From b7701eb8c11dce5fdc00a3107a3eaacd80267346 Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Wed, 17 Feb 2016 00:02:18 +0100 Subject: add combined MANIFEST.in and CHANGELOG --- CHANGELOG | 560 ++++++++++++++++++++++++++++++++++++++++++++++++++ MANIFEST.in | 4 + mitmproxy/CHANGELOG | 475 ------------------------------------------ mitmproxy/MANIFEST.in | 2 - pathod/CHANGELOG | 83 -------- pathod/MANIFEST.in | 2 - 6 files changed, 564 insertions(+), 562 deletions(-) create mode 100644 CHANGELOG create mode 100644 MANIFEST.in delete mode 100644 mitmproxy/CHANGELOG delete mode 100644 mitmproxy/MANIFEST.in delete mode 100644 pathod/CHANGELOG delete mode 100644 pathod/MANIFEST.in diff --git a/CHANGELOG b/CHANGELOG new file mode 100644 index 00000000..72d58d23 --- /dev/null +++ b/CHANGELOG @@ -0,0 +1,560 @@ +15 January 2016: mitmproxy 0.16 + + * Completely revised HTTP2 implementation based on hyper-h2 (Thomas Kriechbaumer) + + * Export flows as cURL command, Python code or raw HTTP (Shadab Zafar) + + * Fixed compatibility with the Android Emulator (Will Coster) + + * Script Reloader: Inline scripts are reloaded automatically if modified (Matthew Shao) + + * Inline script hooks for TCP mode (Michael J. Bazzinotti) + + * Add default ciphers to support iOS9 App Transport Security (Jorge Villacorta) + + * Basic Authentication for mitmweb (Guillem Anguera) + + * Exempt connections from interception based on TLS Server Name Indication (David Weinstein) + + * Provide Python Wheels for faster installation + + * Numerous bugfixes and minor improvements + + +4 December 2015: mitmproxy 0.15 + + * Support for loading and converting older dumpfile formats (0.13 and up) + + * Content views for inline script (@chrisczub) + + * Better handling of empty header values (Benjamin Lee/@bltb) + + * Fix a gnarly memory leak in mitmdump + + * A number of bugfixes and small improvements + + +6 November 2015: mitmproxy 0.14 + + * Statistics: 399 commits, 13 contributors, 79 closed issues, 37 closed + PRs, 103 days + + * Docs: Greatly updated docs now hosted on ReadTheDocs! + http://docs.mitmproxy.org + + * Docs: Fixed Typos, updated URLs etc. (Nick Badger, Ben Lerner, Choongwoo + Han, onlywade, Jurriaan Bremer) + + * mitmdump: Colorized TTY output + + * mitmdump: Use mitmproxy's content views for human-readable output (Chris + Czub) + + * mitmproxy and mitmdump: Support for displaying UTF8 contents + + * mitmproxy: add command line switch to disable mouse interaction (Timothy + Elliott) + + * mitmproxy: bug fixes (Choongwoo Han, sethp-jive, FreeArtMan) + + * mitmweb: bug fixes (Colin Bendell) + + * libmproxy: Add ability to fall back to TCP passthrough for non-HTTP + connections. + + * libmproxy: Avoid double-connect in case of TLS Server Name Indication. + This yields a massive speedup for TLS handshakes. + + * libmproxy: Prevent unneccessary upstream connections (macmantrl) + + * Inline Scripts: New API for HTTP Headers: + http://docs.mitmproxy.org/en/latest/dev/models.html#netlib.http.Headers + + * Inline Scripts: Properly handle exceptions in `done` hook + + * Inline Scripts: Allow relative imports, provide `__file__` + + * Examples: Add probabilistic TLS passthrough as an inline script + + * netlib: Refactored HTTP protocol handling code + + * netlib: ALPN support + + * netlib: fixed a bug in the optional certificate verification. + + * netlib: Initial Python 3.5 support (this is the first prerequisite for + 3.x support in mitmproxy) + + +24 July 2015: mitmproxy 0.13 + + * Upstream certificate validation. See the --verify-upstream-cert, + --upstream-trusted-cadir and --upstream-trusted-ca parameters. Thanks to + Kyle Morton (github.com/kyle-m) for his work on this. + + * Add HTTP transparent proxy mode. This uses the host headers from HTTP + traffic (rather than SNI and IP address information from the OS) to + implement perform transparent proxying. Thanks to github.com/ijiro123 for + this feature. + + * Add ~src and ~dst REGEX filters, allowing matching on source and + destination addresses in the form of : + + * mitmproxy console: change g/G keyboard shortcuts to match less. Thanks to + Jose Luis Honorato (github.com/jlhonora). + + * mitmproxy console: Flow marking and unmarking. Marked flows are not + deleted when the flow list is cleared. Thanks to Jake Drahos + (github.com/drahosj). + + * mitmproxy console: add marking of flows + + * Remove the certforward feature. It was added to allow exploitation of + #gotofail, which is no longer a common vulnerability. Permitting this + hugely increased the complexity of packaging and distributing mitmproxy. + + + + +3 June 2015: mitmproxy 0.12.1 + + * mitmproxy console: mouse interaction - scroll in the flow list, click on + flow to view, click to switch between tabs. + + * Update our crypto defaults: SHA256, 2048 bit RSA, 4096 bit DH parameters. + + * BUGFIX: crash under some circumstances when copying to clipboard. + + * BUGFIX: occasional crash when deleting flows. + + +18 May 2015: mitmproxy 0.12 + + * mitmproxy console: Significant revamp of the UI. The major changes are + listed below, and in addition almost every aspect of the UI has + been tweaked, and performance has improved significantly. + + * mitmproxy console: A new options screen has been created ("o" shortcut), + and many options that were previously manipulated directly via a + keybinding have been moved there. + + * mitmproxy console: Big improvement in palettes. This includes improvements + to all colour schemes. Palettes now set the terminal background colour by + default, and a new --palette-transparent option has been added to disable + this. + + * mitmproxy console: g/G shortcuts throughout mitmproxy console to jump + to the beginning/end of the current view. + + * mitmproxy console: switch palettes on the fly from the options screen. + + * mitmproxy console: A cookie editor has been added for mitmproxy console + at long last. + + * mitmproxy console: Various components of requests and responses can be + copied to the clipboard from mitmproxy - thanks to @marceloglezer. + + * Support for creating new requests from scratch in mitmproxy console (@marceloglezer). + + * SSLKEYLOGFILE environment variable to specify a logging location for TLS + master keys. This can be used with tools like Wireshark to allow TLS + decoding. + + * Server facing SSL cipher suite specification (thanks to Jim Shaver). + + * Official support for transparent proxying on FreeBSD - thanks to Mike C + (http://github.com/mike-pt). + + * Many other small bugfixes and improvemenets throughout the project. + + +29 Dec 2014: mitmproxy 0.11.2: + + * Configuration files - mitmproxy.conf, mitmdump.conf, common.conf in the + .mitmproxy directory. + * Better handling of servers that reject connections that are not