5 ms·

Such an amazing and well-maintained tool!!! Anyone interested in sharing use-cases where it has helped you?

by ericb 5y ago

Proven 5y ago
Tried it last week to see what APIs are used to communicate with home appliance. Couldn't get it to work.
rbdixon 5y ago
Scripting flow manipulations in mitmproxy is easy. There are a lot of great examples to learn from which help. The filter syntax is expressive and simplifies writing code to mangle flows. I've done body conversion [0], weird types of authorization testing, manipulated system update packages on the fly, all sorts of bizarre things. Auto-reloading scripts on change is such a time saver. If you want a python-based programmable HTTPS proxy for testing I have not found anything better. [0]: https://carvesystems.com/news/proxying-wbxml-services/ https://carvesystems.com/news/proxying-wbxml-services/
mhils 5y ago
We have a super diverse userbase, so this is a fun question! Some pointers: Development: - Debug your own apps/devices (which do not come with Chrome Devtools). - Simple Python scripts to replace/inject website content. (https://docs.mitmproxy.org/stable/addons-overview/ https://docs.mitmproxy.org/stable/addons-overview/) - Capture a web page/API and then replay the responses offline. (https://docs.mitmproxy.org/stable/overview-features/#server-side-replay https://docs.mitmproxy.org/stable/overview-features/#server-...). - Replay requests for testing. (https://docs.mitmproxy.org/stable/overview-features/#client-side-replay https://docs.mitmproxy.org/stable/overview-features/#client-...) Privacy: - Figure out what your Covid app is sending out (https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-alert-app https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-...) - Look at how evil IoT devices for pets are (https://www.nytimes.com/2018/12/11/realestate/spying-on-the-dog-or-cat.html https://www.nytimes.com/2018/12/11/realestate/spying-on-the-...) - Generally find more evil stuff (https://mitmproxy.org/publications/ https://mitmproxy.org/publications/) Security: - Reverse-engineering custom binary protocols is never fun, but with mitmproxy you can at least write custom contentviews to dissect stuff. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/addons/contentview.py https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...) - Fiddle with generic TLS-protected TCP streams. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/addons/tcp-simple.py https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...) - Dump TLS master secrets for WireShark. (https://docs.mitmproxy.org/stable/howto-wireshark-tls/ https://docs.mitmproxy.org/stable/howto-wireshark-tls/)
mpicker0 5y ago
We have a product that depends on data received from external web services. We often want to test certain conditions in the data (specific results, error scenarios, etc), and it's difficult or impossible to guarantee these conditions when we call out to our external services. We use mitmproxy to intercept and manipulate the responses we get. Even if we don't need to manipulate the data, it's a very useful tool for watching requests go back and forth.
thinkmassive 5y ago
I’ve used it to diagnose (and work around) webhook problems between third-party applications that are supposedly compatible. One that sticks out in my mind is trying to receive Slack webhooks in Mattermost. I was unaware of Slack’s new BlockKit message format until I saw what was being sent. Then I wrote a simple python script to transform the payload, all within mitmproxy. It’s not the most efficient long term solution, but the fact I could diagnose and resolve the issue with a single tool, all within a few hours of first discovering it, was very satisfying. Here’s the result for anyone interested (warning: it’sa quick hack, not a polished/maintained project) https://github.com/thinkmassive/mattermost-webhook-slack-proxy https://github.com/thinkmassive/mattermost-webhook-slack-pro... Edit: this doesn’t use TLS at all. I understand that’s probably the primary use case for the tool, but I thought this was a cool example of other ways it can be useful too.
- it33 5y ago
  Mattermost CEO here, really nice work @thinkmassive!
KORraN 5y ago
I've introduced mitmproxy in my team and we use it quite often for flows' inspection and manipulation while testing a desktop app. Can't count cases where a quick look into a proxy made debugging a lot easier, because we were able to point at unexpected requests / responses. Thank you for your work, @mhils & the team. Enjoy your moments of glory on HN :)
turtlebits 5y ago
I use it to download music from my music streaming subscription to my son's iPod. None of the files have any tags or metadata so it's was an interesting challenge to get everything tagged.
no_time 5y ago
I wrote a krunkerio aimbot that unpacks the msgpack-over-websocket packets and injects the calculated mouse movements into the stream. The biggest problem was the server only syncing the player position every second or so which means my middleware has can only provide exact calculations when I stand still. Solving this would require reading the process memory but that is exactly what I wanted to avoid :/

Such an amazing and well-maintained tool!!! Anyone interested in sharing use-cases where it has helped you?

by ericb 5y ago

Such an amazing and well-maintained tool!!! Anyone interested in sharing use-cases where it has helped you?

