10 ms·
Charles Proxy
- user3939382 11mo agoEven better SIP bullshit off kext tap nic mitm intermed. certs. Fuck all the phone home stuff it’s enough.
- infomaniac 11mo agoFantastic software that I've used for over a decade. Interacted with Karl a few years ago about Adobe's AMF format; very generous with his time. I was surprised to learn that it's over 20 years old! https://en.wikipedia.org/wiki/Charles_Proxy https://en.wikipedia.org/wiki/Charles_Proxy
- sponno 11mo agoi just texted Karl to say he’s on the front page of HN. I was the same. Charles was soo good for ol AMF!! Still miss Flash.
- followben 11mo agoWow. Charles was indispensable tool for working with HTTP apis back when I got started as an iOS dev in 2011. Great to see it still going strong.
- tgma 11mo agoMore narrow cmdline http inspection tool https://github.com/signeen/inspect-http-proxy https://github.com/signeen/inspect-http-proxy
- cientifico 11mo agoOne hidden gem. The closest free alternative is https://www.mitmproxy.org/ https://www.mitmproxy.org/ that is not even close. And off course, https://www.wireshark.org/ https://www.wireshark.org/ but that is too generic and with a bigger learning curve. Worth the money. And no subscription (or there weren't a subscription back then)
- efortis 11mo agoBurp is free too (community edition) https://portswigger.net/burp/communitydownload https://portswigger.net/burp/communitydownload
- _k2vp 11mo agoI built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption. Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/tree/main/data-collection/mitm https://github.com/acheong08/apple-corelocation-experiments/... I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days. Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .
- le-mark 11mo ago> It's insane that I can't even develop for my own phone without paying an extra fee to Apple. A Linux phone can’t come fast enough. Yes there is at least one, on ancient hardware. IMO a viable Linux phone requires hardware at most one generation old.
- well_ackshually 11mo agoThat Linux phone is called Android. It runs plenty fine enough even without GApps (or with shims like microg), and the sheer amount of engineering needed to make baseline linux even usable as a phone system is over a dozen years away. Android with binder is a strictly superior architecture that anything else that has come for strict isolation. As a bonus, it's battle tested, and latest Android phones just... run linux. You can have a shell and GTK if you so desire.
- DrBenCarson 11mo agoAlltime great software I’m on proxyman https://proxyman.com/ https://proxyman.com/
- jibcage 11mo agoI used Charles for a while and also jumped on the Proxyman bandwagon. It’s a slick tool and even works for remote debugging (i.e., an iPhone attached to your computer with a cable).
- tricker5453 11mo agoProxygen (https://proxygen.app https://proxygen.app) has this super cool way to pair its iPhone app with the Mac app, and then remotely inspect traffic from iPhone apps on the Mac. You do the pairing once and then just beam traffic over. Attaching cables feels pretty ancient compared to this.
- wahnfrieden 11mo agoEven after using it for years I could never recognize all its unlabeled icons without hovering for tooltip I emailed the author about it a decade ago but he didn’t seem convinced
- hboon 11mo agoI don't have elaborate needs and have used Charles for many years. A few years ago I switched to https://proxyman.com https://proxyman.com and found it easier to use.
- cientifico 11mo agoThat it's an osx ONLY app.
- sgt 11mo agoLooks much better, thanks for that tip
- ChrisMarshallNY 11mo agoPretty nice. Does it work for Xcode simulators? I use Charles extensively (I am using it for the development I’m doing right now), and it needs to work on simulators. Cost isn’t an issue for me. Fitness to purpose is important. I won’t cripple my development capacity, in order to save $50.
- jshier 11mo agoYes, Proxyman has great sim integration, including the ability to filter by apps within the sim. It's a far better macOS app than Charles, and I've never found it to be lacking a feature I used in Charles.
- el_benhameen 11mo agoJust upgraded my license today, so I guess Charles is my new Baader-Meinhof token. Great tool! The ssl proxying is especially handy.
- aua 11mo agoI found Charles Proxy last year and it's fantastic. They have a mobile app too (if you need the ssl proxying for mobile apps).
- thunderbong 11mo agoDidn't know about that. https://www.charlesproxy.com/documentation/ios/ https://www.charlesproxy.com/documentation/ios/
- self_awareness 11mo agoThis one is truly a gem: https://httptoolkit.com https://httptoolkit.com It even bypasses SSL pinning on Android using 1 click.
- eddywebs 11mo agoHow come a reverse-proxy, better than the network tab in dev tools ?
- efortis 11mo agoYou can do more, e.g., changing the status code
- leptons 11mo agoDev tools is an "inspector" and limited in scope, like a butter knife, a real proxy tool is like a Swiss Army knife.
