Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP/HTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.
Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP/HTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.
mitmproxy is an interactive, TLS-capable intercepting HTTP proxy for penetration testers and developers. It enables real-time inspection, modification, and replay of HTTP/HTTPS traffic including APIs, mobile apps, and thick clients. With support for HTTP/1, HTTP/2, HTTP/3, and WebSockets, mitmproxy provides comprehensive coverage for modern API security testing.
Interfaces
mitmproxy - Interactive console interface with keyboard navigation
mitmweb - Web-based GUI for visual traffic inspection
mitmdump - Command-line tool for automated traffic capture and scripting
Quick Start
Install and run mitmproxy:
# Install via pip
pip install mitmproxy
# Start interactive console proxy
mitmproxy
# Start web interface (default: http://127.0.0.1:8081)
mitmweb
# Start command-line proxy with output
mitmdump -w traffic.flow
Configure client to use proxy (default: localhost:8080)
Configure target application to use proxy (HTTP: localhost:8080)
Install mitmproxy CA certificate on client device
Trigger API requests from the application
Intercept and inspect requests/responses in mitmproxy
Modify requests to test:
Authentication bypass attempts
Authorization flaws (IDOR, privilege escalation)
Input validation (SQLi, XSS, command injection)
Business logic vulnerabilities
Save flows for documentation and reporting
Workflow 2: Mobile App API Security Testing
Progress:
[ ] 1. Install mitmproxy CA certificate on mobile device
[ ] 2. Configure device WiFi to use mitmproxy as proxy
[ ] 3. Start mitmweb for visual traffic inspection
[ ] 4. Launch mobile app and exercise all features
[ ] 5. Review API endpoints, authentication mechanisms, data flows
[ ] 6. Test for common API vulnerabilities (OWASP API Top 10)
[ ] 7. Export traffic as HAR for further analysis
[ ] 8. Document findings with request/response examples
Work through each step systematically. Check off completed items.
Workflow 3: Automated API Traffic Recording
For capturing and analyzing API traffic at scale:
Start mitmdump with flow capture:
mitmdump -w api-traffic.flow --mode regular
Run automated tests or manual app interaction
Stop mitmdump (Ctrl+C) to save flows
Replay captured traffic:
# Replay to server
mitmdump -nc -r api-traffic.flow
# Replay with modifications via script
mitmdump -s replay-script.py -r api-traffic.flow
Export to HAR format for analysis:
# Using Python API
python3 -c "from mitmproxy.io import FlowReader; from mitmproxy.tools.dump import DumpMaster;
import sys; [print(flow.request.url) for flow in FlowReader(open('api-traffic.flow', 'rb')).stream()]"
# Export flows to HAR format
mitmdump -s export-har.py -r captured-traffic.flow
# export-har.py
from mitmproxy import http, ctx
import json
class HARExporter:
def done(self):
har_entries = []
# Build HAR structure# (Simplified - use mitmproxy's built-in HAR addon)
ctx.log.info(f"Exported {len(har_entries)} entries")
addons = [HARExporter()]
Or use built-in addon:
mitmdump --set hardump=./traffic.har
Security Considerations
Sensitive Data Handling: Captured traffic may contain credentials, tokens, PII. Encrypt and secure stored flows. Never commit flow files to version control
Access Control: Restrict access to mitmproxy instance. Use authentication for mitmweb (--web-user/--web-password flags)
Audit Logging: Log all intercepted traffic and modifications for security auditing and compliance
Compliance: Ensure proper authorization before intercepting production traffic. Comply with GDPR, PCI-DSS for sensitive data
Safe Defaults: Use isolated testing environments. Avoid intercepting production traffic without explicit authorization
Integration Points
Penetration Testing Workflow
Reconnaissance: Identify API endpoints via mitmproxy
Authentication testing: Capture and analyze auth tokens
Authorization testing: Modify user IDs, roles, permissions
Input validation: Inject payloads to test for vulnerabilities
Business logic: Test workflows for logical flaws
Export findings as HAR for reporting
CI/CD Integration
Run automated API security tests:
# Run mitmdump with test script in CI
mitmdump -s api-security-tests.py --anticache -w test-results.flow &
PROXY_PID=$!
# Run API tests through proxyexport HTTP_PROXY=http://localhost:8080
export HTTPS_PROXY=http://localhost:8080
pytest tests/api_tests.py
# Stop proxy and analyze resultskill$PROXY_PID
python3 analyze-results.py test-results.flow
Mobile App Security Testing
Standard workflow for iOS/Android apps:
Configure device to use mitmproxy
Install CA certificate
Bypass SSL pinning if needed
Exercise app functionality
Analyze API security (OWASP Mobile Top 10)
Document API vulnerabilities
Advanced Features
Traffic Filtering
Filter displayed traffic by expression:
# Show only API calls
mitmproxy --view-filter '~d api.example.com'# Show only POST requests
mitmproxy --view-filter '~m POST'# Show responses with specific status
mitmproxy --view-filter '~c 401'# Combine filters
mitmproxy --view-filter '~d api.example.com & ~m POST'
