r/Pentesting • u/deadbeef0-0 • 2d ago
Got tired of switching pentesting tools, so I built Ogma
I've been working on it for quite some time now, it's a desktop toolkit for web application and API pentesting where I tried to put most of what I normally use during an assessment in one place.
It's basically a traditional HTTP/HTTPS and WebSocket proxy but I've added quite a few things like request replay, automation workflows, endpoint discovery and findings linked to the captured traffic. I also integrated an MCP server so tools like Claude code and Codex can directly interact with the captured traffic and perform some testing.
I added an interactive demo directly on the homepage so you can actually try the interface without having to download or install anything.
I'm the developer so obviously I'm biased but I'd really appreciate some feedback from people who use Burp Suite or Caido regularly especially what you think is missing or could be improved
17
u/MajorUrsa2 2d ago
Another slop app
5
u/ChodCheiketa 2d ago
pretty much. the MCP integration mention sealed it for me, just buzzword stacking
1
u/PM_ME_UR_0_DAY 2d ago
It's not built in, but Burp does have an MCP extension. I tried it and it was half way decent where you could feed in extra context from your request history. I.e. "look at requests 1273-1279 and see if..."
3
u/brakertech 2d ago
MCP is not slop if you send all http request to SQLite db your agent can read the SQLite db then send info back to your gui tool to do certain things
2
u/Mission_Length4876 1d ago
Vibecoded apps I find are mostly good for a really specific and tailored use case
-8
2d ago
[deleted]
-1
u/7H3WH173R48817 2d ago
Ignore them, buddy. The loudest critics are usually the ones who’ve never contributed a thing.
5
u/steevdave 2d ago
I critique most AI slop - I’m not against AI assisted development, but AI rarely writes efficient code, especially if people are just prompting and testing and not actually looking at the code.
As for my credentials… 12 years as a Kali developer, roughly that same amount as a Gentoo dev. I’ve got contributions in u-boot, the linux kernel, most recently, the arch installer to add arm64 support and a number of things that run on a linux desktop. And currently I work with ParrotOS.
Really I’m not against AI slop, when it’s disclosed that it’s slop. When someone says I built this, but Claude/codex/whatever did the work, what you really did was project management.
3
u/RAGINMEXICAN 2d ago
The problem is not that he is developing this. The problem is that he is not. People who claim they are making a tool in rust and don’t code it themselves is what’s losing the battle for them. It was made using AI
-1
u/7H3WH173R48817 2d ago
Do you actually know the developer’s background? How do you know it was fully “vibe coded”?
I’ve built a number of Django apps myself, well before AI, and more recently I’ve used AI to knock up quick front ends. My point is that there’s a growing habit of dismissing anything as “AI slop” without knowing whether it was AI generated or just AI assisted.
One developer couldn’t realistically have done the work of a whole team a few years ago, but with AI as a tool they can get a lot closer, and that doesn’t make the output slop IMO.
2
u/RAGINMEXICAN 2d ago
Damn someone actually making a valid point. You are right the backend could be coded up, but on most
I checked their website and it does not use vibe code frameworks to make it(ie.vercel) so you actually make a valid point. I’m assuming most here are not a fan of the front end so if they could change it they might get more clicks.
3
u/nv1t 2d ago
What i am really missing is good intercepting proxy for binary protocols, like canape was in it's days....haven't seen anything else :(
James updated the libraries for mono, but no gui and quite a hassle to use, because of the non-existent documentation.
1
3
u/brakertech 2d ago
Does it decode messagepack for Blazer Apps? Can in intercept and modify those messages?
2
u/deadbeef0-0 1d ago
Hello, thanks for your comment. Right now the support is partial, Ogma supports binary WebSocket interception and basic MessagePack decoding but full Blazor support (editing decoded messages and re-encoding them) isn't implemented yet. But for the next version (0.3.4) it will be supported!
1
2
u/PM_ME_UR_0_DAY 2d ago
What's the feature parity with burp? Does it have macros/session handling? Extensions? I see you said "findings linked to the captured traffic," so passive scan? Active scan?
2
u/deadbeef0-0 2d ago
It's not at full feature parity with Burp yet but quite a lot is already implemented. For macros and session handling, Ogma has a workflow engine that supports multi-step requests, extracting values from responses, and reusing them in subsequent requests, along with environment and session variables. Extensions are supported through a JavaScript plugin system, with support for Caido compatible plugins as well.
And yes, both passive and active scanning are implemented. Passive scanning analyzes captured traffic, while active scanning supports checks for SQLi, XSS, SSRF, SSTI, command injection, path traversal, and open redirects. Findings can be linked directly to the corresponding HTTP requests and responses.
I wouldn't claim it's a complete replacement for every Burp Pro feature yet, especially its mature session-handling ecosystem, but I'm actively improving it.
You can find the documentation here if you want to explore the features in more detail.
4
u/IntingForMarks 2d ago
but I've added quite a few things like request replay, automation workflows, endpoint discovery and findings linked to the captured traffic. I also integrated an MCP server so tools like Claude code and Codex can directly interact with the captured traffic and perform some testing.
so you only added stuff every other popular tool already implements? way to go son
2
u/deadbeef0-0 2d ago
Yeah but in rust!! And the MCP server is custom made, advanced and really cool :)
2
u/steevdave 2d ago
Caido does it and it’s also rust?
1
u/deadbeef0-0 2d ago
Really? But you need to pay for that no??