SNI. + * Many other small bugfixes and improvements. + + +15 November 2014: mitmproxy 0.11.1: + + * Bug fixes: connection leaks some crashes + + +7 November 2014: mitmproxy 0.11: + + * Performance improvements for mitmproxy console + + * SOCKS5 proxy mode allows mitmproxy to act as a SOCKS5 proxy server + + * Data streaming for response bodies exceeding a threshold + (bradpeabody@gmail.com) + + * Ignore hosts or IP addresses, forwarding both HTTP and HTTPS traffic + untouched + + * Finer-grained control of traffic replay, including options to ignore + contents or parameters when matching flows (marcelo.glezer@gmail.com) + + * Pass arguments to inline scripts + + * Configurable size limit on HTTP request and response bodies + + * Per-domain specification of interception certificates and keys (see + --cert option) + + * Certificate forwarding, relaying upstream SSL certificates verbatim (see + --cert-forward) + + * Search and highlighting for HTTP request and response bodies in + mitmproxy console (pedro@worcel.com) + + * Transparent proxy support on Windows + + * Improved error messages and logging + + * Support for FreeBSD in transparent mode, using pf (zbrdge@gmail.com) + + * Content view mode for WBXML (davidshaw835@air-watch.com) + + * Better documentation, with a new section on proxy modes + + * Generic TCP proxy mode + + * Countless bugfixes and other small improvements + + +7 November 2014: pathod 0.11: + + * Hugely improved SSL support, including dynamic generation of certificates + using the mitproxy cacert + + * pathoc -S dumps information on the remote SSL certificate chain + + * Big improvements to fuzzing, including random spec selection and memoization to avoid repeating randomly generated patterns + + * Reflected patterns, allowing you to embed a pathod server response specification in a pathoc request, resolving both on client side. This makes fuzzing proxies and other intermediate systems much better. + + +28 January 2014: mitmproxy 0.10: + + * Support for multiple scripts and multiple script arguments + + * Easy certificate install through the in-proxy web app, which is now + enabled by default + + * Forward proxy mode, that forwards proxy requests to an upstream HTTP server + + * Reverse proxy now works with SSL + + * Search within a request/response using the "/" and "n" shortcut keys + + * A view that beatifies CSS files if cssutils is available + + * Bug fix, documentation improvements, and more. + + +25 August 2013: mitmproxy 0.9.2: + + * Improvements to the mitmproxywrapper.py helper script for OSX. + + * Don't take minor version into account when checking for serialized file + compatibility. + + * Fix a bug causing resource exhaustion under some circumstances for SSL + connections. + + * Revamp the way we store interception certificates. We used to store these + on disk, they're now in-memory. This fixes a race condition related to + cert handling, and improves compatibility with Windows, where the rules + governing permitted file names are weird, resulting in errors for some + valid IDNA-encoded names. + + * Display transfer rates for responses in the flow list. + + * Many other small bugfixes and improvements. + + +25 August 2013: pathod 0.9.2: + + * Adapt to interface changes in netlib + + +16 June 2013: mitmproxy 0.9.1: + + * Use "correct" case for Content-Type headers added by mitmproxy. + + * Make UTF environment detection more robust. + + * Improved MIME-type detection for viewers. + + * Always read files in binary mode (Windows compatibility fix). + + * Some developer documentation. + + +15 May 2013: mitmproxy 0.9: + + * Upstream certs mode is now the default. + + * Add a WSGI container that lets you host in-proxy web applications. + + * Full transparent proxy support for Linux and OSX. + + * Introduce netlib, a common codebase for mitmproxy and pathod + (http://github.com/cortesi/netlib). + + * Full support for SNI. + + * Color palettes for mitmproxy, tailored for light and dark terminal + backgrounds. + + * Stream flows to file as responses arrive with the "W" shortcut in + mitmproxy. + + * Extend the filter language, including ~d domain match operator, ~a to + match asset flows (js, images, css). + + * Follow mode in mitmproxy ("F" shortcut) to "tail" flows as they arrive. + + * --dummy-certs option to specify and preserve the dummy certificate + directory. + + * Server replay from the current captured buffer. + + * Huge improvements in content views. We now have viewers for AMF, HTML, + JSON, Javascript, images, XML, URL-encoded forms, as well as hexadecimal + and raw views. + + * Add Set Headers, analagous to replacement hooks. Defines headers that are set + on flows, based on a matching pattern. + + * A graphical editor for path components in mitmproxy. + + * A small set of standard user-agent strings, which can be used easily in + the header editor. + + * Proxy authentication to limit access to mitmproxy + + +15 May 2013: pathod 0.9 (version synced with mitmproxy): + + * Pathod proxy mode. You can now configure clients to use pathod as an + HTTP/S proxy. + + * Pathoc proxy support, including using CONNECT to tunnel directly to + targets. + + * Pathoc client certificate support. + + * API improvements, bugfixes. + + +16 November 2012: pathod 0.3: + + A release focusing on shoring up our fuzzing capabilities, especially with + pathoc. + + * pathoc -q and -r options, output full request and response text. + + * pathod -q and -r options, add full request and response text to pathod's + log buffer. + + * pathoc and pathod -x option, makes -q and -r options log in hex dump + format. + + * pathoc -C option, specify response codes to ignore. + + * pathoc -T option, instructs pathoc to ignore timeouts. + + * pathoc -o option, a one-shot mode that exits after the first non-ignored + response. + + * pathoc and pathod -e option, which explains the resulting message by + expanding random and generated portions, and logging a reproducible + specification. + + * Streamline the specification langauge. HTTP response message is now + specified using the "r" mnemonic. + + * Add a "u" mnemonic for specifying User-Agent strings. Add a set of + standard user-agent strings accessible through shortcuts. + + * Major internal refactoring and cleanup. + + * Many bugfixes. + + +22 August 2012: pathod 0.2: + + * Add pathoc, a pathological HTTP client. + + * Add libpathod.test, a truss for using pathod in unit tests. + + * Add an injection operator to the specification language. + + * Allow Python escape sequences in value literals. + + * Allow execution of requests and responses from file, using the new + operator. + + * Add daemonization to Pathod, and make it more robust for public-facing use. + + * Let pathod pick an arbitrary open port if -p 0 is specified. + + * Move