#mitmproxy — Public Fediverse posts

Oh, bravo! You bravely ventured into the digital wilderness, armed only with a MitM proxy and the audacity to believe GitHub Copilot wouldn’t notice. 🤡 Turns out, the only thing you learned was how to enable #JavaScript and #cookies. Truly groundbreaking! 🍪💡
https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm #digitalwilderness #MitMproxy #GitHubCopilot #HackerNews #ngated

Oh, bravo! You bravely ventured into the digital wilderness, armed only with a MitM proxy and the audacity to believe GitHub Copilot wouldn’t notice. 🤡 Turns out, the only thing you learned was how to enable #JavaScript and #cookies. Truly groundbreaking! 🍪💡
https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm #digitalwilderness #MitMproxy #GitHubCopilot #HackerNews #ngated

What I learned by putting GitHub Copilot behind a MitM proxy

https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm

Comments: https://news.ycombinator.com/item?id=49256057

#HackerNews #GitHubCopilot #MitMProxy #TechInsights #DeveloperTools #ProgrammingTips

What I learned by putting GitHub Copilot behind a MitM proxy

https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm

Comments: https://news.ycombinator.com/item?id=49256057

#HackerNews #GitHubCopilot #MitMProxy #TechInsights #DeveloperTools #ProgrammingTips

One Open-source Project Daily

Ngrok FRP Alternative • Fast • Lightweight • 0 Dependency • Pluggable • TLS interception • DNS-over-HTTPS • Poor Man's VPN • Reverse & Forward • "Proxy Server" framework • "Web Server" framework • "PubSub" framework • "Work" acceptor & executor framework

https://github.com/abhinavsingh/proxy.py

#1ospd #opensource #dnsoverhttps #gfw #httpproxy #httpserver #httpsproxy #maninthemiddle #mitm #mitmproxy #ngrok #ngrokalternative #ngrokreplacement #proxy #proxyserver #python3 #reverseproxy #tlsinterception #tunnel #vpn #webserver #webserver

One Open-source Project Daily

Ngrok FRP Alternative • Fast • Lightweight • 0 Dependency • Pluggable • TLS interception • DNS-over-HTTPS • Poor Man's VPN • Reverse & Forward • "Proxy Server" framework • "Web Server" framework • "PubSub" framework • "Work" acceptor & executor framework

https://github.com/abhinavsingh/proxy.py

#1ospd #opensource #dnsoverhttps #gfw #httpproxy #httpserver #httpsproxy #maninthemiddle #mitm #mitmproxy #ngrok #ngrokalternative #ngrokreplacement #proxy #proxyserver #python3 #reverseproxy #tlsinterception #tunnel #vpn #webserver #webserver

Here's are some examples of neat things you can do to the traffic with simple python scripts: https://docs.mitmproxy.org/stable/addons/examples/

#mitmproxy

Here's are some examples of neat things you can do to the traffic with simple python scripts: https://docs.mitmproxy.org/stable/addons/examples/

#mitmproxy

#mitmproxy has gotten super cool. It has become my swiss army knife for security assessments as of late.

Sometimes you can't set HTTP or SOCKS proxy, nor can you easily get MiTM to forward packets. But if you can DNS spoof (or set the endpoint address directly) you can redirect the traffic to to mitmproxy.

The reverse proxy mode supports wide range of protocols (among all kinds of http(s)). See https://docs.mitmproxy.org/stable/concepts/modes/#reverse-proxy

There are multitudes of applications for this: Debugging, recording and replaying traffic, applying realtime transformations (such as fuzzing) on the fly etc. Love it!

#mitmproxy has gotten super cool. It has become my swiss army knife for security assessments as of late.

Sometimes you can't set HTTP or SOCKS proxy, nor can you easily get MiTM to forward packets. But if you can DNS spoof (or set the endpoint address directly) you can redirect the traffic to to mitmproxy.

The reverse proxy mode supports wide range of protocols (among all kinds of http(s)). See https://docs.mitmproxy.org/stable/concepts/modes/#reverse-proxy

There are multitudes of applications for this: Debugging, recording and replaying traffic, applying realtime transformations (such as fuzzing) on the fly etc. Love it!

