aeondave/mitmproxy

mitmproxy

Interactive HTTP/HTTPS MITM proxy.

Quick Start

mitmproxy -p 8080
mitmweb -p 8080
mitmdump -p 8080 -w traffic.dump

Install CA cert: browse to http://mitm.it while proxy is running.

Modes

| Mode | Command | Use case | |------|---------|----------| | Regular proxy | mitmproxy | Browser/tool proxying | | Transparent | --mode transparent | Intercept without proxy config | | Reverse | --mode reverse:http://target | Reverse proxy | | SOCKS5 | --mode socks5 | SOCKS proxy |

TUI Keybindings

| Key | Action | |-----|--------| | Enter | Inspect request | | e | Edit request/response | | r | Replay request | | f | Set filter | | i | Set intercept filter |

Python Addon

from mitmproxy import http

def request(flow: http.HTTPFlow):
    if flow.request.method == "POST":
        print(flow.request.pretty_url, flow.request.get_text())

mitmproxy -s addon.py

Useful Addons

# Dump all POST bodies
from mitmproxy import http

def request(flow: http.HTTPFlow):
    if flow.request.method == "POST":
        with open("posts.txt", "a") as f:
            f.write(f"{flow.request.pretty_url}\n{flow.request.get_text()}\n---\n")

# Modify response (e.g. replace token)
def response(flow: http.HTTPFlow):
    if "api/auth" in flow.request.pretty_url:
        flow.response.text = flow.response.text.replace(
            '"role":"user"', '"role":"admin"'
        )

# Add header to all requests (e.g. auth bypass)
def request(flow: http.HTTPFlow):
    flow.request.headers["X-Admin"] = "true"
    flow.request.headers["X-Forwarded-For"] = "127.0.0.1"

Transparent Proxy Setup (Linux)

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Redirect traffic to mitmproxy (iptables)
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080

# Start in transparent mode
mitmproxy --mode transparent --showhost -p 8080

CLI Filtering (mitmdump)

# Capture only POST requests
mitmdump -p 8080 -w traffic.dump "~m POST"

# Capture by domain
mitmdump -p 8080 -w traffic.dump "~d example.com"

# Show only responses with 2xx status
mitmdump -p 8080 "~s ~c 2"

Resources

| File | When to load | |------|--------------| | references/addons.md | Full addon API reference, filter syntax, transparent proxy iptables, upstream proxy chaining |