How is this better than Charles or Fiddler?
It's not "better". It's a hosted alternative.
Show HN: A proxy service for debugging HTTP/S traffic
31–40 of 44 posts
Re: Show HN: A proxy service for debugging HTTP/S traffic
#32> debugProxy is a HTTP/S hosted proxy server that lets you interact with the traffic passing through it, using a web based dashboard. So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffi…
We built a similar proxy at https://wrapapi.com/proxy to allow users to record and replay network requests when turning webpages into an API. I think it's possible to have an end-to-end secure and never-written-to-disk pipeline, provided you trust the provider is doing what they're saying.
The secure pipeline we ended up using involves:
1. Having a HTTPS endpoint for the proxy
2. Forwarding the captures to you immediately via listening WebSocket instances
Note that because the server upon receiving a request can immediately push it to WebSockets instead of relying on polling, no storage is needed
Re: Show HN: A proxy service for debugging HTTP/S traffic
#33Earlier quoted context omitted.
You may be a little optimistic here. Just because the technology exists does not mean everyone uses it. I use a MITM proxy to reverse engineer my IoT apps all the time (a lot of them don't provide public APIs but I want to use them from my controller app). I have not once ran into one that used pinning.
Most of the popular consumer apps use SSL pinning these days.
Is that a fact or assumption? Do you have a source?
That's not a jab at you I am legitimately interested in reading it if you have a source.
I have literally not found one I cared about doing a MitM exploit on that actually did it. Granted I haven't tried social networks because my interest lies mostly in apps that don't have public APIs and most social Networks have APIs.
I won't say who they are because this is not the right venue but I can say for certain that neither my bank or my alarm company uses pinning.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#34Earlier quoted context omitted.
Most of the popular consumer apps use SSL pinning these days.
Is that a fact or assumption? Do you have a source? That's not a jab at you I am legitimately interested in reading it if you have a source. I have literally not found one I cared about doing a MitM exploit on that actually did it. Granted I haven't tried social networks because my interest lies mostly in apps that don't have public APIs and most social Networks have APIs. I won't say who they are because this is not…
[deleted]
Re: Show HN: A proxy service for debugging HTTP/S traffic
#35Earlier quoted context omitted.
Most of the popular consumer apps use SSL pinning these days.
Is that a fact or assumption? Do you have a source? That's not a jab at you I am legitimately interested in reading it if you have a source. I have literally not found one I cared about doing a MitM exploit on that actually did it. Granted I haven't tried social networks because my interest lies mostly in apps that don't have public APIs and most social Networks have APIs. I won't say who they are because this is not…
From personal experience reverse-engineering apps: whatsapp, facebook, twitter, skype, uber, snapchat, instagram - all pinned. The trend is definitely there, more and more apps adopt certificate pinning.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#36> debugProxy is a HTTP/S hosted proxy server that lets you interact with the traffic passing through it, using a web based dashboard. So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffi…
We built a similar proxy at https://wrapapi.com/proxy to allow users to record and replay network requests when turning webpages into an API. I think it's possible to have an end-to-end secure and never-written-to-disk pipeline, provided you trust the provider is doing what they're saying. The secure pipeline we ended up using involves: 1. Having a HTTPS endpoint for the proxy 2. Forwarding the captures to you immedi…
WrapAPI looks neat. Thanks for posting the link, I couldn't find any similar services when we started building debugProxy, although I assumed some must exist.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#37Earlier quoted context omitted.
You may be a little optimistic here. Just because the technology exists does not mean everyone uses it. I use a MITM proxy to reverse engineer my IoT apps all the time (a lot of them don't provide public APIs but I want to use them from my controller app). I have not once ran into one that used pinning.
Most of the popular consumer apps use SSL pinning these days.
This is true for the app store top 10, but from what I've seen not much out of that.
In practical terms, the bigger problem is Android 8, which does not trust user-added CAs for app traffic (https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm...). It's a really odd move by Google against privacy researchers.
Re: Show HN: A proxy service for debugging HTTP/S traffic
#38Hi HN, This is side project I have been working on with a friend. It's a pretty niche service, so it isn't easy finding people to try it. I'm really interested to hear what you think, for better or worse :) I'm also happy to answer any questions.
Congrats on the launch and thanks for using mitmproxy! :-)
Re: Show HN: A proxy service for debugging HTTP/S traffic
#39Earlier quoted context omitted.
Most of the popular consumer apps use SSL pinning these days.
This is true for the app store top 10, but from what I've seen not much out of that. In practical terms, the bigger problem is Android 8, which does not trust user-added CAs for app traffic ( https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm... ). It's a really odd move by Google against privacy researchers.
Weird, so much for a "hacker-friendly" operating system.
I wonder if you can bypass this behavior by rooting the device?
Re: Show HN: A proxy service for debugging HTTP/S traffic
#40For those of you looking for a fully native experience or don’t want to deal with a command line, checkout Peek: https://peek.tools Just a few highlights: - Fully native iOS app - You can intercept traffic from any device and your data stays in Peek - Intercept traffic from other iOS apps on the same device, so you don’t need a Mac or a 2nd iOS device - Modify requests and responses as they come in Disclaimer: I am t…
How does it work? AFAIK you can't run a local webserver on iOS without a jailbreak. What's the benefit compared a traditional network setup with a MITM proxy?
You can run a web server on iOS, and you don’t need special entitlements to do so. Depending on how you implement it, you may have problems keeping it alive while the app is in the background, however.