mitmproxy

Sniffing & Spoofing

Intermediatelow risk

mitmproxy is an interactive, SSL/TLS-capable intercepting HTTP proxy. It allows users to inspect, modify, and replay web traffic flowing through an application layer proxy.

Installation

sudo apt install mitmproxy

Basic Syntax

mitmproxy

Quick Facts

Full Name

mitmproxy

License

MIT

Language

Python

Interface

Console / Web / CLI

Category

Traffic Interception

Requires

CA Certificate for HTTPS

Tool Overview

mitmproxy is an interactive SSL/TLS-capable man-in-the-middle HTTP proxy. It allows security researchers to intercept, inspect, modify, and replay web traffic for testing and debugging purposes.

With support for inline Python scripting, transparent proxying, and multiple interface modes, mitmproxy is an essential tool for web application security testing, API analysis, and traffic manipulation.

Common Commands

mitmproxyLaunch interactive proxy - Initialize console interface on the default port 8080

mitmproxy -p 8888Custom port - Bind the proxy server listener to port 8888 instead of the default

mitmdump -w traffic.flowDump to file - Record streamed connection properties to a flow file quietly without the console UI

mitmdump -r traffic.flowRead flow - Open and replay traffic data saved inside a structured flow file

mitmwebWeb interface - Launch a browser-based graphical console dashboard to review intercepted traffic

mitmdump -s script.pyInline scripting - Pass Python scripts to automatically intercept, process, and alter running traffic states

mitmproxy --mode transparentTransparent mode - Configure traffic interception without requiring explicit client proxy configurations

mitmproxy --ignore-hosts "^example\.com:443
quot;

Ignore traffic - Bypass specific destination domains entirely to exclude them from interception workflows

mitmproxy -p 8080Custom port

mitmweb --web-port 8081Web UI port - Launch the browser dashboard on a custom port

mitmproxy --mode reverse:https://example.comReverse proxy - Front a specific upstream server for API testing

mitmdump -s addon.py -w out.flowScript + save - Run a Python addon while recording all flows

mitmproxy --set block_global=false --mode transparentTransparent tuning - Allow non-local clients in transparent mode

mitmdump "~u /api/" -w api.flowFilter capture - Record only flows whose URL matches a filter

Step-by-Step Guide

1Initiate the program via the command line or utilize the web-based UI
2Adjust the target device to send its web requests to your listening address
3Navigate to the installation portal on the target to download the security certificate
4Install and trust the certificate to enable decryption of secure sites
5Examine the captured requests, alter variables on the fly, and study the responses

Warnings

Capturing web traffic without explicit consent is illegal
Decrypting modern web traffic requires successful certificate installation on the client
Limit usage to formally approved testing scenarios

Use Cases

HTTPS Decryption

Intercept and decrypt SSL/TLS traffic.

Traffic Modification

Modify requests and responses in real-time.

Request Replay

Replay captured requests for testing.

API Testing

Analyze and debug REST/GraphQL API calls.

Key Features

SSL/TLS Decryption: Decrypt HTTPS traffic with custom CA.
Flow Interception: Pause and modify individual requests.
Request Replay: Replay captured flows for testing.
Python Scripting: Extensible with inline Python scripts.
HAR Export: Export captured flows as HAR files.

Related Tools

Wireshark

Sniffing & Spoofing

Packet analysis tool.

Burp Suite

Web Testing

Professional web proxy.

Frequently Asked Questions

What is mitmproxy used for?

mitmproxy is an interactive HTTPS proxy used for intercepting, inspecting, modifying, and replaying HTTP/HTTPS traffic. It is widely used for web security testing, API debugging, and penetration testing.

How does mitmproxy decrypt HTTPS traffic?

mitmproxy acts as a man-in-the-middle by generating per-host SSL certificates signed by a mitmproxy CA. Once the CA certificate is installed and trusted by the client, mitmproxy can decrypt and inspect HTTPS traffic.

What is the difference between mitmproxy, mitmdump, and mitmweb?

mitmproxy is the interactive console UI, mitmdump is the command-line equivalent for scripting and automation, and mitmweb provides a browser-based web interface for traffic inspection.

Can mitmproxy automate request modification?

Yes, mitmproxy supports Python scripting for automating traffic interception and modification. You can write inline scripts to modify requests/responses, inject content, or perform custom analysis.

Output Explanation

Displays an organized list of web transactions, allowing you to drill down into the headers, parameters, and payloads. It offers real-time editing capabilities.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.