5 ms·

mitmproxy has worked on iOS and Android for years now and is OSS and easy to use

thisacctforreal 9y ago
It seems to include SSL support as well https://jasdev.me/intercepting-ios-traffic https://jasdev.me/intercepting-ios-traffic
- joshenders 9y ago
  mitmproxy supports TLS just fine. It had a simple setup for installing a root CA in your device.
  - webo 9y ago
    iirc, you have to do additional setup for Android 7+ apps -- installing a custom apk with modified manifest.xml for each app that you want to intercept TLS traffic.
ReverseCold 9y ago
This runs on the device itself.
- rimliu 9y ago
  And the desktop version allows to intercept the traffic of the machine it runs on. Mitmproxy cannot do that afaik.
  - joshenders 9y ago
    Yes, mitmproxy does as well..
  - majewsky 9y ago
    What do you mean? This has been working since way before 1.0.
    - rimliu 9y ago
      Ok, I need to clarify, I had macOS in mind and this note in the mitmproxy documentation: > Note that the rdr rules in the pf.conf given above > only apply to inbound traffic. This means that > they will NOT redirect traffic coming from the box > running pf itself. We can’t distinguish between an > outbound connection from a non-mitmproxy app, and > an outbound connection from mitmproxy itself - if > you want to intercept your OSX traffic, you should > use an external host to run mitmproxy. Nonetheless, > pf is flexible to cater for a range of creative > possibilities, like intercepting traffic emanating > from VMs. See the pf.conf man page for more. That's for transparent mode only though, maybe that had me confused.
chrisweekly 9y ago
... besides which, mitmproxy (and its partner mitmdump) are scriptable and extensible in ways Charles simply isn't.
joshenders 9y ago
I get the sense the Charles users are just not familiar with mitmproxy. Here’s a guide I wrote awhile ago to get you up to speed: https://gist.github.com/joshenders/2b0dc14c89a8769f64a7 https://gist.github.com/joshenders/2b0dc14c89a8769f64a7
- robterrell 9y ago
  Sure, but (a) this is an on-device app, and (b) some of us have been using Charles on the desktop since before mitmproxy existed.

It seems to include SSL support as well https://jasdev.me/intercepting-ios-traffic https://jasdev.me/intercepting-ios-traffic

joshenders 9y ago
mitmproxy supports TLS just fine. It had a simple setup for installing a root CA in your device.
- webo 9y ago
  iirc, you have to do additional setup for Android 7+ apps -- installing a custom apk with modified manifest.xml for each app that you want to intercept TLS traffic.

ReverseCold 9y ago

This runs on the device itself.

rimliu 9y ago
And the desktop version allows to intercept the traffic of the machine it runs on. Mitmproxy cannot do that afaik.
- joshenders 9y ago
  Yes, mitmproxy does as well..
- majewsky 9y ago
  What do you mean? This has been working since way before 1.0.
  - rimliu 9y ago
    Ok, I need to clarify, I had macOS in mind and this note in the mitmproxy documentation: > Note that the rdr rules in the pf.conf given above > only apply to inbound traffic. This means that > they will NOT redirect traffic coming from the box > running pf itself. We can’t distinguish between an > outbound connection from a non-mitmproxy app, and > an outbound connection from mitmproxy itself - if > you want to intercept your OSX traffic, you should > use an external host to run mitmproxy. Nonetheless, > pf is flexible to cater for a range of creative > possibilities, like intercepting traffic emanating > from VMs. See the pf.conf man page for more. That's for transparent mode only though, maybe that had me confused.

chrisweekly 9y ago

... besides which, mitmproxy (and its partner mitmdump) are scriptable and extensible in ways Charles simply isn't.

joshenders 9y ago

I get the sense the Charles users are just not familiar with mitmproxy. Here’s a guide I wrote awhile ago to get you up to speed: https://gist.github.com/joshenders/2b0dc14c89a8769f64a7 https://gist.github.com/joshenders/2b0dc14c89a8769f64a7

robterrell 9y ago
Sure, but (a) this is an on-device app, and (b) some of us have been using Charles on the desktop since before mitmproxy existed.