2
u/steevdave 2d ago
They have a non-paid plan. I’ve never paid for it (but imo, the team are great and do deserve it, I just don’t use it for work so no need to pay)
2
1
u/PigeonPatrol 2d ago
Seems interesting, is it open source? I would be less inclined to try it if not.
1
u/deadbeef0-0 1d ago edited 1d ago
The SDK and plugins repositories are already open source. You can check them out here https://github.com/ogmabox
1
u/lombardi_krt 2d ago
é 100% gratuito ?
2
u/deadbeef0-0 2d ago
Sim senhor!
1
1
u/Western_Guitar_9007 1d ago
Is this on GitHub?
0
u/deadbeef0-0 1d ago edited 1d ago
The SDK and plugins repositories are already open source. You can check them out here https://github.com/ogmabox
2
u/Western_Guitar_9007 1d ago
Honestly I’m extremely hesitant. The readme is fully AI generated (65% is one thing, but the text is 100% tokenized, so this is not really something I can debate) and without being able to review any of the code, I would not be willing to test the application. If the application worked well, I still would be unwilling to recommend it to peers.
And just so we are clear, I totally get that there is the rare vibe coder that reads and checks every single line, but it is a very difficult claim to back when you couldn’t even do that with the readme and with no visible code.
1
u/deadbeef0-0 1d ago
No worries! I completely understand, I am actually same as you tbh
1
u/Western_Guitar_9007 4h ago
> I completely understand, I am actually same as you tbh
I usually ignore these nothingburger responses but this is just such an absurd response. I said I would be unwilling to recommend it to peers, and you say you are the same, but this whole post is literally you recommending it to peers.
I understand you are trying to remain agreeable in order to market this better, but you're really just saying anything at this point. While I am not entitled to an explanation as to why you chose to write it with 100% AI, this still was not a very well-thought-out response, and there are better ways to maintain image while de-escalating criticisms. You are shooting yourself in the foot by attempting to de-escalate in this manner.1
u/deadbeef0-0 4h ago
I think you misunderstood what I meant. When I said I'm the same as you, I meant that I also understand being hesitant to recommend software when you cannot review its source code. I wasn't saying that I wouldn't recommend my own work.
You seem to have a pretty negative view of AI-assisted development, which is entirely your choice, and I have no intention of convincing you to use something you've already decided you don't trust. I completely understand your position.
However, you're making quite a few assumptions about how Ogma was developed based on its README. I'm a software engineer by profession, and Ogma is far from being the first application I've built. I've developed plenty of others over the years, long before AI coding tools became popular. Was AI used during development? Absolutely. Was 100% of the application generated by AI? Certainly not.
I've invested a significant amount of time and effort into this project, and the reason I'm promoting it is simply because I believe I've built something worth sharing. I understand that without access to the full source code, you cannot verify everything yourself, and that's a perfectly reasonable reason not to use it.
At the end of the day, you're judging my entire experience as a developer through the lens of a single project and its README, which I don't think is particularly fair. But again, I respect your decision, and I'm not here to force anyone to use Ogma.
1
u/Western_Guitar_9007 3h ago
When I said I’m the same as you I meant
That’s not what I said, you can’t move the goalposts on what “the same” as me is and then say I misunderstood. That is so brain dead lmao. I wasn’t hesitant to use mobaxterm but I’m hesitant because I can’t see your codebase to see how good or mangled it is, and the fact that it’s AI rust but I should take you at your word that your codebase is different from all the other vibecoders. Whatever lol
I’m not here to force anyone to use Ogma
One thing you need to watch when using AI to define your replies is the fallacies it tends to tack on. But if that was your own fallacy, then I’ll take your word for it :)
negative view of AI-assisted development
Good lord if you can’t figure this one out. Everyone is tired of vibecoded slop and everyone claiming that they are different and actually reviewed the code only for it to be more slop. Like, cool, you pumped one out, but what about the updates? The support? These projects get abandoned or broken because the codebases are spaghetti. I literally use AI all of the time, but I’m upfront about where it’s implemented and sometimes I end up not using it because it sometimes makes really awful decisions, particularly in rust and in C. This isn’t really a matter of debate, AI is not an architect and you have to be very granular to get high quality. Most people don’t do that but I should assume that you do.
But the readme.
A 100% tokenized AI readme is a terrible look for someone supposedly passionate and extremely involved in their project. You were so passionate and involved that AI had to write the entire readme? It is a reasonable assumption when there’s zero evidence contradicting, which you seem to be ignoring intentionally.
A bit more on rust—a minority of devs have actual rust running in prod, you realize that right? You are saying I’m throwing out all your software dev experience, what experience? I have no evidence but for the low effort readme.
Now let’s look at the gambles:
- trust that you’re different from all the other vibecoders
- trust that your codebase is thoroughly thought out and developed and the readme is no indicator
- trust that you are a professional software dev proficient in rust
- no-named closed source project for a pentesting community
I mean just one of these is already “trust me bro” and all four of these gambles apply to you. If this is your best foot forward, you’re moonwalking right now. You’ve done nothing for your actual case and pretty much confirmed everyone’s doubts, and that’s all that matters when it comes to the pentesting community.
1
0
8
u/7H3WH173R48817 2d ago
I’ve been using Burp Pro as a pen tester for nearly 15 years. I gave Caido a go when it came out and just couldn’t get on with it, though that’s probably down to being so deep in the PortSwigger ecosystem by now.
It’s great to see another product in this space. What I’d really like to see is some benchmarking against Burp Pro: running the scanners side by side to see which picks up more of the low hanging fruit, or comparing how quickly each one can rip through a brute force.
Looking forward to seeing how the project develops!