Capture, Analyze and Debug HTTPS traffic with MITMProxy

Mitmproxy is an enormously flexible tool. Knowing exactly how the proxying process works will help you deploy it creatively, and take into account its fundamental assumptions and how to work around them. This document explains mitmproxy’s proxy mechanism in detail, starting with the simplest unencrypted explicit proxying, and working up to the most complicated interaction -transparent proxying of TLS-protected traffic1 in the presence of Server Name Indication.
Resources
docs.mitmproxy.org/stable/con...
-Install mitm
brew install mitmproxy
-intstall certificate
mitm.it/#
run
mitmproxy
mitmweb
0:00 Intro
0:40 How mitm work?
4:30 Installing and Running MITMProxy
6:30 Installing Certificate
9:00 MITM Web Interface
🎙️Listen to the Backend Engineering Podcast
husseinnasser.com/podcast
🏭 Backend Engineering Videos
backend.husseinnasser.com
💾 Database Engineering Videos
• Database Engineering
🏰 Load Balancing and Proxies Videos
• Proxies
🏛️ Software Archtiecture Videos
• Software Architecture
📩 Messaging Systems
• Message Queues & PubSu...
Become a Member
/ @hnasr
Support me on PayPal
bit.ly/33ENps4
Join our Thriving Backend Community on Discord
/ discord
Stay Awesome,
Hussein

[@hnasr]

Hey guys, apologies for yesterday's MITMProxy video.. somehow during editing I have accidentally removed an Important step (setting the actual proxy) which left most of you confused... this is a reupload with that part added in (5:00 -> 6:30) Lesson learned, don't edit late at night.. only in the mornings.

[@AjithkumarSekar]

thanks

[@batista98854]

No problem at all. Thanks ❤️

[@codygaudet8071]

I love your personality.

[@daohiep]

Very helpful video to learn about how a proxy works and what is needed to inspect https traffic, thanks!

[@infosandfacts7536]

So helpful thanks. As I have issues with couchDB, I will analyze may traffic with your advise. Thanks.

[@ivena]

Hmmm, if I got it right so we need to add this certificate in each device that going to use this proxy? is there a way to do that without installing the cert manualy?

[@rajantwanabashu]

This one gave me some clarification regarding MIMT on web. Is there a way we (server side) detect such SSL tempering / certificate modified via proxy servers.

[@nadavn5911]

Hey I want to build a proxy server that can be the man in the middle between my pc and the browsers, i want it to capture and filter urls

[@umangmalhotra1222]

😥😥😥 For me my macbook isn't allowing to configure web proxy, and secure web proxy, I change the settings for traffic to go through the localhost:8080 but after I apply my changes, it is immediately forgotten. Seems like some bug with macOS

[@farhanyousaf5616]

Very useful as always.

[@Bnslakki]

Congratulations for 100k subscribers 😊, please make a video on Noise Protocol Framework

[@ReligionAndMaterialismDebunked]

Congrats 🎉🎉👏🥳!!

[@bharatnanwani]

This is beautiful!

[@MrAjaykumar619]

Any instruction on how to configure mitm proxy for windows machine

[@bijeesraj007]

I press the "Like" button on every single video I watch on this channel.

[@hnasr]

❤️❤️

[@lalitjain5965]

i need help apps such as msft store, etc wont open after i use mitmweb or proxy help plz

[@anishakumar1199]

Great video! Thanks!

[@ipn92]

Awesome video @Hussein do you know any ways/tools to detect whether your HTTPS has an MITM server? (assuming certificates are 'forward' )

[@hnasr]

most of the MITM will fail if you don't have the certificate / or CA trusted on your machine. that is why some browsers use their own cert store and do not trust Operation system (firefox come to mind)

[@bastiaan85]

Nice tutorial 👍🏻 Unfortunately some apps use “certificate pinning”, in that case the connection will fail 🤔

[@hnasr]

Correct, apps with pinned certs can’t be MITM kzbin.info/www/bejne/aZTSgaOPf8x5qNE

[@julianhotter]

@@hnasr you can disable cert pinning when you patch the app fia frida for example. then it works

[@ReligionAndMaterialismDebunked]

​@@julianhotterthanks. :3 😅🤝

[@nadavn5911]

Hey How can i work with this tool in python?

[@suvarnav2019]

How to stop mitm proxy and mitm web server while running?

[@darkp0int]

how to analyze network traffic from android? thanks mate. This is great tutorial, very detail and simple to watch. but i think this will be my alternative after burpsuite and fiddler

[@micromaxcanvas265]

Can you generate python code from the intercepted requests automatically? I think postman has something like that. If you have to manually convert each request to code it's still very painful.

[@VIKASHMADHUKAR]

Exceptional 🤩

[@carlossuarez3842]

Hey @Hussein .. thanks for the awesome content.. do you know if MITMProxy is capable of capturing and decrypting HTTP/3 QUIC protocol also? I ran into an app that seems to enforce HTTP/3 and haven't been able to capture but I'm using Fiddler Classic and it seems HTTP/3 not implemented there, not really sure since all this low level security is really hard for me hehe.. so I'm looking for something like Fiddler which I can use for the purpose. I know my issue is not due to cert pinning because I'm using a jailbroken phone with SSLKillSwitch which is specifically to go around that.

[@sunnyy6295]

Can I add my custom certificate here?

[@shubhamtarkar38]

re-upload??

[@hnasr]

yes with additional content, I missed a very important step during editing :(

[@batista98854]

@@hnasr re-upload does not matter. We are loving the tutorials 👍. Thanks from India

[@BR-lx7py]

To use with curl under Ubuntu, add this to ~/.curlrc: proxy=localhost:8080 cacert=/home/$YOURUSER/Downloads/mitmproxy-ca-cert.pem For some reason curl does not pick up the system proxy.

[@hnasr]

Correct! Curl doesn’t use the OS proxy by default,

[@azizihack6593]

similar to burp suite?

[@shibbyshaggy]

can you do a video where the client doesn't need to update their wifi connection proxy (transparent) and intercept https login for example gmail or other site? This would truly be MITM when client has no idea their HTTPS requests are being intercepted. nice vid

[@enicolasgomez]

What a hack!!! "If you want to intercept HTTPS traffic then go and install a fake certificate for google in the client". Man, you should be CIA or something. Keep the good work!

[@ReligionAndMaterialismDebunked]

:3

[@shubhamkumbhare2725]

Good stuff

[@nithincs]

Hey.. just checking if you are aware of software Burp suite.

[@hnasr]

Yeah some people mentioned it ill give the free version a try

[@nithincs]

Cool, the free version itself got so many features. I am glad that you replied! thanks for the awesome videos on the channel 👍

[@ismaildavid9921]

Can it sniff passwords and usernames?

[@davidforrest3551]

i wonder this too, i would guess that it can, because it is using your certificate

[@AyushKumar-rg1uk]

been tired of using burpsuite it always crashes by computer , i will switch to mitm instead

[@OLDGAMERCHAN]

I actually did not understand what are you doing, what is the point of mitm yourself, i thought you were doing it to another device on your network. How can i let him connect the proxy server, is it possible by arp poisoning??

[@ReligionAndMaterialismDebunked]

If you want to use an alternative to Burp Suite without using a GUI OS on an Android or iPhone (Android is better), then this is the main one talked about that you'll use. :p

[@bharatjain5389]

What is 1:45 httttpss 😱

[@PiracyChecker]

thank for the good tutorial but try to talk less and go straight.