mitmproxy

Start mitmproxy on the default port (8080)

$ mitmproxy

$ mitmproxy -p [8888]

$ mitmproxy -m reverse:https://[example.com]

$ mitmproxy -m transparent

$ mitmproxy -s [path/to/script.py]

$ mitmproxy -r [flows.mitm]

$ mitmproxy --ignore-hosts '^example\.com$'

$ mitmweb

mitmproxy [options]
mitmdump [options]
mitmweb [options]

mitmproxy is an interactive man-in-the-middle proxy for HTTP and HTTPS traffic. It allows inspection, modification, and replay of web traffic through a console interface. The suite includes three tools: mitmproxy (console UI), mitmweb (web UI), and mitmdump (command-line only).
The proxy works by intercepting connections and presenting its own certificate to clients. Install the mitmproxy CA certificate on clients to avoid SSL warnings. Traffic flows can be filtered, modified with Python scripts, or saved for later analysis.
Proxy modes include regular (explicit proxy), transparent (network-level interception), reverse (forwarding to upstream), and SOCKS5. Python addons can modify requests and responses, implement custom logic, or integrate with other tools.

-p PORT, --listen-port PORT

Proxy service port (default: 8080)

Proxy mode: regular, transparent, socks5, reverse:SPEC, upstream:SPEC

Enable transparent proxy mode

Enable SOCKS5 proxy mode

Reverse proxy to upstream server (http[s]://host[:port])

Path to Python script for flow manipulation

Read flows from file

Write flows to file

Regex matching hosts to ignore (not intercepted)

Regex matching hosts to intercept

Strip cache headers to prevent 304 responses

Do not verify upstream SSL/TLS certificates

Add SSL certificate (path or directory)

Location of CA files (default: ~/.mitmproxy)

Disable HTTP/2 support

Quiet mode

Don't start a proxy server

Dump all options as YAML

Show help message

Intercepting HTTPS requires clients to trust the mitmproxy CA certificate, which can be found in ~/.mitmproxy. Transparent mode requires additional system configuration (iptables on Linux). Some applications implement certificate pinning and will refuse connections through mitmproxy. Intercepting traffic without authorization may violate laws.

mitmproxy was created by Aldo Cortesi and first released in 2010. Written in Python, it became a standard tool for web application security testing and debugging. The project introduced innovative features like the web interface (mitmweb) and a powerful scripting API. It gained widespread adoption among security researchers, developers, and QA engineers for analyzing HTTP traffic.

burpsuite(1), wireshark(1), tcpdump(1), charles(1)