Hey guys, apologies for yesterday's MITMProxy video.. somehow during editing I have accidentally removed an Important step (setting the actual proxy) which left most of you confused... this is a reupload with that part added in (5:00 -> 6:30) Lesson learned, don't edit late at night.. only in the mornings.
What a hack!!! "If you want to intercept HTTPS traffic then go and install a fake certificate for google in the client". Man, you should be CIA or something. Keep the good work!
This one gave me some clarification regarding MIMT on web. Is there a way we (server side) detect such SSL tempering / certificate modified via proxy servers.
how to analyze network traffic from android? thanks mate. This is great tutorial, very detail and simple to watch. but i think this will be my alternative after burpsuite and fiddler
Hmmm, if I got it right so we need to add this certificate in each device that going to use this proxy? is there a way to do that without installing the cert manualy?
I actually did not understand what are you doing, what is the point of mitm yourself, i thought you were doing it to another device on your network. How can i let him connect the proxy server, is it possible by arp poisoning??
If you want to use an alternative to Burp Suite without using a GUI OS on an Android or iPhone (Android is better), then this is the main one talked about that you'll use. :p
😥😥😥 For me my macbook isn't allowing to configure web proxy, and secure web proxy, I change the settings for traffic to go through the localhost:8080 but after I apply my changes, it is immediately forgotten. Seems like some bug with macOS
Can you generate python code from the intercepted requests automatically? I think postman has something like that. If you have to manually convert each request to code it's still very painful.
most of the MITM will fail if you don't have the certificate / or CA trusted on your machine. that is why some browsers use their own cert store and do not trust Operation system (firefox come to mind)
can you do a video where the client doesn't need to update their wifi connection proxy (transparent) and intercept https login for example gmail or other site? This would truly be MITM when client has no idea their HTTPS requests are being intercepted. nice vid
To use with curl under Ubuntu, add this to ~/.curlrc: proxy=localhost:8080 cacert=/home/$YOURUSER/Downloads/mitmproxy-ca-cert.pem For some reason curl does not pick up the system proxy.
Hey @Hussein .. thanks for the awesome content.. do you know if MITMProxy is capable of capturing and decrypting HTTP/3 QUIC protocol also? I ran into an app that seems to enforce HTTP/3 and haven't been able to capture but I'm using Fiddler Classic and it seems HTTP/3 not implemented there, not really sure since all this low level security is really hard for me hehe.. so I'm looking for something like Fiddler which I can use for the purpose. I know my issue is not due to cert pinning because I'm using a jailbroken phone with SSLKillSwitch which is specifically to go around that.
