Also, mitmdump is one of the best and fastest ways to get ahold of web requests with Python to modify it on the fly.
http://docs.mitmproxy.org/en/stable/mitmdump.html
I have been using mitmproxy over Burp for day to day web app hacking these days. But we still use Burp scanner for lots of chores. I almost always chain through both to then go back in and use Burp features missing in mitmproxy (exploring site contents, etc.). But those are edge cases mostly needed for professional use and not for tinkering.
Would you mind sharing an example flow?
Things that are a few clicks in Burp are a few terse keystrokes or key presses in mitmproxy. IDK, give it a shot and see if it makes sense . Most of our team just sticks with Burp FWIW.
See this mitmproxy bug: https://github.com/mitmproxy/mitmproxy/issues/2054
And this tool is nice to automate decompiling, adding the line in the manifest to be able to use user-installed certificates, and recompiling: https://github.com/levyitay/AddSecurityExceptionAndroid
Also, if the app uses Google signin, you have to be rooted, because play services uses the package manager to check the app signer before giving the app a token.
I was recently wishing for a "Jailbroken Mobile Testing Tool", similar to Sauce Labs or BrowserStack but with jailbroken mobiles -- i.e. a cloud-based service allowing you to remotely control a mobile phone through a web interface. Would that be interesting to have?
This service would allow you to load an app from the App Store / Google Play, and then interact with it while logging all network connections (in tcpdump/wireshark/HAR/etc. format). The controlled mobiles would be jailbroken and have tools like SSL kill switch (as mentioned by @bitexploder in another comment) installed by default.
(Going further: the same tool would allow you to download the phone's storage as a zip archive for further analysis)
For iOS, I know there are jailbreak cydia tweaks that try to disable certificate pinning, but I have no experience with this.
We deal with this routinely. Solutions tend to vary.
On iOS just use SSL kill switch (if you are jailbroken). If you are not jailbroken you don't have a lot of options. On Android there are some well documented approaches. Usually decompiling the app and adding to the local app's cert store will work and then rearchive and sign it.
Function hooking key network calls can work as well. It is pretty much required that if you want to do serious tinkering or assessment you need a jailbroken or rooted device. This can be a significant effort investment, but once done is generally reliable.
http://docs.mitmproxy.org/en/stable/certinstall.html#certifi...
All I wanted to do was change a request header for one host.
After ~15 minutes I now have a transparent MITM https proxy - and I didn't even have to google the openssl command.
Edit: Also, the documentation is excellent as the software.
SSLKEYLOGFILE=$HOME/ssl_crt_dbg google-chrome --user-data-dir=TEMPUSER
Now days I use remote-debugging and Python a lot:
$ google-chrome --remote-debugging-port=9222
import PyChromeDevTools
chrome = PyChromeDevTools.ChromeInterface(host="localhost", port=9222)
chrome.Network.enable()
while True:
print chrome.wait_message(timeout=0.1)
We've shifted to using https://github.com/joeferner/node-http-mitm-proxy as a part of WrapAPI Proxy (https://wrapapi.com/proxy), which is a zero-install proxy in the style of mitmproxy and Charles.
The node proxy is really great in that it's fully extensible, allows you to generate certificates, and filter/save the kinds of traffic you get to simple JSON structures. We've found it to be a huge boon in development, but it's clearly inspired by mitmproxy (which predates node), so credit where it's due.
https://github.com/lightbody/browsermob-proxy
It's Java-based and forked out from some old MITM code from Selenium. It has a bunch of APIs for manipulating traffic, tweaking DNS resolution, rewriting content, etc. Just passing along in case anyone is looking for alternatives.
https://github.com/mitmproxy/mitmproxy/issues/1293
I learned this the hard way. If you run a proxy on an unfirewalled machine with public IPv4, it's going to be abused really fast. :-(
https://hn.algolia.com/?query=mitmproxy&sort=byPopularity&pr...
Does anyone have any experience with charles vs mitmproxy?