- keithnz 11mo agosuper useful when you have an application, i.e. not a browser, that is making api calls that you want to inspect.
- logicuce 11mo agoI feel obliged to mention Fiddler. The tool I loved almost 20 years back and felt like it came from future. IIRC it was/is more powerful than Charles. Fiddler was Windows only but at one time they had builds for other platforms in works. Sadly they got acquired which changed their roadmap, and I had also moved on from Windows. https://www.telerik.com/fiddler https://www.telerik.com/fiddler
- _blackhawk_ 11mo agoThis. I tell people tales of that beautiful tool. have you found anything for a MacOS? My hunt so far has been futile.
- dsincl12 11mo agohttps://proxyman.com/ https://proxyman.com/
- logicuce 11mo agoFor macOS settled on Charles back then but not as capable as Fiddler.
- mytydev 11mo agoThe fiddler landing page says it runs on Windows, macOS, and Linux, so maybe give it another try.
- logicuce 11mo agoThe original thing is now called Fiddler Classic and it is still Windows only. Not maintained anymore, sadly. It has first class scripting support.
- leptons 11mo agoI still use Fiddler Classic, at least once a week when I need to dig-in on a problem. It occasionally gets an update though I can't remember the last time it did. It's so powerful, especially with the JScript scripting language. Such a powerful tool.
- _f9cu 11mo agoNever learnt the use of this tool. The certificate configuration tripped my head during my work. This gives brain damage because it doesn't make sense. Why to check network payload when you are sure the data was sent. -frontend developer
- myHNAccount123 11mo agoIt's invaluable for mobile developers. What you think you sent and in what order, is not always what happens. Charles and Proxyman help you figure that out.
- swaraj 11mo agoI once used Charles Proxy to change all the game configs for Candy Crush Saga on my phone back in 2013 by intercepting and replacing the API requests - I made all the puzzles have 1-2 colors and infinite powerups. I guess they didn't care much about the security because I ended up spending way more time in the game
- h33t-l4x0r 11mo agoI loved Charles, I used it for many years. It only stopped when an update changed the UI in ways that were confusing, and also the chrome network tab really did everything I need in terms of inspecting requests / responses.
- runtimepanic 11mo agoBurp Suite can do much of this as well, but the intent feels different. Charles is very much about observing and understanding raw HTTP(S) traffic with minimal friction, which makes it handy for quick debugging, mobile app inspection, or client-side issues. Burp leans heavily into security workflows: interception, replay, automation, and attack surface exploration. That power comes with more setup and a more opinionated UI. I’ve found Charles useful when I want visibility without switching into “pentest mode,” whereas Burp shines when security analysis is the goal.
- lillesvin 11mo agoJust to mention an alternative option, ZAP (aka. Zed Attack Proxy) covers much of the same ground as Burp and is entirely free and Open Source.
- dns_snek 11mo agoOn paper ZAP has all of the features I care about, but I gave it my best try and found it really unintuitive to use.
- Sytten 11mo agoYou can also check out Caido as an alternative, we are a newer player in the space but catching up very fast. Most of the Burp new features of the last 2 years are basically copying what we innovated in Caido.
- runtimepanic 11mo agoThat’s fair. I mostly stick with Burp because I’m very familiar with its workflows and tooling, and that familiarity matters a lot in day-to-day work. That said, I genuinely appreciate having credible competitors to Burp. New tools entering the space tend to challenge long-standing assumptions, especially around UX and ergonomics, and that pressure usually benefits everyone. Even if I don’t switch immediately, competition is healthy and often the reason established tools keep improving.
- 11mo ago
- rramadass 11mo agoHow does "Zed Attack Proxy" (ZAP - https://www.zaproxy.org/ https://www.zaproxy.org/) which is opensource and part of OWASP (https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools https://owasp.org/www-community/Free_for_Open_Source_Applica...) compare with this and other similar proxies?
- simultsop 11mo agoTool that can't be beaten
- tricker5453 11mo ago[dead]
- daishi424 11mo agoMind making some disclosure? Your account is 0 days old, and has made 3 comments. All in the same thread and promoting the same app.
- tricker5453 11mo agoJust noticed this post making the rounds in Hacker News. I've worked with these tools for tens of years so figured I'd chime in, although I haven't commented here before. Lately I've been super happy with the Proxygen app and wanted to add it to the discussion because I really want to see that app thrive. Included the URL as the names are easy to confuse.
- poemxo 11mo agoI like Burp Suite better for intercept and Squid better for a persistent proxy but maybe I'll give Charles another shot.