from Tornado to netlib, the network library written for mitmproxy. + + * Move the web application to Flask. + + * Massively expand the documentation. + + +5 April 2012: mitmproxy 0.8: + + * Detailed tutorial for Android interception. Some features that land in + this release have finally made reliable Android interception possible. + + * Upstream-cert mode, which uses information from the upstream server to + generate interception certificates. + + * Replacement patterns that let you easily do global replacements in flows + matching filter patterns. Can be specified on the command-line, or edited + interactively. + + * Much more sophisticated and usable pretty printing of request bodies. + Support for auto-indentation of Javascript, inspection of image EXIF + data, and more. + + * Details view for flows, showing connection and SSL cert information (X + keyboard shortcut). + + * Server certificates are now stored and serialized in saved traffic for + later analysis. This means that the 0.8 serialization format is NOT + compatible with 0.7. + + * Many other improvements, including bugfixes, and expanded scripting API, + and more sophisticated certificate handling. + + +20 February 2012: mitmproxy 0.7: + + * New built-in key/value editor. This lets you interactively edit URL query + strings, headers and URL-encoded form data. + + * Extend script API to allow duplication and replay of flows. + + * API for easy manipulation of URL-encoded forms and query strings. + + * Add "D" shortcut in mitmproxy to duplicate a flow. + + * Reverse proxy mode. In this mode mitmproxy acts as an HTTP server, + forwarding all traffic to a specified upstream server. + + * UI improvements - use unicode characters to make GUI more compact, + improve spacing and layout throughout. + + * Add support for filtering by HTTP method. + + * Add the ability to specify an HTTP body size limit. + + * Move to typed netstrings for serialization format - this makes 0.7 + backwards-incompatible with serialized data from 0.6! + + * Significant improvements in speed and responsiveness of UI. + + * Many minor bugfixes and improvements. + + +7 August 2011: mitmproxy 0.6: + + * New scripting API that allows much more flexible and fine-grained + rewriting of traffic. See the docs for more info. + + * Support for gzip and deflate content encodings. A new "z" + keybinding in mitmproxy to let us quickly encode and decode content, plus + automatic decoding for the "pretty" view mode. + + * An event log, viewable with the "v" shortcut in mitmproxy, and the + "-e" command-line flag in mitmdump. + + * Huge performance improvements: mitmproxy interface, loading + large numbers of flows from file. + + * A new "replace" convenience method for all flow objects, that does a + universal regex-based string replacement. + + * Header management has been rewritten to maintain both case and order. + + * Improved stability for SSL interception. + + * Default expiry time on generated SSL certs has been dropped to avoid an + OpenSSL overflow bug that caused certificates to expire in the distant + past on some systems. + + * A "pretty" view mode for JSON and form submission data. + + * Expanded documentation and examples. + + * Countless other small improvements and bugfixes. + + +27 June 2011: mitmproxy 0.5: + + * An -n option to start the tools without binding to a proxy port. + + * Allow scripts, hooks, sticky cookies etc. to run on flows loaded from + save files. + + * Regularize command-line options for mitmproxy and mitmdump. + + * Add an "SSL exception" to mitmproxy's license to remove possible + distribution issues. + + * Add a --cert-wait-time option to make mitmproxy pause after a new SSL + certificate is generated. This can pave over small discrepancies in + system time between the client and server. + + * Handle viewing big request and response bodies more elegantly. Only + render the first 100k of large documents, and try to avoid running the + XML indenter on non-XML data. + + * BUGFIX: Make the "revert" keyboard shortcut in mitmproxy work after a + flow has been replayed. + + * BUGFIX: Repair a problem that sometimes caused SSL connections to consume + 100% of CPU. + + +30 March 2011: mitmproxy 0.4 + + * Full serialization of HTTP conversations + + * Client and server replay + + * On-the-fly generation of dummy SSL certificates + + * mitmdump has "grown up" into a powerful tcpdump-like tool for HTTP/S + + * Dozens of improvements to the mitmproxy console interface + + * Python scripting hooks for programmatic modification of traffic + + +1 March 2010: mitmproxy 0.2 + + * Big speed and responsiveness improvements, thanks to Thomas Roth + + * Support urwid 0.9.9 + + * Terminal beeping based on filter expressions + + * Filter expressions for terminal beeps, limits, interceptions and sticky + cookies can now be passed on the command line. + + * Save requests and responses to file + + * Split off non-interactive dump functionality into a new tool called + mitmdump + + * "A" will now accept all intercepted connections + + * Lots of bugfixes diff --git a/MANIFEST.in b/MANIFEST.in new file mode 100644 index 00000000..440a14ed --- /dev/null +++ b/MANIFEST.in @@ -0,0 +1,4 @@ +graft mitmproxy +graft pathod +graft netlib +recursive-exclude * *.pyc *.pyo *.swo *.swp *.map \ No newline at end of file diff --git a/mitmproxy/CHANGELOG b/mitmproxy/CHANGELOG deleted file mode 100644 index b41b4a24..00000000 --- a/mitmproxy/CHANGELOG +++ /dev/null @@ -1,475 +0,0 @@ -15 January 2016: mitmproxy 0.16 - - * Completely revised HTTP2 implementation based on hyper-h2 (Thomas Kriechbaumer) - - * Export flows as cURL command, Python code or raw HTTP (Shadab Zafar) - - * Fixed compatibility with the Android Emulator (Will Coster) - - * Script Reloader: Inline scripts are reloaded automatically if modified (Matthew Shao) - - * Inline script hooks for TCP mode (Michael J. Bazzinotti) - - * Add default ciphers to support iOS9 App Transport Security (Jorge Villacorta) - - * Basic Authentication for mitmweb (Guillem Anguera) - - * Exempt connections from interception based on TLS Server Name Indication (David Weinstein) - - * Provide Python Wheels for faster installation - - * Numerous bugfixes and minor improvements - - -4 December 2015: mitmproxy 0.15 - - * Support for loading and converting older dumpfile formats (0.13 and up) - - * Content views for inline script (@chrisczub) - - * Better handling of empty header values (Benjamin Lee/@bltb) - - * Fix a gnarly memory leak in mitmdump - - * A number of bugfixes and small improvements - - -6 November 2015: mitmproxy 0.14 - - * Statistics: 399 commits, 13 contributors, 79 closed issues, 37 closed - PRs, 103 days - - * Docs: Greatly updated docs now hosted on ReadTheDocs! - http://docs.mitmproxy.org - - * Docs: