5 ms·

I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using

I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.

daeken 5y ago
FWIW, Burp also does this. But I'm not sure I'd argue that it actually has a nicer UI ;)
- mhils 5y ago
  Shameless plug: We (mitmproxy) have a somewhat reasonable web UI (React/Typescript), but I think there's a lot more potential here. We're also looking for Google Summer of Code students at the moment, so if someone wants to spend a few months hacking on cool FOSS stuff while getting a nice stipend for it, please check out https://github.com/mitmproxy/mitmproxy/issues/5048 https://github.com/mitmproxy/mitmproxy/issues/5048 and reach out to me. I'd love to work with good front end folks on this! :)
  - djbusby 5y ago
    I'm still loving the TUI. Thanks for the awesome work.
Groxx 5y ago
er. don't they all? at least all the sophisticated ones. otherwise you can't see the contents of https/etc requests. Charles does this as well for example, and it's reasonably popular: https://www.charlesproxy.com/ https://www.charlesproxy.com/ AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles%20proxy%22,mitmproxy https://trends.google.com/trends/explore?geo=US&q=%22charles... or are you referring to some other cert-related feature?
- hug 5y ago
  I assume he means client certificates for HTTPS mutual auth. https://techcommunity.microsoft.com/t5/iis-support-blog/client-certificate-authentication-part-1/ba-p/324623 https://techcommunity.microsoft.com/t5/iis-support-blog/clie...
- GordonS 5y ago
  I think you're confusing server certificates and client certificates - I'm specifically referring to client certificates here, aka TLS mutual authentication. Also, isn't Charles OSX only?
  - Groxx 5y ago
    OSX-only: I think so. But google trends doesn't care about that, so the scale-of-support side still stands. And yeah, I wasn't thinking of client certs for auth purposes. I assume that'll hide the encryption keys, so you need a proxy that can do its own exchange? I have no idea what support for that looks like, I've never tried.
  - luckman212 5y ago
    > isn't Charles OSX only? Nope! Charles runs on Windows, Mac, and Linux.
- clumsysmurf 5y ago
  Another nice one with GUI is proxyman.

I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.

daeken 5y ago

FWIW, Burp also does this. But I'm not sure I'd argue that it actually has a nicer UI ;)

mhils 5y ago
Shameless plug: We (mitmproxy) have a somewhat reasonable web UI (React/Typescript), but I think there's a lot more potential here. We're also looking for Google Summer of Code students at the moment, so if someone wants to spend a few months hacking on cool FOSS stuff while getting a nice stipend for it, please check out https://github.com/mitmproxy/mitmproxy/issues/5048 https://github.com/mitmproxy/mitmproxy/issues/5048 and reach out to me. I'd love to work with good front end folks on this! :)
- djbusby 5y ago
  I'm still loving the TUI. Thanks for the awesome work.

Groxx 5y ago

er. don't they all? at least all the sophisticated ones. otherwise you can't see the contents of https/etc requests. Charles does this as well for example, and it's reasonably popular: https://www.charlesproxy.com/ https://www.charlesproxy.com/ AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles%20proxy%22,mitmproxy https://trends.google.com/trends/explore?geo=US&q=%22charles... or are you referring to some other cert-related feature?

hug 5y ago
I assume he means client certificates for HTTPS mutual auth. https://techcommunity.microsoft.com/t5/iis-support-blog/client-certificate-authentication-part-1/ba-p/324623 https://techcommunity.microsoft.com/t5/iis-support-blog/clie...
GordonS 5y ago
I think you're confusing server certificates and client certificates - I'm specifically referring to client certificates here, aka TLS mutual authentication. Also, isn't Charles OSX only?
- Groxx 5y ago
  OSX-only: I think so. But google trends doesn't care about that, so the scale-of-support side still stands. And yeah, I wasn't thinking of client certs for auth purposes. I assume that'll hide the encryption keys, so you need a proxy that can do its own exchange? I have no idea what support for that looks like, I've never tried.
- luckman212 5y ago
  > isn't Charles OSX only? Nope! Charles runs on Windows, Mac, and Linux.
clumsysmurf 5y ago
Another nice one with GUI is proxyman.