I was just told that @max made mitmproxy really nice with QUIC support and all sorts of bells and whistles.

Check it out!
#mitmproxy

I was just told that @max made mitmproxy really nice with QUIC support and all sorts of bells and whistles.

Check it out!
#mitmproxy

Aldo Cortesi released #mitmproxy version 12.2.3. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.2.3. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.2.2. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.2.2. https://mitmproxy.org/

I’ve started doing something simple when local LLM behavior feels “off”: I inspect the wire.

In this piece, I show how I route Quarkus → Ollama traffic through mitmproxy to see the real `/v1/chat/completions` payload, compare plain vs tool-enabled requests, and stop guessing.

https://www.the-main-thread.com/p/debug-ollama-traffic-quarkus-mitmproxy

#Java #Quarkus #Ollama #mitmproxy #LLM

I’ve started doing something simple when local LLM behavior feels “off”: I inspect the wire.

In this piece, I show how I route Quarkus → Ollama traffic through mitmproxy to see the real `/v1/chat/completions` payload, compare plain vs tool-enabled requests, and stop guessing.

https://www.the-main-thread.com/p/debug-ollama-traffic-quarkus-mitmproxy

#Java #Quarkus #Ollama #mitmproxy #LLM

MitM-прокси для LLM

Многие разработчики в последнее время используют облачные LLM для генерации программного кода, в том числе с помощью агентов. Но это вызывает как минимум две проблемы: Утечка информации: мы не знаем, какие данные LLM передаёт в облако Бесконтрольный расход токенов, особенно в случае автоматических агентов, которые запускаются в автономную работу на длительный период Для этого есть специальные инструменты мониторинга. Например, Tokentap (бывший Sherlock) отслеживает использование токенов для LLM CLI в реальном времени на панели в консоли. Такой MitM-прокси полезен для информационной безопасности и просто для учёта расходов.

https://habr.com/ru/companies/globalsign/articles/1016612/

#MitM #Hugging_Face #llamaccp #ggml #Local_AI #Gemini_CLI #Claude_Code #OpenAI_Codex #mitmproxy #HTTPSпрокси

I am working with some #embedded #esp32 #websocket for #ClassQuiz. It took me hours why the websocket connection would seemingly random collapse. Now I figured it out after debugging for hours:

I configured a timeout for the network socket on the esp32. At least I found it after setting up Wireshark and later #mitmproxy with custom CA certificates... What gave me the final hint were the exact 2 seconds between the websocket opening and closing.

#embedded #rust

I am working with some #embedded #esp32 #websocket for #ClassQuiz. It took me hours why the websocket connection would seemingly random collapse. Now I figured it out after debugging for hours:

I configured a timeout for the network socket on the esp32. At least I found it after setting up Wireshark and later #mitmproxy with custom CA certificates... What gave me the final hint were the exact 2 seconds between the websocket opening and closing.

#embedded #rust

Проксирование в UI автотестах с mitmproxy

Прокси — один из основных инструментов в арсенале QA-инженера. Charles Proxy, Fiddler и Proxyman давно стали стандартом для анализа и изменения сетевого трафика в процессе ручного тестирования. Их принцип работы хорошо известен и подробно описан во множестве материалов. Однако возникает вопрос: как использовать подобные возможности в UI-автотестах? Как перехватывать или мокать трафик в автоматизированных сценариях? Давайте разберёмся ->

https://habr.com/ru/articles/1013218/

#проксирование #qa_automation #qa_testing #python #mitmproxy

Ce mec a entraîné une IA avec 4000 rapports de bug bounty pour chasser les failles automatiquement

https://fed.brid.gy/r/https://korben.info/instavm-security-agent-ia-bug-bounty-mitmproxy.html

Aldo Cortesi released #mitmproxy version 12.2.1. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.2.1. https://mitmproxy.org/

„Turning a Cheap Router into a Networking Test Lab with OpenWrt“ – Jan Kala

Proměňte levný router v reprodukovatelný testbed s #OpenWrt — od snadného nastavení přes webové rozhraní po vlastní firewall a traffic shaping. Přednáška představí captive portal (#OpenNDS) a integraci #mitmproxy pro testování autentizace a hlubokou inspekci provozu.

