Mitmproxy 1.0 released

Dev tools

http debugging proxy

SHOW HN2016

Thanks!

Shown by mhils on Dec 26, 2016. Click the card to turn it over.

248points

37comments

#95of 2,264 in 2016

Top 5%of 2016 by points

How HN took it

MixedNo clear lean

8 positive, 10 neutral or asking, 4 mixed, 2 critical, out of 24 comments about the project. Thread score +0.20.

Execution: 2 for, 0 againstIdea: 2 for, 0 againstDesign: 2 for, 0 againstPerformance: 0 for, 2 against

Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.

positive neutral or mixed critical about another commenter or something else the maker

Useful, scriptable tool for web security testing
From 3 comments
- Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what…
  capt8bit on HN
- > (I am, for what it's worth, extremely familiar with Burp, but only casually acquainted with mitmproxy). You may be disappointed, since I am the opposite. I use burp in rare…
  capt8bit on HN
- TIL a new word: abstruse. Mitmproxy is a great tool for debugging web applications at a low level, particularly security related issues. Even for a n00b like myself the CLI was…
  mstade on HN
Well-written Python codebase
From 1 comment
- Forgot this was written in python. Scanned the code to see how they do http/2. This lib seems useful for general python use:…
  Goopplesoft on HN

Slow performance when intercepting large responses
From 2 comments
- I tried to use mitmproxy to fiddle around with ad requests a while back and found it really hard to get good performance from it. All I wanted to do was find all responses that…
  Eridrus on HN
- Its written in Python so performance will never be its strong point. Your regex might have been too greedy or you were throwing an entire network at it?
  jaimex2 on HN
No built-in SAZ format support for Fiddler users
From 1 comment
- Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may…
  colemickens on HN

Keep the command-line interface first-class
From 1 comment
- Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what…
  capt8bit on HN
Support for SAZ import and export
From 1 comment
- Nice but, I'd pay money for built in SAZ support. Maybe just exposing the web interface to colleagues might be sufficient, but generally if they can't open it in Fiddler, it may…
  colemickens on HN

Why the jump to 1.0 and planned 2.0
From 1 comment
- Why the sudden bump to a 1.0 version number? And why the planned jump to 2.0 in February? (I'd really like to see that blog post you're alluding to. :) Congrats on the release!
  echelon on HN
Can it intercept HTTPS
From 1 comment
- Can you mitm HTTPS? I'm guessing that the client would get some sort of certificate warning?
  rahrahrah on HN

Burp Suite
From 3 comments
- Looks cool! How does this compare to Burp Suite? I am specifically looking for something more lightweight.
  janvdberg on HN
- It's getting there, and if you hate Burp's Java UI and mostly use Burp solely to capture and manually edit requests, it might be an acceptable substitute. I don't think…
  tptacek on HN
- I have used mitmproxy for performing web application pentest for years. If you want something to create/intercept/edit/tamper/replay requests, this is your tool. If you want to…
  capt8bit on HN
Fiddler
From 2 comments
- I tried to use mitmproxy to fiddle around with ad requests a while back and found it really hard to get good performance from it. All I wanted to do was find all responses that…
  Eridrus on HN
- There's a Fiddler version for Linux (based on mono) which, in my experience, works quite well. Easier than starting up a windows VM. The killer feature of Fiddler, for me, is the…
  nimrody on HN
ZAP
From 1 comment
- Many thanks to you, cortesi, and the rest of the team. I hope this doesn't mean that the command-line interface is going to become a second-class interface? The CLI is what…
  capt8bit on HN