Fixed Typos, updated URLs etc. (Nick Badger, Ben Lerner, Choongwoo - Han, onlywade, Jurriaan Bremer) - - * mitmdump: Colorized TTY output - - * mitmdump: Use mitmproxy's content views for human-readable output (Chris - Czub) - - * mitmproxy and mitmdump: Support for displaying UTF8 contents - - * mitmproxy: add command line switch to disable mouse interaction (Timothy - Elliott) - - * mitmproxy: bug fixes (Choongwoo Han, sethp-jive, FreeArtMan) - - * mitmweb: bug fixes (Colin Bendell) - - * libmproxy: Add ability to fall back to TCP passthrough for non-HTTP - connections. - - * libmproxy: Avoid double-connect in case of TLS Server Name Indication. - This yields a massive speedup for TLS handshakes. - - * libmproxy: Prevent unneccessary upstream connections (macmantrl) - - * Inline Scripts: New API for HTTP Headers: - http://docs.mitmproxy.org/en/latest/dev/models.html#netlib.http.Headers - - * Inline Scripts: Properly handle exceptions in `done` hook - - * Inline Scripts: Allow relative imports, provide `__file__` - - * Examples: Add probabilistic TLS passthrough as an inline script - - * netlib: Refactored HTTP protocol handling code - - * netlib: ALPN support - - * netlib: fixed a bug in the optional certificate verification. - - * netlib: Initial Python 3.5 support (this is the first prerequisite for - 3.x support in mitmproxy) - - -24 July 2015: mitmproxy 0.13 - - * Upstream certificate validation. See the --verify-upstream-cert, - --upstream-trusted-cadir and --upstream-trusted-ca parameters. Thanks to - Kyle Morton (github.com/kyle-m) for his work on this. - - * Add HTTP transparent proxy mode. This uses the host headers from HTTP - traffic (rather than SNI and IP address information from the OS) to - implement perform transparent proxying. Thanks to github.com/ijiro123 for - this feature. - - * Add ~src and ~dst REGEX filters, allowing matching on source and - destination addresses in the form of : - - * mitmproxy console: change g/G keyboard shortcuts to match less. Thanks to - Jose Luis Honorato (github.com/jlhonora). - - * mitmproxy console: Flow marking and unmarking. Marked flows are not - deleted when the flow list is cleared. Thanks to Jake Drahos - (github.com/drahosj). - - * mitmproxy console: add marking of flows - - * Remove the certforward feature. It was added to allow exploitation of - #gotofail, which is no longer a common vulnerability. Permitting this - hugely increased the complexity of packaging and distributing mitmproxy. - - - - -3 June 2015: mitmproxy 0.12.1 - - * mitmproxy console: mouse interaction - scroll in the flow list, click on - flow to view, click to switch between tabs. - - * Update our crypto defaults: SHA256, 2048 bit RSA, 4096 bit DH parameters. - - * BUGFIX: crash under some circumstances when copying to clipboard. - - * BUGFIX: occasional crash when deleting flows. - - -18 May 2015: mitmproxy 0.12 - - * mitmproxy console: Significant revamp of the UI. The major changes are - listed below, and in addition almost every aspect of the UI has - been tweaked, and performance has improved significantly. - - * mitmproxy console: A new options screen has been created ("o" shortcut), - and many options that were previously manipulated directly via a - keybinding have been moved there. - - * mitmproxy console: Big improvement in palettes. This includes improvements - to all colour schemes. Palettes now set the terminal background colour by - default, and a new --palette-transparent option has been added to disable - this. - - * mitmproxy console: g/G shortcuts throughout mitmproxy console to jump - to the beginning/end of the current view. - - * mitmproxy console: switch palettes on the fly from the options screen. - - * mitmproxy console: A cookie editor has been added for mitmproxy console - at long last. - - * mitmproxy console: Various components of requests and responses can be - copied to the clipboard from mitmproxy - thanks to @marceloglezer. - - * Support for creating new requests from scratch in mitmproxy console (@marceloglezer). - - * SSLKEYLOGFILE environment variable to specify a logging location for TLS - master keys. This can be used with tools like Wireshark to allow TLS - decoding. - - * Server facing SSL cipher suite specification (thanks to Jim Shaver). - - * Official support for transparent proxying on FreeBSD - thanks to Mike C - (http://github.com/mike-pt). - - * Many other small bugfixes and improvemenets throughout the project. - - -29 Dec 2014: mitmproxy 0.11.2: - - * Configuration files - mitmproxy.conf, mitmdump.conf, common.conf in the - .mitmproxy directory. - * Better handling of servers that reject connections that are not SNI. - * Many other small bugfixes and improvements. - - -15 November 2014: mitmproxy 0.11.1: - - * Bug fixes: connection leaks some crashes - - -7 November 2014: mitmproxy 0.11: - - * Performance improvements for mitmproxy console - - * SOCKS5 proxy mode allows mitmproxy to act as a SOCKS5 proxy server - - * Data streaming for response bodies exceeding a threshold - (bradpeabody@gmail.com) - - * Ignore hosts or IP addresses, forwarding both HTTP and HTTPS traffic - untouched - - * Finer-grained control of traffic replay, including options to ignore - contents or parameters when matching flows (marcelo.glezer@gmail.com) - - * Pass arguments to inline scripts - - * Configurable size limit on HTTP request and response bodies - - * Per-domain specification of interception certificates and keys (see - --cert option) - - * Certificate forwarding, relaying upstream SSL certificates verbatim (see - --cert-forward) - - * Search and highlighting for HTTP request and response bodies in - mitmproxy console (pedro@worcel.com) - - * Transparent proxy support on Windows - - * Improved error messages and logging - - * Support for FreeBSD in transparent mode, using pf (zbrdge@gmail.com) - - * Content view mode for WBXML (davidshaw835@air-watch.com) - - * Better documentation, with a new section on proxy modes - - * Generic TCP proxy mode - - * Countless bugfixes and other small improvements - - - -28 January 2014: mitmproxy 0.10: - - * Support for multiple scripts and multiple script arguments - - * Easy certificate install through the in-proxy web app, which is now - enabled by default - - * Forward proxy mode, that forwards proxy requests to an upstream HTTP server - - * Reverse proxy now works with SSL - - * Search within a request/response using the "/" and "n" shortcut keys - - * A view that beatifies CSS files if cssutils is available - - * Bug fix, documentation improvements, and more. - - -25 August 2013: mitmproxy 0.9.2: - - * Improvements to the mitmproxywrapper.py helper script for OSX. - - * Don't take minor version into account when checking for serialized file - compatibility. - - * Fix