Pokud vás tato přednáška zaujala, bude 2.11. v 13:00 v A113 na #OpenAlt: http://openalt.cz/program/

„Turning a Cheap Router into a Networking Test Lab with OpenWrt“ – Jan Kala

Proměňte levný router v reprodukovatelný testbed s #OpenWrt — od snadného nastavení přes webové rozhraní po vlastní firewall a traffic shaping. Přednáška představí captive portal (#OpenNDS) a integraci #mitmproxy pro testování autentizace a hlubokou inspekci provozu.

Pokud vás tato přednáška zaujala, bude 2.11. v 13:00 v A113 na #OpenAlt: http://openalt.cz/program/

Aldo Cortesi released #mitmproxy version 12.2.0. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.2.0. https://mitmproxy.org/

[Перевод] Я хотел пошпионить за своим псом, а в результате проследил за TP-Link

Недавно я купил дешёвую камеру Tapo, чтобы понимать, чем занимается мой пёс, пока меня нет дома. И что в результате? Я выполнил реверс-инжиниринг потоков онбординга, декомпилировал APK, занимался MITM TLS-сессий и писал криптографические скрипты. Основной моей мотивацией к созданию этого проекта стало то, что с первого дня установки камера начала меня раздражать. Настраивать её во frigate было довольно утомительно: похоже, никто точно не знает, как эти камеры работают онлайн.

https://habr.com/ru/articles/947264/

#вебкамеры #tapo #tplink #mitmproxy

Aldo Cortesi released #mitmproxy version 12.1.2. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.1.2. https://mitmproxy.org/

Would folks be interested in a writeup with working scripts for 100% locally #selfhosted #LanguageTool Desktop (#macOS, #Linux should work too) with full grammar checking and sentence rewriting capabilities, taking advantage of the open source LT server, #ollama, and #mitmproxy or #Proxyman ?

The upshot is #private #secure #grammarcheck with #LLM rewrites, like a secure self-hosted alternative to #Grammarly without sharing out every word you type. Awfully #hacky, but it works... #infosec

Would folks be interested in a writeup with working scripts for 100% locally #selfhosted #LanguageTool Desktop (#macOS, #Linux should work too) with full grammar checking and sentence rewriting capabilities, taking advantage of the open source LT server, #ollama, and #mitmproxy or #Proxyman ?

The upshot is #private #secure #grammarcheck with #LLM rewrites, like a secure self-hosted alternative to #Grammarly without sharing out every word you type. Awfully #hacky, but it works... #infosec

Hm was ist denn mit #mitmproxy in #Debian passiert?
Ist in sid und in bookworm aber nicht in trixie?!

#openBSD
#VulnHUB
#MatrixBreakOut
#mitmproxy
#metasploit
#infosec

A todo esto...decidí rehacer todos los laboratorios de #burpsuite, pero con #mitmproxy, hasta ahora todo funciona...es una herramienta mucho más liviana y con todo lo que se necesita para un pentesting web...recomendable...

:awesome:

#mitmproxy
#burpsuite
#pentesting

🤣 Oh, look! Another techie spends "a couple of hours" cracking open Claude Code like it's their personal piñata! Spoiler alert: they found it's slower and pricier than a toddler on a sugar high. 🚀 But hey, at least they got to flex their terminal skills with some #mitmproxy magic! 🧙‍♂️✨
https://kirshatrov.com/posts/claude-code-internals #techiefun #piñata #hacking #terminalskills #ClaudeCode #HackerNews #ngated

🤣 Oh, look! Another techie spends "a couple of hours" cracking open Claude Code like it's their personal piñata! Spoiler alert: they found it's slower and pricier than a toddler on a sugar high. 🚀 But hey, at least they got to flex their terminal skills with some #mitmproxy magic! 🧙‍♂️✨
https://kirshatrov.com/posts/claude-code-internals #techiefun #piñata #hacking #terminalskills #ClaudeCode #HackerNews #ngated

Aldo Cortesi released #mitmproxy version 12.1.1. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.1.1. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.1.0. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.1.0. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.0.1. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.0.1. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 12.0.0. https://mitmproxy.org/

So finished debugging #mitmproxy-linux segfault. It turned out it was a segfault in #Gentoo #Sandbox. After dire debugging, it turns out that, for some reason, aya_ebpf crate overrides the system memcpy() function with a #RustLang implementation that has incorrect return value.

