I thought this would be something that would run in my own machine.
As others have suggested mitmproxy[1] is great for this.
Show HN: A proxy service for debugging HTTP/S traffic
11–20 of 44 posts
Re: Show HN: A proxy service for debugging HTTP/S traffic
#12> debugProxy is a HTTP/S hosted proxy server that lets you interact with the traffic passing through it, using a web based dashboard. So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffi…
> So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Yes. Requests more than 20 minutes old are permanently deleted. > Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffic as well. No, if you make HTTPS requests they are tunneled over T…
> mitmproxy is indeed great, in fact, this service is build on mitmproxy instances :)
I can appreciate this. Pre-configured / zero config open source software as a service is a useful thing. Not everyone wants to install, configure, and deal with command line tools.
Are there tradeoffs? Sure. Would I personally make those tradeoffs? No. But I am sure some people will.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#13Moderns app use SSL pinning, same with big websites using HSTS. So this won't really decrypt HTTPS traffic
You may be a little optimistic here. Just because the technology exists does not mean everyone uses it.
I use a MITM proxy to reverse engineer my IoT apps all the time (a lot of them don't provide public APIs but I want to use them from my controller app). I have not once ran into one that used pinning.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#14Moderns app use SSL pinning, same with big websites using HSTS. So this won't really decrypt HTTPS traffic
HPKP (which I assume you meant when saying HSTS) in browsers does not apply if you add a CA manually, exactly to allow HTTPS interception.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#15Moderns app use SSL pinning, same with big websites using HSTS. So this won't really decrypt HTTPS traffic
This will prevent decryption. In cases where you are debugging your own modern SSL pinned apps, you can add the debugproxy root certificate in development / testing builds.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#16Earlier quoted context omitted.
> So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Yes. Requests more than 20 minutes old are permanently deleted. > Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffic as well. No, if you make HTTPS requests they are tunneled over T…
> mitmproxy is indeed great, in fact, this service is build on mitmproxy instances :) I can appreciate this. Pre-configured / zero config open source software as a service is a useful thing. Not everyone wants to install, configure, and deal with command line tools. Are there tradeoffs? Sure. Would I personally make those tradeoffs? No. But I am sure some people will.
This is my thoughts too. I wouldn't think it is very useful to most mitmproxy/fiddler/charles power users.
But not having to install something, find your IP address, open your firewall etc, allows some users who don't want to do all this to start using a debugging proxy without having to. I'm not sure how many of these users exist though, we will see!
Re: Show HN: A proxy service for debugging HTTP/S traffic
#17These guys never seem to get a mention when this subject surfaces. So I'll address that:. https://cloudmiddleman.com
Been using them for a couple of years, excellent support and new features keep on coming to their already slick web UI.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#18[deleted]
Re: Show HN: A proxy service for debugging HTTP/S traffic
#19These guys never seem to get a mention when this subject surfaces. So I'll address that:. https://cloudmiddleman.com Been using them for a couple of years, excellent support and new features keep on coming to their already slick web UI.
Thanks for the link. I couldn't find any services offering this when we started building debugProxy. It's good to see there might be a viable business model here :)
Re: Show HN: A proxy service for debugging HTTP/S traffic
#20These guys never seem to get a mention when this subject surfaces. So I'll address that:. https://cloudmiddleman.com Been using them for a couple of years, excellent support and new features keep on coming to their already slick web UI.
Thanks for the link. I couldn't find any services offering this when we started building debugProxy. It's good to see there might be a viable business model here :)
There might be, but our experiences running our original product[0] are contrary to that. Happy to chat about it if you’d like.