a bug causing resource exhaustion under some circumstances for SSL - connections. - - * Revamp the way we store interception certificates. We used to store these - on disk, they're now in-memory. This fixes a race condition related to - cert handling, and improves compatibility with Windows, where the rules - governing permitted file names are weird, resulting in errors for some - valid IDNA-encoded names. - - * Display transfer rates for responses in the flow list. - - * Many other small bugfixes and improvements. - - - - -16 June 2013: mitmproxy 0.9.1: - - * Use "correct" case for Content-Type headers added by mitmproxy. - - * Make UTF environment detection more robust. - - * Improved MIME-type detection for viewers. - - * Always read files in binary mode (Windows compatibility fix). - - * Some developer documentation. - - -15 May 2013: mitmproxy 0.9: - - * Upstream certs mode is now the default. - - * Add a WSGI container that lets you host in-proxy web applications. - - * Full transparent proxy support for Linux and OSX. - - * Introduce netlib, a common codebase for mitmproxy and pathod - (http://github.com/cortesi/netlib). - - * Full support for SNI. - - * Color palettes for mitmproxy, tailored for light and dark terminal - backgrounds. - - * Stream flows to file as responses arrive with the "W" shortcut in - mitmproxy. - - * Extend the filter language, including ~d domain match operator, ~a to - match asset flows (js, images, css). - - * Follow mode in mitmproxy ("F" shortcut) to "tail" flows as they arrive. - - * --dummy-certs option to specify and preserve the dummy certificate - directory. - - * Server replay from the current captured buffer. - - * Huge improvements in content views. We now have viewers for AMF, HTML, - JSON, Javascript, images, XML, URL-encoded forms, as well as hexadecimal - and raw views. - - * Add Set Headers, analagous to replacement hooks. Defines headers that are set - on flows, based on a matching pattern. - - * A graphical editor for path components in mitmproxy. - - * A small set of standard user-agent strings, which can be used easily in - the header editor. - - * Proxy authentication to limit access to mitmproxy - - -5 April 2012: mitmproxy 0.8: - - * Detailed tutorial for Android interception. Some features that land in - this release have finally made reliable Android interception possible. - - * Upstream-cert mode, which uses information from the upstream server to - generate interception certificates. - - * Replacement patterns that let you easily do global replacements in flows - matching filter patterns. Can be specified on the command-line, or edited - interactively. - - * Much more sophisticated and usable pretty printing of request bodies. - Support for auto-indentation of Javascript, inspection of image EXIF - data, and more. - - * Details view for flows, showing connection and SSL cert information (X - keyboard shortcut). - - * Server certificates are now stored and serialized in saved traffic for - later analysis. This means that the 0.8 serialization format is NOT - compatible with 0.7. - - * Many other improvements, including bugfixes, and expanded scripting API, - and more sophisticated certificate handling. - - -20 February 2012: mitmproxy 0.7: - - * New built-in key/value editor. This lets you interactively edit URL query - strings, headers and URL-encoded form data. - - * Extend script API to allow duplication and replay of flows. - - * API for easy manipulation of URL-encoded forms and query strings. - - * Add "D" shortcut in mitmproxy to duplicate a flow. - - * Reverse proxy mode. In this mode mitmproxy acts as an HTTP server, - forwarding all traffic to a specified upstream server. - - * UI improvements - use unicode characters to make GUI more compact, - improve spacing and layout throughout. - - * Add support for filtering by HTTP method. - - * Add the ability to specify an HTTP body size limit. - - * Move to typed netstrings for serialization format - this makes 0.7 - backwards-incompatible with serialized data from 0.6! - - * Significant improvements in speed and responsiveness of UI. - - * Many minor bugfixes and improvements. - - -7 August 2011: mitmproxy 0.6: - - * New scripting API that allows much more flexible and fine-grained - rewriting of traffic. See the docs for more info. - - * Support for gzip and deflate content encodings. A new "z" - keybinding in mitmproxy to let us quickly encode and decode content, plus - automatic decoding for the "pretty" view mode. - - * An event log, viewable with the "v" shortcut in mitmproxy, and the - "-e" command-line flag in mitmdump. - - * Huge performance improvements: mitmproxy interface, loading - large numbers of flows from file. - - * A new "replace" convenience method for all flow objects, that does a - universal regex-based string replacement. - - * Header management has been rewritten to maintain both case and order. - - * Improved stability for SSL interception. - - * Default expiry time on generated SSL certs has been dropped to avoid an - OpenSSL overflow bug that caused certificates to expire in the distant - past on some systems. - - * A "pretty" view mode for JSON and form submission data. - - * Expanded documentation and examples. - - * Countless other small improvements and bugfixes. - - -27 June 2011: mitmproxy 0.5: - - * An -n option to start the tools without binding to a proxy port. - - * Allow scripts, hooks, sticky cookies etc. to run on flows loaded from - save files. - - * Regularize command-line options for mitmproxy and mitmdump. - - * Add an "SSL exception" to mitmproxy's license to remove possible - distribution issues. - - * Add a --cert-wait-time option to make mitmproxy pause after a new SSL - certificate is generated. This can pave over small discrepancies in - system time between the client and server. - - * Handle viewing big request and response bodies more elegantly. Only - render the first 100k of large documents, and try to avoid running the - XML indenter on non-XML data. - - * BUGFIX: Make the "revert" keyboard shortcut in mitmproxy work after a - flow has been replayed. - - * BUGFIX: Repair a problem that sometimes caused SSL connections to consume - 100% of CPU. - - -30 March 2011: mitmproxy 0.4 - - * Full serialization of HTTP conversations - - * Client and server replay - - * On-the-fly generation of dummy SSL certificates - - * mitmdump has "grown up" into a powerful tcpdump-like tool for HTTP/S - - * Dozens of improvements to the mitmproxy console interface - - * Python scripting hooks for programmatic modification of traffic - - -1 March 2010: mitmproxy 0.2 - - * Big speed and responsiveness improvements, thanks to Thomas Roth - - * Support urwid 0.9.9 - - * Terminal beeping based on filter expressions - - * Filter