- obventio56 11mo agoWait why is this on the front page? I thought this is a very established and well-known tool
- everlier 11mo agoI am also confused, I can't see any recent news/updates for this project either.
- geerlingguy 11mo agoFrom time to time, an "old" things reappears, since there's always a number of people who haven't heard of it (or just like upvoting things they like, I guess). Obligatory Ten Thousand reference: https://xkcd.com/1053/ https://xkcd.com/1053/
- benhurmarcel 11mo agoWell I never heard of it before so I appreciate it
- doomerhunter 11mo agoI am a Burp guy, but lately Caido[1] has been trending, pretty lightweight and can be ran in headless mode. It's still very security-oriented (as Burp Suite is), but might be worth your time, notably as you can run it on a VPS/container to proxy all your traffic through it (which is by-design, contrary to my beloved burp/zap) [1] https://caido.io/ https://caido.io/
- Sytten 11mo agoCaido co-founder here, thanks for the shoutout! We are slowly moving to the DevSecOps space too.
- ghxst 11mo agoPlease consider allowing the user to modify the TLS handshake / ClientHello. Out of all proxies I have used only Burp offers this through a plugin / extension.
- Sytten 11mo agoAgreed this is something we need to do, but not easy to do properly. The TLS 1.3 spec has a lot of extensions, currently we use openssl that for example doesn't support GREASE.
- doomerhunter 11mo agoMy pleasure, your team is doing a great job and its good to see competition in that space, forces everyone to push forward :D
- dhuan_ 11mo agoI’ve found tools like Charles really useful for understanding what’s happening on the wire. When I need something more repeatable (tests, offline work), I usually reach for a mock server instead. I ended up building a small one for my own use and later open-sourced it: https://dhuan.github.io/mock/latest/examples.html https://dhuan.github.io/mock/latest/examples.html
- Aldipower 11mo agoUsed it heavily as my AS3 dev times from 2008 to 2011. Crazy that is still around.
- kyleblarson 11mo agoThe combination of Charles + Postman is great for reverse engineering mobile API's. Inspect traffic w/ Charles, export request to cUrl, import cUrl into Postman, play around with request headers / params / etc, export to py, use Cursor to create reusable library.
- oxedom 11mo agoOut of curiosity, what would the setup for reverse enginering a iOS/Android app look like using Charles Proxy?
- ghxst 11mo agoI'd say Reqable is a worthy mention as well.
- cxplay 11mo agoI'm also using Reqable, for those interested check it out: https://reqable.com https://reqable.com
- akaitea 11mo agoFor my rather simple needs I've been using https://httptoolkit.com https://httptoolkit.com free edition, I like that it launches a independent Firefox window on its own for the intercepting so I don't have to touch my working browser or deal with configuring a proxy anywhere
- nunez 11mo agoUsed this all of the time back in the day. Great tool.
- 1vuio0pswjnm7 11mo agoIs this "breaking TLS", as referred to here: https://news.ycombinator.com/item?id=46214950 https://news.ycombinator.com/item?id=46214950
- sflanker 11mo agoThis is a totally different class of software than what that post is ranting about. Charles is a local developer tool intended for temporary use when debugging. It only inspects TLS connections if 1) you enable that feature and 2) you add the domain being connected to the list to be inspected. That being said, the mechanism is the same. Charles generates a root certificate that it uses to issue certificates for each domain in intercepts a TLS connection for and you need to install that root certificate in your OS such that your clients will trust that certificate. If you have a client that doesn’t use the Mac OS certificate store you may have to do some extra per client configuration. I also despise “security” tools that intercept and inspect TLS traffic (such as ZAcaler for example), but I find a Charles to be very useful for what it does and the TLS inspection support is easy to use and really helpful/necessary in some cases.
- 1vuio0pswjnm7 11mo agoIs the "breaking TLS" rant referring to the mechanism for doing so or to the reason why the mechanism is being used (and/or who is using it)
- PieUser 11mo agoUgh these comments - every time it's just people spewing alternatives they like better
- keithnz 11mo agothat's a good thing, many a time I've discovered some real gems by people telling us about alternatives
- snyp 11mo agoA much better alternative for MacOS folks https://proxyman.com/ https://proxyman.com/
- ollysb 11mo agoI used Charles for many years but proxyman's performance is a real step up.
- rightisleft 11mo agoflashback to 2009 right here...
- dilyevsky 11mo agoIs there a story behind misusing the term "reverse proxy" as it is clearly a forward proxy?
- dacapoday 11mo agoWhy not [Reqable](https://reqable.com/en-US/ https://reqable.com/en-US/)? More modern, more powerful.