8 ms·
Mitmproxy 8
- armitron 5y agoNice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies. Can't wait for someone to do it in Go.
- SixDouble5321 5y agoThis banana is delicious but makes for a terrible automobile. I wish someone would make a banana that could get me to work on time. In other news I know of a MitM proxy that works as advertised, has a decent UI, and is reasonably tasty.
- develatio 5y agoI thought mitmproxy was designed to make it easier to debug stuff in a local environment. Why would you want to deploy it to production? How would you use it?
- throwaway1777 5y agoMaybe they write malware?
- retrobox 5y agoI’m also curious about the use case. For debugging things locally, it is ideal for my needs.
- armitron 5y agoMany different applications: Red/blue teaming, metric collection, policy-based decision making.
- marginalia_nu 5y agoSeems like a bit of a foot-gun to do these things by effectively undermining your own security.
- Cyphase 5y agoRed teaming at least is all about undermining ~your security. ;)
- creeble 5y agoNot sure I understand "MITM" and "in production".
- armitron 5y agoEvery single major corporation does "MITM in production".
- creeble 5y agoWell, okay, got me. But you don't need to do what mitmproxy does in that case.
- Beltalowda 5y agomitmproxy is explicitly intended as an interactive MITM for debugging: "your swiss-army knife for debugging, testing, privacy measurements, and penetration testing". What you're talking about here was never a goal. And being in Python means it's much easier to extend, which is also greatly useful.
- oarsinsync 5y agoThis isn't a replacement for a Bluecoat, this is a developer/debugger application.
- deleted 5y ago[deleted]
- stgn 5y agoOne of the things I like about mitmproxy is how easy it is to develop and use addons. You just pass a script file to it. How would you achieve such painless extensibility if it were written in Go?
- Beltalowda 5y agoExactly this. It's very hard to do with Go; also see Hugo, where Go is in many ways "holding it back" compared to something like Jekyll, which you can customize and hack with great ease. I love Go, but this kind of things is not where it shines.
- fork-while-fork 5y agoCheck out bettercap
- dstotijn 5y agoFWIW: I'm building something in Go (https://github.com/dstotijn/hetty https://github.com/dstotijn/hetty). But it's pretty early stage and not even near the featureset that mitmproxy or Burp Suite has. Also I wouldn't dare say it's more efficient (yet!). But Go has been great so far to build it. As mentioned elsewhere: (dev friendly) extensibility/add-ons with Go will be an interesting challenge. Haven't looked into it yet.
- jorgesborges 5y agoThis is cool. I’m learning a lot reading through the docs. Why is subversion so instructive? I’ve read about SSL certificates a gazillion times and it’s simple enough in theory but for some reason this is making everything click. What’s the use most common use case for something like this, by the way?
- gizmo686 5y agoDebugging things that happen over TLS.
- jeroenhd 5y agoYou can use this to debug stuff happening over TLS connections, but there are also other practical ways to use it. For example, install the CA certificate on your phone (with root if you have Android) and set up a WiFi network that transparently proxies everything through mitmproxy. Let it collect data for a while and you'll be surprised how many random servers even well known apps try to contact. You'll also be able to see what data they're trying to send! With modern TLS pinning that's a little hard, but there are Frida scripts out there for rooted/jailbroken devices that will let you bypass that. Just make sure to remove the cert afterwards and to reboot the device to make sure none of your mods remain in memory where they might affect your device's security. You don't always need TLS, either. It's also useful as a general proxy for protocols like HTTP, for example to intercept, alter, and repeat requests. This can be very useful if you're running into a bug accessing a backend endpoint from code that doesn't easily allow you to iterate through the request code, like some mobile dev frameworks.
- almog 5y agoSince Android Nougat I think you cannot install user certificates unless you: 1. Root your device. 2. Add the certificate to the APK manifest. I'm not well versed in Android changes, this is just the conclusion I came to when Nougat came out and haven't tried it again since. If there's an easier way to use MITM with Android without modifying the APK / rooting your device, I'd love to know!
- 5y ago
- Tretiotrr 5y agoIs there any benchmark against squid proxy in regards of cpu and memory usage? Anyone has expiernce with it or can recommend something else?
- orev 5y agoSquid is meant to be used as a general proxy for things like caching to help your local network save bandwidth, etc. Mitmproxy is more of a pen testing/security tool. They’re very different things and not something you would be comparing benchmarks to try to choose one.
- tills13 5y agoFWIW from experience MITMproxy eventually reaches a point on my 2019 MacBook Pro where the whole computer becomes unusable. I have to restart MITMproxy. I don't think they are doing all the necessary GC when disposing of flows from the UI.
- sanqui 5y agoI've been looking to use mitmproxy to capture traffic in a project, but the serialization format is something called TNetStrings [1], which postfixes types and is thus not streamable. There seem to be some efforts to switch flow captures to use SQLite [2] or Protobuf [3], although PCAP would also be nice, I think. [1] https://tnetstrings.info/ https://tnetstrings.info/ [2] https://github.com/mitmproxy/mitmproxy/issues/3075 https://github.com/mitmproxy/mitmproxy/issues/3075 [3] https://github.com/mitmproxy/mitmproxy/pull/3232 https://github.com/mitmproxy/mitmproxy/pull/3232
- ireneu 5y agoThere’s an addon that supports PCAP files [0]. It works quite well in my experience. [0] https://github.com/muzuiget/mitmpcap https://github.com/muzuiget/mitmpcap
- mhils 5y agoCould you explain what your use case is? What format would you prefer?