expressions for terminal beeps, limits, interceptions and sticky - cookies can now be passed on the command line. - - * Save requests and responses to file - - * Split off non-interactive dump functionality into a new tool called - mitmdump - - * "A" will now accept all intercepted connections - - * Lots of bugfixes diff --git a/mitmproxy/MANIFEST.in b/mitmproxy/MANIFEST.in deleted file mode 100644 index 54b57382..00000000 --- a/mitmproxy/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -graft mitmproxy -recursive-exclude * *.pyc *.pyo *.swo *.swp *.map \ No newline at end of file diff --git a/pathod/CHANGELOG b/pathod/CHANGELOG deleted file mode 100644 index 2de445b4..00000000 --- a/pathod/CHANGELOG +++ /dev/null @@ -1,83 +0,0 @@ -7 November 2014: pathod 0.11: - - * Hugely improved SSL support, including dynamic generation of certificates - using the mitproxy cacert - * pathoc -S dumps information on the remote SSL certificate chain - * Big improvements to fuzzing, including random spec selection and memoization to avoid repeating randomly generated patterns - * Reflected patterns, allowing you to embed a pathod server response specification in a pathoc request, resolving both on client side. This makes fuzzing proxies and other intermediate systems much better. - - -25 August 2013: pathod 0.9.2: - - * Adapt to interface changes in netlib - - -15 May 2013: pathod 0.9 (version synced with mitmproxy): - - * Pathod proxy mode. You can now configure clients to use pathod as an - HTTP/S proxy. - - * Pathoc proxy support, including using CONNECT to tunnel directly to - targets. - - * Pathoc client certificate support. - - * API improvements, bugfixes. - - -16 November 2012: pathod 0.3: - - A release focusing on shoring up our fuzzing capabilities, especially with - pathoc. - - * pathoc -q and -r options, output full request and response text. - - * pathod -q and -r options, add full request and response text to pathod's - log buffer. - - * pathoc and pathod -x option, makes -q and -r options log in hex dump - format. - - * pathoc -C option, specify response codes to ignore. - - * pathoc -T option, instructs pathoc to ignore timeouts. - - * pathoc -o option, a one-shot mode that exits after the first non-ignored - response. - - * pathoc and pathod -e option, which explains the resulting message by - expanding random and generated portions, and logging a reproducible - specification. - - * Streamline the specification langauge. HTTP response message is now - specified using the "r" mnemonic. - - * Add a "u" mnemonic for specifying User-Agent strings. Add a set of - standard user-agent strings accessible through shortcuts. - - * Major internal refactoring and cleanup. - - * Many bugfixes. - - -22 August 2012: pathod 0.2: - - * Add pathoc, a pathological HTTP client. - - * Add libpathod.test, a truss for using pathod in unit tests. - - * Add an injection operator to the specification language. - - * Allow Python escape sequences in value literals. - - * Allow execution of requests and responses from file, using the new + operator. - - * Add daemonization to Pathod, and make it more robust for public-facing use. - - * Let pathod pick an arbitrary open port if -p 0 is specified. - - * Move from Tornado to netlib, the network library written for mitmproxy. - - * Move the web application to Flask. - - * Massively expand the documentation. diff --git a/pathod/MANIFEST.in b/pathod/MANIFEST.in deleted file mode 100644 index a83fa08f..00000000 --- a/pathod/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -graft pathod -recursive-exclude * *.pyc *.pyo *.swo *.swp *.map \ No newline at end of file -- cgit v1.2.3 From 595d2a2fa09ea8c16507266a0c4d435bb1c68983 Mon Sep 17 00:00:00 2001 From: Will Coster Date: Tue, 16 Feb 2016 18:35:42 -0800 Subject: Add a content view for query parameters The query content view uses format_dict to display a table of query parameters and is made the default content view for requests with query parameters and no request body. To facilitate this the query parameter dictionary of HTTPRequests is added to the metadata content view parameter under the "query" key. Additionally, the logic for handling "no content" messages is moved from contentviews.get_content_view to ViewAuto. This is necessary as it allows the query content view to be displayed when there is no request body. --- mitmproxy/mitmproxy/console/flowview.py | 5 ++++- mitmproxy/mitmproxy/contentviews.py | 27 ++++++++++++++++++++++----- test/mitmproxy/test_contentview.py | 21 +++++++++++++++++++++ 3 files changed, 47 insertions(+), 6 deletions(-) diff --git a/mitmproxy/mitmproxy/console/flowview.py b/mitmproxy/mitmproxy/console/flowview.py index d2b98b68..f490732e 100644 --- a/mitmproxy/mitmproxy/console/flowview.py +++ b/mitmproxy/mitmproxy/console/flowview.py @@ -193,8 +193,11 @@ class FlowView(tabs.Tabs): def _get_content_view(self, viewmode, message, max_lines, _): try: + query = None + if isinstance(message, HTTPRequest): + query = message.query description, lines = contentviews.get_content_view( - viewmode, message.content, headers=message.headers + viewmode, message.content, headers=message.headers, query=query ) except ContentViewException: s = "Content viewer failed: \n" + traceback.format_exc() diff --git a/mitmproxy/mitmproxy/contentviews.py b/mitmproxy/mitmproxy/contentviews.py index c0652c18..5335b59c 100644 --- a/mitmproxy/mitmproxy/contentviews.py +++ b/mitmproxy/mitmproxy/contentviews.py @@ -8,7 +8,8 @@ in the future, e.g. to decode protobuf messages sent as WebSocket frames. Thus, the View API is very minimalistic. The only arguments are `data` and `**metadata`, where `data` is the actual content (as bytes). The contents on metadata depend on the protocol in -use. For HTTP, the message headers are passed as the ``headers`` keyword argument. +use. For HTTP, the message headers are passed as the ``headers`` keyword argument. For HTTP +requests, the query parameters are passed as the ``query`` keyword argument. """ from __future__ import (absolute_import, print_function, division) @@ -118,15 +119,19 @@ class ViewAuto(View): def __call__(self, data, **metadata): headers = metadata.get("headers", {}) ctype = headers.get("content-type") - if ctype: + if data and ctype: ct = parse_content_type(ctype) if ctype else None ct = "%s/%s" % (ct[0], ct[1]) if ct in content_types_map: return content_types_map[ct][0](data, **metadata) elif utils.isXML(data): return get("XML")(data, **metadata) - if utils.isMostlyBin(data): + if metadata.get("query"): + return get("Query")(data, **metadata) + if data and utils.isMostlyBin(data): return get("Hex")(data) + if not data: + return "No content", [] return get("Raw")(data) @@ -460,6 +465,19 @@ class ViewProtobuf(View): return "Protobuf", format_text(decoded) +class