabilities

• Supported Formats: Images (PNG, JPG), Code files (.py, .js, .php, etc.), Documents (TXT, JSON, XML)
• Vision Models: Automatic detection and use of image-capable models
• Batch Analysis: Process multiple files simultaneously

Integration Features

• Caido Workflow: Seamless integration with Caido's proxy and testing features
• Export Functions: Save conversations, findings, and methodologies
• Theme Support: Dark/light mode matching Caido's interface

Troubleshooting

Common Issues

Local LLM Setup

1. Install Ollama:

   # Download from https://ollama.ai
   ollama serve
   

2. Download Models:

   ollama pull llama3.2          # General purpose
   ollama pull llama3.2-vision   # Image analysis
   ollama pull codellama         # Code analysis
   

3. Configure Chatio:

   • Set URL: http://localhost:11434
   • Add models: llama3.2, llama3.2-vision, codellama

Documentation

Complete documentation including:

• Setup Guides: Step-by-step provider configuration
• Security Templates: Pre-built prompts for common scenarios
• Best Practices: Professional testing methodologies
• Troubleshooting: Comprehensive problem-solving guides

Access the full documentation within the plugin under the Help & Docs tab.

Updates

Chatio is actively maintained with regular updates including:

• New AI provider integrations
• Enhanced security testing templates
• Performance optimizations

Feedback & Issues

If you encounter any issues or have suggestions for improvements, please:

• Report bugs and feature requests
• Share your security testing workflows
• Contribute to the growing knowledge base

License

This project is licensed under the MIT License - see the LICENSE file for details.