Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Mitmproxy 1.0 released, now with a web interface

corte.si

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#11

Post by tptacek »

capt8bit wrote: post #5
mhils wrote: post #2

Author(s) here - happy to answer any questions and take feedback! :)

Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what originally attracted me to mitmproxy. Having CLI keyboard shortcuts helped me immediately speed up my workflow faster than I was ever able to customize ZAP or Burp. I love mitmproxy and use it for all my web application pentests. The flexibility i…

That's interesting to me. Can you describe your Burp workflow, and how you accomplish the same things in mitmproxy?

One of the things we're doing this year for our clients is selling them on the idea of doing basic security integration testing as part of their normal dev process, which might involve these companies buying copies of Burp for their team. But I could probably be convinced that mitmproxy would work just as well.

(I am, for what it's worth, extremely familiar with Burp, but only casually acquainted with mitmproxy).

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#12

Post by nimrody »

colemickens wrote: post #4

Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may have never happened, even if I provide complete instructions for opening the flow. (And I've spent a nontrivial amount of time to make the SAZ post processor thing to work but after spending an hour or two trying to get compatible versions an…

There's a Fiddler version for Linux (based on mono) which, in my experience, works quite well. Easier than starting up a windows VM.

The killer feature of Fiddler, for me, is the timeline display which we use to optimise network heavy apps.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#13

Post by Goopplesoft »

Forgot this was written in python. Scanned the code to see how they do http/2. This lib seems useful for general python use:

https://github.com/mitmproxy/mitmproxy/tree/master/pathod

https://github.com/mitmproxy/mitmproxy/blob/master/mitmproxy...

The whole package very well written. I'll definitely read through it and add it to my list of repos people should scan if they work with python.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#15

Post by cortesi »

echelon wrote: post #3
mhils wrote: post #2

Author(s) here - happy to answer any questions and take feedback! :)

Why the sudden bump to a 1.0 version number? And why the planned jump to 2.0 in February? (I'd really like to see that blog post you're alluding to. :) Congrats on the release!

It probably has to do with psychology more than anything. My mental model of this sort of development (if you'll permit me to be a bit florid) is of an eternal pilgrimage of small incremental improvements, without any fixed destination or many real landmarks along the way. The TODO list for mitmproxy has never grown shorter (and never will), so I just never reached a point where declaring a 1.0 was obviously right. I realise this is eccentric, doesn't reflect the maturity of the project, and is probably not the way my co-maintainers think about this, hence the change.

For much the same reason, I'd like to de-emphasise major version increments as flag-fall events. Incrementing the major version inline with our development cadence makes sense from that perspective.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#16

Post by colemickens »

nimrody wrote: post #12
colemickens wrote: post #4

Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may have never happened, even if I provide complete instructions for opening the flow. (And I've spent a nontrivial amount of time to make the SAZ post processor thing to work but after spending an hour or two trying to get compatible versions an…

There's a Fiddler version for Linux (based on mono) which, in my experience, works quite well. Easier than starting up a windows VM. The killer feature of Fiddler, for me, is the timeline display which we use to optimise network heavy apps.

Kind of a non-starter for me, as this is a headless cloud VM with more RAM and CPU than any PC I've ever owned. If I were to actually install X, Xrdp, etc... I'm not in a better situation than simply using Windows in the first place.

And I suppose it's been long enough since trying Fiddler for Linux that I should reserve my experiences from last time around. I've gotten pretty used to mitmproxy. Seems to be the defacto, goto tool for HTTP captures on Linux.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#17

Post by mhils »

SimeVidas wrote: post #14

The web interface is available only after installing the Python tool, or?

Not sure if this answers your question: You can download our precompiled standalone binaries from https://github.com/mitmproxy/mitmproxy/releases/, run the mitmweb executable and your browser should open.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#18

Post by cortesi »

colemickens wrote: post #4

Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may have never happened, even if I provide complete instructions for opening the flow. (And I've spent a nontrivial amount of time to make the SAZ post processor thing to work but after spending an hour or two trying to get compatible versions an…

Something we'll be focusing on in the next release cycle is much better export and import to/from other formats. We already have pretty good HAR support, and that's going to get much better soon. I don't know if the SAZ format is well-documented... but Fiddler is an excellent tool and we'd like to be able to work alongside it. I'd certainly merge SAZ support if, say, I woke up tomorrow morning to a PR implementing it.

Re: Show HN: Mitmproxy 1.0 released, now with a web interface

#20

Post by mhils »

Goopplesoft wrote: post #13

Forgot this was written in python. Scanned the code to see how they do http/2. This lib seems useful for general python use: https://github.com/mitmproxy/mitmproxy/tree/master/pathod https://github.com/mitmproxy/mitmproxy/blob/master/mitmproxy... The whole package very well written. I'll definitely read through it and add it to my list of repos people should scan if they work with python.

Thanks!

We actually use https://github.com/python-hyper/hyper-h2 to implement mitmproxy's HTTP/2 support and have our own HTTP/2 mini-stack for fuzzing that (which is also exposed in pathod).

Post reply on HN