31–40 of 41 posts
https://github.com/lightbody/browsermob-proxy
It's Java-based and forked out from some old MITM code from Selenium. It has a bunch of APIs for manipulating traffic, tweaking DNS resolution, rewriting content, etc. Just passing along in case anyone is looking for alternatives.
Mitmproxy works pretty well for HTTPS - but it doesn't seem to generate HTTPS certs as well as Fiddler does
Don't forget mitmdump. It is a great way to log sessions and chain to other proxies at the same time. Also, mitmdump is one of the best and fastest ways to get ahold of web requests with Python to modify it on the fly. http://docs.mitmproxy.org/en/stable/mitmdump.html I have been using mitmproxy over Burp for day to day web app hacking these days. But we still use Burp scanner for lots of chores. I almost always chai…
Would you mind sharing an example flow?
one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?
Does anyone have any experience with charles vs mitmproxy?
It's not just a console, it also has a web based interface: http://docs.mitmproxy.org/en/stable/mitmweb.html
https://github.com/mitmproxy/mitmproxy/issues/1293
I learned this the hard way. If you run a proxy on an unfirewalled machine with public IPv4, it's going to be abused really fast. :-(
This tool has really helped me on several occasions with a wide variety of issues up and down the stack. Even with debugging web apps because while the chrome Dev tools are awesome they (at least at the time as far as I know) didn't expose the initial headers/network exchange for certain types of auth like NTLM.
Mitmproxy is nice, but I think dev tools have become alot better, I discovered that because my standard work horse Chrome+Wireshark is very fincky with SSL: SSLKEYLOGFILE=$HOME/ssl_crt_dbg google-chrome --user-data-dir=TEMPUSER Then you configure wireshark SSL decoding with with pre master key file as "ssl_crt_dbg", it fails too often for me. Now days I use remote-debugging and Python a lot: $ google-chrome --remote-…
Don't forget mitmdump. It is a great way to log sessions and chain to other proxies at the same time. Also, mitmdump is one of the best and fastest ways to get ahold of web requests with Python to modify it on the fly. http://docs.mitmproxy.org/en/stable/mitmdump.html I have been using mitmproxy over Burp for day to day web app hacking these days. But we still use Burp scanner for lots of chores. I almost always chai…
I don't understand how this can be faster or more friendly than using Burp. Would you mind sharing an example flow?
Things that are a few clicks in Burp are a few terse keystrokes or key presses in mitmproxy. IDK, give it a shot and see if it makes sense . Most of our team just sticks with Burp FWIW.
Earlier quoted context omitted.
Even without certificate pinning, starting with Android 7, you must decompile the app to allow user provided certificates. Or use an xposed module if you have a rooted device. See this mitmproxy bug: https://github.com/mitmproxy/mitmproxy/issues/2054 And this tool is nice to automate decompiling, adding the line in the manifest to be able to use user-installed certificates, and recompiling: https://github.com/levyita…
Just wait until they go full 'treacherous computing' and turn on remote attestation using TPMs.