Mitmproxy CheatSheet

Mitmproxy is a command-line tool that acts as an HTTP and HTTPS proxy and records all the traffic. You can easily see what requests are being made and even replay them. Its great for diagnosing problems.

Mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols. You can prettify and decode a variety of message types ranging from HTML to Protobuf, intercept specific messages on-the-fly, modify them before they reach their destination, and replay them to a client or server later on.

• Intercept HTTP & HTTPS requests and responses and modify them on the fly
• Save complete HTTP conversations for later replay and analysis
• Replay the client-side of an HTTP conversations
• Replay HTTP responses of a previously recorded server
• Reverse proxy mode to forward traffic to a specified server
• Transparent proxy mode on macOS and Linux
• Make scripted changes to HTTP traffic using Python
• SSL/TLS certificates for interception are generated on the fly

MITM proxy and Charles proxy is an HTTP proxy/HTTP monitor that enables developers to view all of the HTTP and SSL/HTTPS traffic between the client and the server. The MITM in its name stands for Man-In-The-Middle, the basic idea behind it is to pretend to be the server to the client and pretend to be the client to the server, while in the middle we can observe the traffic coming from both sides on MITM proxy monitor.

The tricky part is that the Certificate Authority system is to create secure connections to a server via the Internet, by allowing a trusted party to cryptographically sign a servers certificates to verify that they are legit. As we know if the server has a Certificate authority with both public and private keys if the client which has these keys can only connect securely to the Sever. If this signature doesnt match a secure client will simply drop the connection and refuse to proceed, to overcome this Mitmproxy includes a full CA implementation that generates interception certificates on the fly. To get the client to trust these certificates, we register Mitmproxy as a trusted CA with the device manually.

        k                 Ctrl b
        ?                   ??
        ?                   ??
h ? ??? + ??? ? l           ?? page
        ?                   ??
        ?                   ??
        j             Ctrl f / Space 

URL containing "google.com"

google\.com

---

Requests whose body contains the string "test"

~q ~b test

---

Anything but requests with a text/html content type:

!(~q & ~t "text/html")

---

Replace entire GET string in a request (quotes required to make it work):

":~q ~m GET:.*:/replacement.html"

from mitmproxy import http


def request(flow: http.HTTPFlow) -> None:
    if flow.request.pretty_url == "http://example.com/path":
        flow.response = http.HTTPResponse.make(
            200,  # (optional) status code
            b"Hello World",  # (optional) content
            {"Content-Type": "text/html"}  # (optional) headers
        )

class AddHeader:
    def __init__(self):
        self.num = 0

    def response(self, flow):
        self.num = self.num + 1
        flow.response.headers["count"] = str(self.num)


addons = [
    AddHeader()
]