# Mitmproxy

> Use for interactive HTTP and API interception during authorized pentests. Trigger on request and response inspection, workflow debugging, replay needs, and situations where a lightweight programmable proxy fits better than a larger suite.

- Skill: `timsonner/mitmproxy` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/mitmproxy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/mitmproxy/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/mitmproxy

---


# Mitmproxy

## Purpose

Use this skill for controlled HTTP and API interception when the engagement needs a lightweight programmable proxy workflow.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to inspect, replay, or modify HTTP traffic in a controlled way.
- Need a smaller or scriptable alternative to a full interception suite.
- Need a repeatable API validation workflow.

## Avoid When

- The workflow includes highly sensitive data beyond the approved proof path.
- Proxying or replay would exceed the agreed impact level.

## Inputs

- Approved target workflow and auth context
- Proxy mode and interception goal
- Evidence handling limits for captured traffic

## Procedure

1. Scope proxying to the specific workflow under test.
2. Inspect and replay only the requests needed to prove the issue.
3. Avoid broad browsing or unnecessary data capture.
4. Record the exact request path used for the proof.
5. Preserve proxy settings and replay steps for retest.

## Command Syntax

Launch syntax is simple; validation logic happens in the proxied workflow.

```bash
# Start interactive TUI proxy on port 8080
mitmproxy -p 8080

# Start web UI
mitmweb -p 8080

# Capture to file (non-interactive)
mitmdump -p 8080 -w contoso-flows.mitm

# Replay saved flows
mitmproxy -r contoso-flows.mitm

# Filter to specific hosts only
mitmproxy -p 8080 --allow-hosts 'portal.contoso.com'

# Chain to an upstream proxy (e.g., Burp)
mitmproxy -p 8082 --mode upstream:http://127.0.0.1:8080

# Transparent proxy mode
mitmproxy --mode transparent -p 8080
```

## Evidence to Capture

- Requests and responses that establish the issue
- Exact workflow and proxy mode used
- Minimal replay path required for retest

## Safety Boundaries

- Keep interception tightly scoped to the approved workflow.
- Avoid capturing unnecessary sensitive traffic.