31–40 of 63 posts
I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.
Is there any benchmark against squid proxy in regards of cpu and memory usage? Anyone has expiernce with it or can recommend something else?
I don't think they are doing all the necessary GC when disposing of flows from the UI.
These days I think it would be a simple matter of using tee and netcat, but it was fun at the time.
It is a shame getting a "real ip" is such a hassle nowadays.
This is cool. I’m learning a lot reading through the docs. Why is subversion so instructive? I’ve read about SSL certificates a gazillion times and it’s simple enough in theory but for some reason this is making everything click. What’s the use most common use case for something like this, by the way?
A similar frustration is the tendency for SDK / library vendors to document their product using code snippets in various languages, but without simply showing you what the raw HTTP requests look like. Typically the closest you can get is a set of curl commands.
When you show me a python/ruby/swift/js snippet, I have a guess as to what's happening. When you show me HTTP, I know exactly what's going on. And if you won't show me HTTP, time to fire up mitmproxy.
Earlier quoted context omitted.
You can use this to debug stuff happening over TLS connections, but there are also other practical ways to use it. For example, install the CA certificate on your phone (with root if you have Android) and set up a WiFi network that transparently proxies everything through mitmproxy. Let it collect data for a while and you'll be surprised how many random servers even well known apps try to contact. You'll also be able…
I haven't tried it for replacing TLS certificates, but you do not need a rooted phone to mess with 3rd party apps on android. You can unpack an APK and re-sign it using your own key, allowing you to make whatever modifications to the APK you want. In addition to making whatever changes you want to directly (such as just replacing the pinned certificates), you can update the manifest to set the android:debuggable flag…
It's also a huge hassle if you just want to see what metadata your phone is leaking.
If you're only going after a few specific apps then sure, you can just alter the APK. It's not hard to disassemble and patch the custom validation code most apps use either. The downside is just that it's a huge bother.
Neat! Anyone happen to know if there's progress on interactive interception of TCP TLS streams (non-http)?
I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.
AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles...
or are you referring to some other cert-related feature?
I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.
FWIW, Burp also does this. But I'm not sure I'd argue that it actually has a nicer UI ;)