Show HN: Mitmproxy 1.0 released, now with a web interface
1–10 of 39 posts
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#2Author(s) here - happy to answer any questions and take feedback! :)
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#3Author(s) here - happy to answer any questions and take feedback! :)
Why the sudden bump to a 1.0 version number? And why the planned jump to 2.0 in February? (I'd really like to see that blog post you're alluding to. :)
Congrats on the release!
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#4Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may have never happened, even if I provide complete instructions for opening the flow.
(And I've spent a nontrivial amount of time to make the SAZ post processor thing to work but after spending an hour or two trying to get compatible versions and python's environment setup, I gave up, installed a Windows VM and made a Fiddler capture...)
edit: Now I feel guilty for a feature request in an announcement post. Thank you for mitmproxy! It's definitely something I use weekly and I very much appreciate the support that Maximilian has given me in various GitHub issues, Slack, etc.
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#5Author(s) here - happy to answer any questions and take feedback! :)
Many thanks to you, cortesi, and the rest of the team.
I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what originally attracted me to mitmproxy. Having CLI keyboard shortcuts helped me immediately speed up my workflow faster than I was ever able to customize ZAP or Burp.
I love mitmproxy and use it for all my web application pentests. The flexibility is amazing, and allows me to quickly adapt, or write a rewrite rule or plugin, in any situation. Regex rules for limits and intercepts are amazing too.
Keep up the good work.
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#6Looks cool! How does this compare to Burp Suite? I am specifically looking for something more lightweight.
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#7Author(s) here - happy to answer any questions and take feedback! :)
Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what originally attracted me to mitmproxy. Having CLI keyboard shortcuts helped me immediately speed up my workflow faster than I was ever able to customize ZAP or Burp. I love mitmproxy and use it for all my web application pentests. The flexibility i…
The console interface will always remain a first-class interface. We plan to bring mitmweb up to feature parity with the console, after which we'll make sure that neither tool has capabilities the other doesn't. I'm super excited about the new possibilities the web interface opens up for the project (watch this space), but the command-line tool is wired into my fingers. :)
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#8Author(s) here - happy to answer any questions and take feedback! :)
Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what originally attracted me to mitmproxy. Having CLI keyboard shortcuts helped me immediately speed up my workflow faster than I was ever able to customize ZAP or Burp. I love mitmproxy and use it for all my web application pentests. The flexibility i…
> I hope this doesn't mean that the command-line interface is going to become a second-class interface?
No worries - the command line interface is definitely staying a first-class interface.
We're also planning to mirror the CLI keyboard shortcuts in the web interface (to the extent possible). Some are already in, others are coming. :)
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#9Looks cool! How does this compare to Burp Suite? I am specifically looking for something more lightweight.
It's getting there, and if you hate Burp's Java UI and mostly use Burp solely to capture and manually edit requests, it might be an acceptable substitute.
I don't think pathoc/pathos are really close to what the Burp "Intruder" fuzzer does (and I'm not in love with Intruder either). A lot of people also rely on Burp's spider, for which there's no mitmproxy analog. Obviously, there's Burp's scanner, but I think scanners are a bad idea and wouldn't count this against mitmproxy.
Re: Show HN: Mitmproxy 1.0 released, now with a web interface
#10Looks cool! How does this compare to Burp Suite? I am specifically looking for something more lightweight.
I have used mitmproxy for performing web application pentest for years.
If you want something to create/intercept/edit/tamper/replay requests, this is your tool. If you want to script any of those things, this is still your tool.
However, burp comes with a lot of bells and whistles that don't make a lot of sense to build in to mitmproxy, but you can script yourself. For example, there is no intruder, spider, or scanner tool. But, they have an easy to use interface to write scripts that will be run on every request you make, or individual requests.
Or, you can just pass all mitmproxy traffic out to burp and get the best of both worlds.