11–20 of 63 posts
Nice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies. Can't wait for someone to do it in Go.
This is cool. I’m learning a lot reading through the docs. Why is subversion so instructive? I’ve read about SSL certificates a gazillion times and it’s simple enough in theory but for some reason this is making everything click. What’s the use most common use case for something like this, by the way?
For example, install the CA certificate on your phone (with root if you have Android) and set up a WiFi network that transparently proxies everything through mitmproxy. Let it collect data for a while and you'll be surprised how many random servers even well known apps try to contact. You'll also be able to see what data they're trying to send! With modern TLS pinning that's a little hard, but there are Frida scripts out there for rooted/jailbroken devices that will let you bypass that. Just make sure to remove the cert afterwards and to reboot the device to make sure none of your mods remain in memory where they might affect your device's security.
You don't always need TLS, either. It's also useful as a general proxy for protocols like HTTP, for example to intercept, alter, and repeat requests. This can be very useful if you're running into a bug accessing a backend endpoint from code that doesn't easily allow you to iterate through the request code, like some mobile dev frameworks.
Earlier quoted context omitted.
I thought mitmproxy was designed to make it easier to debug stuff in a local environment. Why would you want to deploy it to production? How would you use it?
Many different applications: Red/blue teaming, metric collection, policy-based decision making.
This is cool. I’m learning a lot reading through the docs. Why is subversion so instructive? I’ve read about SSL certificates a gazillion times and it’s simple enough in theory but for some reason this is making everything click. What’s the use most common use case for something like this, by the way?
Nice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies. Can't wait for someone to do it in Go.
One of the things I like about mitmproxy is how easy it is to develop and use addons. You just pass a script file to it. How would you achieve such painless extensibility if it were written in Go?
It's very hard to do with Go; also see Hugo, where Go is in many ways "holding it back" compared to something like Jekyll, which you can customize and hack with great ease.
I love Go, but this kind of things is not where it shines.
Earlier quoted context omitted.
Not sure I understand "MITM" and "in production".
Every single major corporation does "MITM in production".
What you're talking about here was never a goal. And being in Python means it's much easier to extend, which is also greatly useful.
Nice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies. Can't wait for someone to do it in Go.
Anyone has expiernce with it or can recommend something else?
This is cool. I’m learning a lot reading through the docs. Why is subversion so instructive? I’ve read about SSL certificates a gazillion times and it’s simple enough in theory but for some reason this is making everything click. What’s the use most common use case for something like this, by the way?
You can use this to debug stuff happening over TLS connections, but there are also other practical ways to use it. For example, install the CA certificate on your phone (with root if you have Android) and set up a WiFi network that transparently proxies everything through mitmproxy. Let it collect data for a while and you'll be surprised how many random servers even well known apps try to contact. You'll also be able…
I'm not well versed in Android changes, this is just the conclusion I came to when Nougat came out and haven't tried it again since. If there's an easier way to use MITM with Android without modifying the APK / rooting your device, I'd love to know!