Rust is truly impressive.

https://github.com/aya-rs/aya/issues/1254

#mitmproxy update AKA not how I imagined spending my Saturday.

Previous post: https://social.treehouse.systems/@mgorny/114364774872404427

So:

1. With help of vadorovsky, I've learned that I need to pass --no-default-features, and then it uses system LLVM which resolves problems 2. and 4.
2. #LLVM 20 still fails on that assertion, but Tuesday's LLVM 21 snapshot works fine.
3. I also needed to package btfdump for bpf-linker's tests but I was finally able to get them to pass.
4. After spending hours trying to figure out mitmproxy-linux build failures, I've finally found a way to build it: I need to remove upstream's logic for building bpf binaries, build them manually with correct RUSTFLAGS, and then build the whole thing. https://github.com/mitmproxy/mitmproxy/issues/7663
5. rustc-build-sysroot crate problem is even worse in mitmproxy-linux.
6. mitmproxy-linux's tests segfault (yeah, #RustLang).
7. But still, with the packages built, I can get tests to pass on mitmproxy itself.

So yeah, if I can only figure out what to do about these segfaulting tests, I think we can get new mitmproxy version into #Gentoo. Pinned to one Rust version, but that's better than nothing, I guess.

Spent another hour on trying to get bpf-linker / new #mitmproxy into #Gentoo. To summarize:

1. It needs features from nightly #RustLang compiler at runtime. This can be worked around via setting RUSTC_BOOTSTRAP=1. https://github.com/aya-rs/bpf-linker/issues/250
2. It needs different pinned versions of some libraries via aya-rustc-llvm-proxy somehow. This can be solved via manually adding more crates to the ebuild (sigh) or just removing the extra `Cargo.lock` from the crate.
3. It needs `compiler_builtins` crate via rustc-build-sysroot crate. Funny enough, the version is pinned by Rust standard library itself, so I need to add a specific crate for every supported Rust compiler version!
4. It uses a homemade logic to find #LLVM library, which iterates over PATH and replaces `bin` with `lib`. Yes, with 32-bit libdir. It can be worked around via setting LD_LIBRARY_PATH. https://github.com/aya-rs/bpf-linker/issues/270
5. Even after working around all these issues, it crashes by triggering an assertion in LLVM. I guess nobody bothered testing with assertions enabled, as usual. https://github.com/aya-rs/bpf-linker/issues/271

So yeah, that's your Rust quality. On top of that, let's not forget that this is all runtime issues — like we would be installed a bpf-linker executable that's nonfunctional unless you apply workarounds.

The developers of the mitmproxy tool describe it as the Swiss army knife for debugging, testing, data protection analysis, and penetration testing HTTP(S) connections. Holger Reibold shows you how mitmproxy can be a useful addition to your security toolbox.
https://www.admin-magazine.com/Archive/2025/85/Traffic-analysis-with-mitmproxy?utm_source=mlm
#OpenSource #mitmproxy #debugging #testing #security #proxy #MITM

Aldo Cortesi released #mitmproxy version 11.1.3. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 11.1.2. https://mitmproxy.org/

Aldo Cortesi released #mitmproxy version 11.1.1. https://mitmproxy.org/

The company doing this is https://www.n-able.com/ - here's are the details: https://sintonen.fi/advisories/n-able-ecosystem-agent-improper-certificate-validation.txt

...except for the PoC exploit which is insanely simple to pull off. Anyone with #mitmproxy and half a brain can do it.