A local proxy for authorized web testing.
Intercept, replay, and scan systems you own or have written permission to test. Source is available to run and inspect. The license is not open source.
Personal use
Free after you accept the Kerf Personal Use License. No commercial use.
Install with Docker
First run builds the image (Python + Chromium). Later runs just start.
git clone https://github.com/ExecutiveKoder/kerf.git cd kerf docker compose up -d
Accept the license
Open http://127.0.0.1:8000. Read the terms and check the box. You are accepting personal, non-commercial use only, and agreeing not to redistribute Kerf.
Trust the CA on a machine you control
In Setup, download the Kerf CA and install it in that browser or OS trust store. This is how HTTPS interception works. Remove the CA when you are done.
Point a browser at the proxy
HTTP/HTTPS proxy: 127.0.0.1:8080. Browse in-scope hosts. Traffic lands in History. Repo scans are under Scan → Repos.
Without Docker: pip install -r requirements.txt && python main.py. History, the CA, and the license acceptance live in ./data (Docker) or ~/.dastday.
What ships
One process on your machine. SQLite history. No hosted cluster.
Proxy toolkit
- HTTP/1.1, HTTP/2, WebSockets, local CA
- History, intercept, Replay, rewrite, cookies
- Encode, Compare, Tokens, reports
Authorized scanning
- Passive findings on captured traffic
- GitHub repo SCA / secrets / dangerous APIs
- Scan engine without a public exploit catalog
Commercial use
Paid work, an employer, a client, or any commercial advantage is not licensed by the personal grant.
Buy a commercial license
Smashrock Media Inc licenses Kerf for teams and client engagements. Email what you need: seats, duration, and whether you want it on employer hardware.
- Use at work or on a paid engagement
- Install on company machines
- No right to redistribute or resell Kerf