Mitmproxy

Mitmproxy

Purpose

Use this skill for controlled HTTP and API interception when the engagement needs a lightweight programmable proxy workflow.

Phase Fit

• Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
• Secondary: Retest and Closure

Use When

• Need to inspect, replay, or modify HTTP traffic in a controlled way.
• Need a smaller or scriptable alternative to a full interception suite.
• Need a repeatable API validation workflow.

Avoid When

• The workflow includes highly sensitive data beyond the approved proof path.
• Proxying or replay would exceed the agreed impact level.

Inputs

• Approved target workflow and auth context
• Proxy mode and interception goal
• Evidence handling limits for captured traffic

Procedure

1. Scope proxying to the specific workflow under test.
2. Inspect and replay only the requests needed to prove the issue.
3. Avoid broad browsing or unnecessary data capture.
4. Record the exact request path used for the proof.
5. Preserve proxy settings and replay steps for retest.

Command Syntax

Launch syntax is simple; validation logic happens in the proxied workflow.

# Start interactive TUI proxy on port 8080
mitmproxy -p 8080

# Start web UI
mitmweb -p 8080

# Capture to file (non-interactive)
mitmdump -p 8080 -w contoso-flows.mitm

# Replay saved flows
mitmproxy -r contoso-flows.mitm

# Filter to specific hosts only
mitmproxy -p 8080 --allow-hosts 'portal.contoso.com'

# Chain to an upstream proxy (e.g., Burp)
mitmproxy -p 8082 --mode upstream:http://127.0.0.1:8080

# Transparent proxy mode
mitmproxy --mode transparent -p 8080

Evidence to Capture

• Requests and responses that establish the issue
• Exact workflow and proxy mode used
• Minimal replay path required for retest

Safety Boundaries

• Keep interception tightly scoped to the approved workflow.
• Avoid capturing unnecessary sensitive traffic.