mitmproxy
Interactive HTTPS proxy for intercepting, inspecting, modifying, and replaying HTTP traffic.
Technical Architecture & Overview
mitmproxy intercepts HTTP and HTTPS traffic with three interfaces: a terminal UI, a web UI, and the mitmdump CLI for scripted runs. Python add-ins rewrite traffic on the fly, and replay modes re-send captured or modified requests. Support covers HTTP/1, HTTP/2, HTTP/3, and WebSockets, and the free and open source license makes it the standard proxy in API testing and mobile assessment workflows.
Targeted Technical Use Cases
Scriptable traffic interception where Burp-class licensing is unnecessary or automation matters more than the GUI.
Evaluation & Trade-offs
Core Strengths
- +Python add-in API enables custom traffic manipulation.
- +Free with no feature restrictions.
- +Strong protocol coverage including HTTP/3.
Trade-Offs & Limitations
- -Terminal-first workflow has a learning curve.
- -No vulnerability scanner or site map features of commercial proxies.
Defensive Security Application
Verifying that applications enforce trust boundaries correctly by replaying crafted requests.
Frequently Asked Questions
What is mitmproxy?→
mitmproxy intercepts HTTP and HTTPS traffic with three interfaces: a terminal UI, a web UI, and the mitmdump CLI for scripted runs. Python add-ins rewrite traffic on the fly, and replay modes re-send captured or modified requests. Support covers HTTP/1, HTTP/2, HTTP/3, and WebSockets, and the free and open source license makes it the standard proxy in API testing and mobile assessment workflows.
What is mitmproxy used for?→
Scriptable traffic interception where Burp-class licensing is unnecessary or automation matters more than the GUI.
What are the strengths of mitmproxy?→
- +Python add-in API enables custom traffic manipulation.
- +Free with no feature restrictions.
- +Strong protocol coverage including HTTP/3.
What are the limitations of mitmproxy?→
- +Terminal-first workflow has a learning curve.
- +No vulnerability scanner or site map features of commercial proxies.
How is mitmproxy used defensively?→
Verifying that applications enforce trust boundaries correctly by replaying crafted requests.