Skip to main content

Technical Architecture & Overview

mitmproxy intercepts HTTP and HTTPS traffic with three interfaces: a terminal UI, a web UI, and the mitmdump CLI for scripted runs. Python add-ins rewrite traffic on the fly, and replay modes re-send captured or modified requests. Support covers HTTP/1, HTTP/2, HTTP/3, and WebSockets, and the free and open source license makes it the standard proxy in API testing and mobile assessment workflows.

Targeted Technical Use Cases

Scriptable traffic interception where Burp-class licensing is unnecessary or automation matters more than the GUI.

Evaluation & Trade-offs

Core Strengths

  • +Python add-in API enables custom traffic manipulation.
  • +Free with no feature restrictions.
  • +Strong protocol coverage including HTTP/3.

Trade-Offs & Limitations

  • -Terminal-first workflow has a learning curve.
  • -No vulnerability scanner or site map features of commercial proxies.

Defensive Security Application

Verifying that applications enforce trust boundaries correctly by replaying crafted requests.

Frequently Asked Questions

What is mitmproxy?

mitmproxy intercepts HTTP and HTTPS traffic with three interfaces: a terminal UI, a web UI, and the mitmdump CLI for scripted runs. Python add-ins rewrite traffic on the fly, and replay modes re-send captured or modified requests. Support covers HTTP/1, HTTP/2, HTTP/3, and WebSockets, and the free and open source license makes it the standard proxy in API testing and mobile assessment workflows.

What is mitmproxy used for?

Scriptable traffic interception where Burp-class licensing is unnecessary or automation matters more than the GUI.

What are the strengths of mitmproxy?
  • +Python add-in API enables custom traffic manipulation.
  • +Free with no feature restrictions.
  • +Strong protocol coverage including HTTP/3.
What are the limitations of mitmproxy?
  • +Terminal-first workflow has a learning curve.
  • +No vulnerability scanner or site map features of commercial proxies.
How is mitmproxy used defensively?

Verifying that applications enforce trust boundaries correctly by replaying crafted requests.