- deleted 5y ago[deleted]
- sanqui 5y agoSorry for not stating that in the first place! My use case is archival and preservation. It should be possible to stream the format, build indexes into it (ideally at runtime alongside the capture), it should be as complete as possible, and it should last a long time. I'm looking into pcapng together with a sslkeylog file as the formats of choice for this currently.
- GordonS 5y agoI've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.
- daeken 5y agoFWIW, Burp also does this. But I'm not sure I'd argue that it actually has a nicer UI ;)
- mhils 5y agoShameless plug: We (mitmproxy) have a somewhat reasonable web UI (React/Typescript), but I think there's a lot more potential here. We're also looking for Google Summer of Code students at the moment, so if someone wants to spend a few months hacking on cool FOSS stuff while getting a nice stipend for it, please check out https://github.com/mitmproxy/mitmproxy/issues/5048 https://github.com/mitmproxy/mitmproxy/issues/5048 and reach out to me. I'd love to work with good front end folks on this! :)
- djbusby 5y agoI'm still loving the TUI. Thanks for the awesome work.
- Groxx 5y agoer. don't they all? at least all the sophisticated ones. otherwise you can't see the contents of https/etc requests. Charles does this as well for example, and it's reasonably popular: https://www.charlesproxy.com/ https://www.charlesproxy.com/ AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles%20proxy%22,mitmproxy https://trends.google.com/trends/explore?geo=US&q=%22charles... or are you referring to some other cert-related feature?
- hug 5y agoI assume he means client certificates for HTTPS mutual auth. https://techcommunity.microsoft.com/t5/iis-support-blog/client-certificate-authentication-part-1/ba-p/324623 https://techcommunity.microsoft.com/t5/iis-support-blog/clie...
- cjbprime 5y agoNeat! Anyone happen to know if there's progress on interactive interception of TCP TLS streams (non-http)?
- mhils 5y agoNot yet. What works reasonably well is to iteratively work with a custom addon (addons are livereloaded on every change). But I'd love to see progress on that front, it'd make a great GSoC project! :)
- BrianHenryIE 5y agoI was reverse engineering my microwave a few years ago and couldn't MITM on XMPP because of the TLS so I used a jailbroken iPhone and was able to "swizzle" the Objective-C methods to log the data at a method right before encryption started. Fun. There was another XMPP MITM I could have used, but I think I was already invested in figuring out the first idea before I learned of the simpler, existing way: https://github.com/BrianHenryIE/XMPPFrameworkLogger https://github.com/BrianHenryIE/XMPPFrameworkLogger https://github.com/iamultra/xmppmitm https://github.com/iamultra/xmppmitm
- marcodiego 5y agoWhen I was a teenager I wrote generic proxy in Borland C++ Builder. I say generic because it was not protocol specific, at the time I called it a "bridge". I had lots of fun convincing 'friends' to try my "own IRC server" and watch they interact with other people. These days I think it would be a simple matter of using tee and netcat, but it was fun at the time. It is a shame getting a "real ip" is such a hassle nowadays.
- _ZeD_ 5y agowhy should I use this instead of fiddler[0]? [0] https://www.telerik.com/fiddler/fiddler-classic https://www.telerik.com/fiddler/fiddler-classic
- SixDouble5321 5y agoFiddler classic is probably fine for Windows users. It's a bit old and unsupported now if I'm not mistaken, but otherwise good IMHO. New fiddler is not something I would recommend or use, I can't get passed the fact you need to login to it. Mitm works on Mac and Linux and it's never asked me to login once.
- markuta 5y agoI’ve used mitmproxy with the transparent proxy mode for decrypting VPN traffic. Works really well. The mitmweb feature is quite usually too.
- mhils 5y agomitmproxy dev here! Happy to answer any questions. Answers may take a while as I'm on a remote mountain hut, but please shoot. :)
- igetspam 5y agoNo question, just a thanks. First used mitmproxy to build a demo CDN to show off for a customer that hadn't signed yet, so they wouldn't give me certs (reasonable). It was so simple to use, it scares people. I had to explain how CA trusts worked before the company would consider using it to show off.
- SixDouble5321 5y agoAlso thanks. The alternatives are expensive or just ass by comparison. Plus the name is cool.
- SixDouble5321 5y agoUsed it to troubleshoot test-cafe hammerhead which itself is a proxy, but it fails to do its job under more circumstances than you would think.
- HellsMaddy 5y agoMitmproxy is so much fun. I used it recently to inspect the traffic between a `node --inspect` process and the Chrome devtools. I then used my understanding to "fix" a few things that annoyed me about the node debugging workflow - like how each time the debug server starts, it has a unique URL that you need to manually attach to in the debugger. It's very hacky but it works for my needs. https://github.com/b0o/ndbproxy https://github.com/b0o/ndbproxy
- sleepybrett 5y agoI've seen this software, misconfigured, become an open socks proxy sitting on the public internet being used by shady 'vpn' providers to proxy connections. (it bubbled up to me because dns operators were seeing a lot of very weird dns queries originating from our account where we ran a large shared kubernetes cluster. I was tasked with finding the pod/s that were causing the problem)