Proven 5y ago

Tried it last week to see what APIs are used to communicate with home appliance. Couldn't get it to work.

rbdixon 5y ago

Scripting flow manipulations in mitmproxy is easy. There are a lot of great examples to learn from which help. The filter syntax is expressive and simplifies writing code to mangle flows. I've done body conversion [0], weird types of authorization testing, manipulated system update packages on the fly, all sorts of bizarre things. Auto-reloading scripts on change is such a time saver. If you want a python-based programmable HTTPS proxy for testing I have not found anything better. [0]: https://carvesystems.com/news/proxying-wbxml-services/ https://carvesystems.com/news/proxying-wbxml-services/

mhils 5y ago

We have a super diverse userbase, so this is a fun question! Some pointers: Development: - Debug your own apps/devices (which do not come with Chrome Devtools). - Simple Python scripts to replace/inject website content. (https://docs.mitmproxy.org/stable/addons-overview/ https://docs.mitmproxy.org/stable/addons-overview/) - Capture a web page/API and then replay the responses offline. (https://docs.mitmproxy.org/stable/overview-features/#server-side-replay https://docs.mitmproxy.org/stable/overview-features/#server-...). - Replay requests for testing. (https://docs.mitmproxy.org/stable/overview-features/#client-side-replay https://docs.mitmproxy.org/stable/overview-features/#client-...) Privacy: - Figure out what your Covid app is sending out (https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-alert-app https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-...) - Look at how evil IoT devices for pets are (https://www.nytimes.com/2018/12/11/realestate/spying-on-the-dog-or-cat.html https://www.nytimes.com/2018/12/11/realestate/spying-on-the-...) - Generally find more evil stuff (https://mitmproxy.org/publications/ https://mitmproxy.org/publications/) Security: - Reverse-engineering custom binary protocols is never fun, but with mitmproxy you can at least write custom contentviews to dissect stuff. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/addons/contentview.py https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...) - Fiddle with generic TLS-protected TCP streams. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/addons/tcp-simple.py https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...) - Dump TLS master secrets for WireShark. (https://docs.mitmproxy.org/stable/howto-wireshark-tls/ https://docs.mitmproxy.org/stable/howto-wireshark-tls/)

mpicker0 5y ago

We have a product that depends on data received from external web services. We often want to test certain conditions in the data (specific results, error scenarios, etc), and it's difficult or impossible to guarantee these conditions when we call out to our external services. We use mitmproxy to intercept and manipulate the responses we get. Even if we don't need to manipulate the data, it's a very useful tool for watching requests go back and forth.

thinkmassive 5y ago

I’ve used it to diagnose (and work around) webhook problems between third-party applications that are supposedly compatible. One that sticks out in my mind is trying to receive Slack webhooks in Mattermost. I was unaware of Slack’s new BlockKit message format until I saw what was being sent. Then I wrote a simple python script to transform the payload, all within mitmproxy. It’s not the most efficient long term solution, but the fact I could diagnose and resolve the issue with a single tool, all within a few hours of first discovering it, was very satisfying. Here’s the result for anyone interested (warning: it’sa quick hack, not a polished/maintained project) https://github.com/thinkmassive/mattermost-webhook-slack-proxy https://github.com/thinkmassive/mattermost-webhook-slack-pro... Edit: this doesn’t use TLS at all. I understand that’s probably the primary use case for the tool, but I thought this was a cool example of other ways it can be useful too.

it33 5y ago
Mattermost CEO here, really nice work @thinkmassive!

KORraN 5y ago

I've introduced mitmproxy in my team and we use it quite often for flows' inspection and manipulation while testing a desktop app. Can't count cases where a quick look into a proxy made debugging a lot easier, because we were able to point at unexpected requests / responses. Thank you for your work, @mhils & the team. Enjoy your moments of glory on HN :)

turtlebits 5y ago

I use it to download music from my music streaming subscription to my son's iPod. None of the files have any tags or metadata so it's was an interesting challenge to get everything tagged.

no_time 5y ago

I wrote a krunkerio aimbot that unpacks the msgpack-over-websocket packets and injects the calculated mouse movements into the stream. The biggest problem was the server only syncing the player position every second or so which means my middleware has can only provide exact calculations when I stand still. Solving this would require reading the process memory but that is exactly what I wanted to avoid :/