Earlier quoted context omitted.
Not sure I understand "MITM" and "in production".
Every single major corporation does "MITM in production".
[deleted]
Mitmproxy 8
51–60 of 63 posts
Re: Mitmproxy 8
#52Mitmproxy is so much fun. I used it recently to inspect the traffic between a `node --inspect` process and the Chrome devtools. I then used my understanding to "fix" a few things that annoyed me about the node debugging workflow - like how each time the debug server starts, it has a unique URL that you need to manually attach to in the debugger. It's very hacky but it works for my needs.
Re: Mitmproxy 8
#53I've used several other apps like Mitmproxy, and some of them have nicer UIs... but Mitmproxy is the only one I've found that supports MITM'ng connections using client certificates.
er. don't they all? at least all the sophisticated ones. otherwise you can't see the contents of https/etc requests. Charles does this as well for example, and it's reasonably popular: https://www.charlesproxy.com/ AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles... or are you referring to some oth…
Another nice one with GUI is proxyman.
Re: Mitmproxy 8
#54Earlier quoted context omitted.
er. don't they all? at least all the sophisticated ones. otherwise you can't see the contents of https/etc requests. Charles does this as well for example, and it's reasonably popular: https://www.charlesproxy.com/ AFAICT it's roughly as widely used as mitmproxy, and e.g. google trends favors Charles by a moderate amount: https://trends.google.com/trends/explore?geo=US&q=%22charles... or are you referring to some oth…
I think you're confusing server certificates and client certificates - I'm specifically referring to client certificates here, aka TLS mutual authentication. Also, isn't Charles OSX only?
> isn't Charles OSX only?
Nope! Charles runs on Windows, Mac, and Linux.
Re: Mitmproxy 8
#55Earlier quoted context omitted.
Many different applications: Red/blue teaming, metric collection, policy-based decision making.
Seems like a bit of a foot-gun to do these things by effectively undermining your own security.
Red teaming at least is all about undermining ~your security. ;)
Re: Mitmproxy 8
#56Nice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies. Can't wait for someone to do it in Go.
FWIW: I'm building something in Go (https://github.com/dstotijn/hetty). But it's pretty early stage and not even near the featureset that mitmproxy or Burp Suite has. Also I wouldn't dare say it's more efficient (yet!). But Go has been great so far to build it.
As mentioned elsewhere: (dev friendly) extensibility/add-ons with Go will be an interesting challenge. Haven't looked into it yet.
Re: Mitmproxy 8
#57I've been looking to use mitmproxy to capture traffic in a project, but the serialization format is something called TNetStrings [1], which postfixes types and is thus not streamable. There seem to be some efforts to switch flow captures to use SQLite [2] or Protobuf [3], although PCAP would also be nice, I think. [1] https://tnetstrings.info/ [2] https://github.com/mitmproxy/mitmproxy/issues/3075 [3] https://github.…
Could you explain what your use case is? What format would you prefer?
[deleted]
Re: Mitmproxy 8
#58I've been looking to use mitmproxy to capture traffic in a project, but the serialization format is something called TNetStrings [1], which postfixes types and is thus not streamable. There seem to be some efforts to switch flow captures to use SQLite [2] or Protobuf [3], although PCAP would also be nice, I think. [1] https://tnetstrings.info/ [2] https://github.com/mitmproxy/mitmproxy/issues/3075 [3] https://github.…
Could you explain what your use case is? What format would you prefer?
Sorry for not stating that in the first place! My use case is archival and preservation. It should be possible to stream the format, build indexes into it (ideally at runtime alongside the capture), it should be as complete as possible, and it should last a long time. I'm looking into pcapng together with a sslkeylog file as the formats of choice for this currently.
Re: Mitmproxy 8
#59I've seen this software, misconfigured, become an open socks proxy sitting on the public internet being used by shady 'vpn' providers to proxy connections. (it bubbled up to me because dns operators were seeing a lot of very weird dns queries originating from our account where we ran a large shared kubernetes cluster. I was tasked with finding the pod/s that were causing the problem)
Re: Mitmproxy 8
#60mitmproxy dev here! Happy to answer any questions. Answers may take a while as I'm on a remote mountain hut, but please shoot. :)
Also thanks. The alternatives are expensive or just ass by comparison. Plus the name is cool.