ViewQuery(View): + name = "Query" + prompt = ("query", "q") + content_types = [] + + def __call__(self, data, **metadata): + query = metadata.get("query") + if query: + return "Query", format_dict(query) + else: + return "Query", format_text("") + + class ViewWBXML(View): name = "WBXML" prompt = ("wbxml", "w") @@ -541,6 +559,7 @@ add(ViewCSS()) add(ViewURLEncoded()) add(ViewMultipart()) add(ViewImage()) +add(ViewQuery()) if pyamf: add(ViewAMF()) @@ -577,8 +596,6 @@ def get_content_view(viewmode, data, **metadata): Raises: ContentViewException, if the content view threw an error. """ - if not data: - return "No content", [] msg = [] headers = metadata.get("headers", {}) diff --git a/test/mitmproxy/test_contentview.py b/test/mitmproxy/test_contentview.py index 7f1d735e..c00afa5f 100644 --- a/test/mitmproxy/test_contentview.py +++ b/test/mitmproxy/test_contentview.py @@ -1,5 +1,6 @@ from mitmproxy.exceptions import ContentViewException from netlib.http import Headers +from netlib.odict import ODict import netlib.utils from netlib import encoding @@ -45,6 +46,19 @@ class TestContentView: ) assert f[0].startswith("XML") + f = v( + "", + headers=Headers() + ) + assert f[0] == "No content" + + f = v( + "", + headers=Headers(), + query=ODict([("foo", "bar")]), + ) + assert f[0] == "Query" + def test_view_urlencoded(self): d = netlib.utils.urlencode([("one", "two"), ("three", "four")]) v = cv.ViewURLEncoded() @@ -158,6 +172,13 @@ Larry h = Headers(content_type="unparseable") assert not view(v, headers=h) + def test_view_query(self): + d = "" + v = cv.ViewQuery() + f = v(d, query=ODict([("foo", "bar")])) + assert f[0] == "Query" + assert [x for x in f[1]] == [[("header", "foo: "), ("text", "bar")]] + def test_get_content_view(self): r = cv.get_content_view( cv.get("Raw"), -- cgit v1.2.3 From 262b4bc482381d8ce4caee7c16cc4c4d0d96d002 Mon Sep 17 00:00:00 2001 From: Thomas Kriechbaumer Date: Wed, 17 Feb 2016 15:34:31 +0100 Subject: upgrade h2, remove reset-stream hotfix --- mitmproxy/mitmproxy/protocol/http2.py | 15 --------------- mitmproxy/setup.py | 2 +- 2 files changed, 1 insertion(+), 16 deletions(-) diff --git a/mitmproxy/mitmproxy/protocol/http2.py b/mitmproxy/mitmproxy/protocol/http2.py index c121637c..3fbc500a 100644 --- a/mitmproxy/mitmproxy/protocol/http2.py +++ b/mitmproxy/mitmproxy/protocol/http2.py @@ -9,8 +9,6 @@ from netlib.exceptions import HttpException from netlib.http import Headers from netlib.utils import http2_read_raw_frame -import hyperframe -import h2 from h2.connection import H2Connection from h2.events import * @@ -232,19 +230,6 @@ class Http2Layer(Layer): stream.zombie = time.time() return - frame, _ = hyperframe.frame.Frame.parse_frame_header(raw_frame[:9]) - - if is_server: - list = self.server_reset_streams - else: - list = self.client_reset_streams - if frame.stream_id in list: - # this frame belongs to a reset stream - just ignore it - if isinstance(frame, hyperframe.frame.HeadersFrame) or isinstance(frame, hyperframe.frame.ContinuationFrame): - # we need to keep the hpack-decoder happy too - source_conn.h2.decoder.decode(raw_frame[9:]) - continue - events = source_conn.h2.receive_data(raw_frame) source_conn.send(source_conn.h2.data_to_send()) diff --git a/mitmproxy/setup.py b/mitmproxy/setup.py index 9d796ebb..e2035a42 100644 --- a/mitmproxy/setup.py +++ b/mitmproxy/setup.py @@ -54,7 +54,7 @@ setup( # It is not considered best practice to use install_requires to pin dependencies to specific versions. install_requires=[ "netlib=={}".format(version.VERSION), - "h2>=2.1.0, <2.2", + "h2>=2.1.2, <3.0", "tornado>=4.3, <4.4", "configargparse>=0.10, <0.11", "pyperclip>=1.5.22, <1.6", -- cgit v1.2.3 From 10047a025fd80f0bbf7970141bf344166058f2b6 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Thu, 18 Feb 2016 09:05:24 +1300 Subject: One CHANGELOG at the top of the repo --- CHANGELOG | 493 ++++++++++++++++++++++++++++++++++++++++++++++++++++ mitmproxy/CHANGELOG | 475 -------------------------------------------------- pathod/CHANGELOG | 83 --------- 3 files changed, 493 insertions(+), 558 deletions(-) create mode 100644 CHANGELOG delete mode 100644 mitmproxy/CHANGELOG delete mode 100644 pathod/CHANGELOG diff --git a/CHANGELOG b/CHANGELOG new file mode 100644 index 00000000..f1f3f9fc --- /dev/null +++ b/CHANGELOG @@ -0,0 +1,493 @@ +15 January 2016: mitmproxy 0.16 + + * Completely revised HTTP2 implementation based on hyper-h2 (Thomas Kriechbaumer) + + * Export flows as cURL command, Python code or raw HTTP (Shadab Zafar) + + * Fixed compatibility with the Android Emulator (Will Coster) + + * Script Reloader: Inline scripts are reloaded automatically if modified (Matthew Shao) + + * Inline script hooks for TCP mode (Michael J. Bazzinotti) + + * Add default ciphers to support iOS9 App Transport Security (Jorge Villacorta) + + * Basic Authentication for mitmweb (Guillem Anguera) + + * Exempt connections from interception based on TLS Server Name Indication (David Weinstein) + + * Provide Python Wheels for faster installation + + * Numerous bugfixes and minor improvements + + +4 December 2015: mitmproxy 0.15 + + * Support for loading and converting older dumpfile formats (0.13 and up) + + * Content views for inline script (@chrisczub) + + * Better handling of empty header values (Benjamin Lee/@bltb) + + * Fix a gnarly memory leak in mitmdump + + * A number of bugfixes and small improvements + + +6 November 2015: mitmproxy 0.14 + + * Statistics: 399 commits, 13 contributors, 79 closed issues, 37 closed + PRs, 103 days + + * Docs: Greatly updated docs now hosted on ReadTheDocs! + http://docs.mitmproxy.org + + * Docs: Fixed Typos, updated URLs etc. (Nick Badger, Ben Lerner, Choongwoo + Han, onlywade, Jurriaan Bremer) + + * mitmdump: Colorized TTY output + + * mitmdump: Use mitmproxy's content views for human-readable output (Chris + Czub) + + * mitmproxy and mitmdump: Support for displaying UTF8 contents + + * mitmproxy: add command line switch to disable mouse interaction (Timothy + Elliott) + + * mitmproxy: bug fixes (Choongwoo Han, sethp-jive, FreeArtMan) + + * mitmweb: bug fixes (Colin Bendell) + + * libmproxy: Add ability to fall back to TCP passthrough for non-HTTP + connections. + + * libmproxy: Avoid double-connect in case of TLS Server Name Indication. + This yields a massive speedup for TLS handshakes. + + * libmproxy: Prevent unneccessary upstream connections (macmantrl) + + * Inline Scripts: New API for HTTP Headers: + http://docs.mitmproxy.org/en/latest/dev/models.html#netlib.http.Headers + + * Inline Scripts: Properly handle exceptions in `done` hook + + * Inline Scripts: Allow relative imports, provide `__file__` + + * Examples: Add probabilistic TLS passthrough as an inline script + + * netlib: Refactored HTTP protocol handling code + + * netlib: ALPN support + + * netlib: fixed a bug in the optional certificate verification. + + * netlib: Initial Python 3.5 support (this is the first prerequisite for + 3.x support in mitmproxy) + + +24 July 2015: mitmproxy 0.13 + + * Upstream certificate validation. See the --verify-upstream-cert, + --upstream-trusted-cadir and --upstream-trusted-ca parameters. Thanks to + Kyle Morton (github.com/kyle-m) for his work on this. + + * Add HTTP transparent proxy mode. This uses the host headers from HTTP + traffic (rather than SNI and IP address information from the OS) to + implement perform transparent proxying. Thanks to github.com/ijiro123 for + this feature. + + * Add ~src and ~dst REGEX filters, allowing matching on source and + destination addresses in the form of : + + * mitmproxy console: change g/G keyboard shortcuts to match less. Thanks to + Jose Luis Honorato (github.com/jlhonora). + + * mitmproxy console: Flow marking and unmarking. Marked flows are not + deleted when the flow list is cleared. Thanks to Jake Drahos + (github.com/drahosj). + + * mitmproxy console: add marking of flows + + * Remove the certforward feature. It was added to allow exploitation of + #gotofail, which is no longer a common vulnerability. Permitting this + hugely increased the complexity of packaging and distributing mitmproxy. + + + + +3 June 2015: mitmproxy 0.12.1 + + * mitmproxy console: mouse interaction - scroll in the flow list, click on + flow to view, click to switch between tabs. + + * Update our crypto defaults: SHA256, 2048 bit RSA, 4096 bit DH parameters. + + * BUGFIX: crash under some circumstances when copying to clipboard. + + * BUGFIX: occasional crash when deleting flows. + + +18 May 2015: mitmproxy 0.12 + + * mitmproxy console: Significant revamp of the UI. The major changes are + listed below, and in addition almost every aspect of the UI has + been tweaked, and performance has improved significantly. + + * mitmproxy console: A new options screen has been created ("o" shortcut), + and many options that were previously manipulated directly via a + keybinding have been moved there. + + * mitmproxy console: Big improvement in palettes. This includes improvements + to all colour schemes. Palettes now set the terminal background colour by + default, and a new --palette-transparent option has been added to disable + this. + + * mitmproxy console: g/G shortcuts throughout mitmproxy console to jump + to the beginning/end of the current view. + + * mitmproxy console: switch palettes on the fly from the options screen. + + * mitmproxy console: A cookie editor has been added for mitmproxy console + at long last. + + * mitmproxy console: Various components of requests and responses can be + copied to the clipboard from mitmproxy - thanks to @marceloglezer. + + * Support for creating new requests from scratch in mitmproxy console (@marceloglezer). + + * SSLKEYLOGFILE environment variable to specify a logging location for TLS + master keys. This can be used with tools like Wireshark to allow TLS + decoding. + + * Server facing SSL cipher suite specification (thanks to Jim Shaver). + + * Official support for transparent proxying on FreeBSD - thanks to Mike C + (http://github.com/mike-pt). + + * Many other small bugfixes and improvemenets throughout the project. + + +29 Dec 2014: mitmproxy 0.11.2: + + * Configuration files - mitmproxy.conf, mitmdump.conf, common.conf in the + .mitmproxy directory. + * Better handling of servers that reject connections that are not SNI. + * Many other small bugfixes and improvements. + + +15 November 2014: mitmproxy 0.11.1: + + * Bug fixes: connection leaks some crashes + + +7 November 2014: mitmproxy 0.11: + + * Performance improvements for mitmproxy console + + * SOCKS5 proxy mode allows mitmproxy to act as a SOCKS5 proxy server + + * Data streaming for response bodies exceeding a threshold + (bradpeabody@gmail.com) + + * Ignore hosts or IP addresses, forwarding both HTTP and HTTPS traffic + untouched + + * Finer-grained control of traffic replay, including options to ignore + contents or parameters when matching flows (marcelo.glezer@gmail.com) + + * Pass arguments to inline scripts + + * Configurable size limit on HTTP request and response bodies + + * Per-domain specification of interception certificates and keys (see + --cert option) + + * Certificate forwarding, relaying upstream SSL certificates verbatim (see + --cert-forward) + + * Search and highlighting for HTTP request and response bodies in + mitmproxy console (pedro@worcel.com) + + * Transparent proxy support on Windows + + * Improved error messages and logging + + * Support for FreeBSD in transparent mode, using pf (zbrdge@gmail.com) + + * Content view mode for WBXML (davidshaw835@air-watch.com) + + * Better documentation, with a new section on proxy modes + + * Generic TCP proxy mode + + * Countless bugfixes and other small improvements + + * pathod: Hugely improved SSL support, including dynamic generation of certificates + using the mitproxy cacert + + * pathod: pathoc -S dumps information on the remote SSL certificate chain + + * pathod: Big improvements to fuzzing, including random spec selection and + memoization to avoid repeating randomly generated patterns + + * pathod: Reflected patterns, allowing you to embed a pathod server response specification in a pathoc request, resolving both on client side. This makes fuzzing proxies and other intermediate systems much better. + +28 January 2014: mitmproxy 0.10: + + * Support for multiple scripts and multiple script arguments + + * Easy certificate install through the in-proxy web app, which is now + enabled by default + + * Forward proxy mode, that forwards proxy requests to an upstream HTTP server + + * Reverse proxy now works with SSL + + * Search within a request/response using the "/" and "n" shortcut keys + + * A view that beatifies CSS files if cssutils is available + + * Bug fix, documentation improvements, and more. + + +25 August 2013: mitmproxy 0.9.2: + + * Improvements to the mitmproxywrapper.py helper script for OSX. + + * Don't take minor version into account when checking for serialized file + compatibility. + + * Fix a bug causing resource exhaustion under some circumstances for SSL + connections. + + * Revamp the way we store interception certificates. We used to store these + on disk, they're now in-memory. This fixes a race condition related to + cert handling, and improves compatibility with Windows, where the rules + governing permitted file names are weird, resulting in errors for some + valid IDNA-encoded names. + + * Display transfer rates for responses in the flow list. + + * Many other small bugfixes and improvements. + + * pathod: Adapt to interface changes in netlib + + +16 June 2013: mitmproxy 0.9.1: + + * Use "correct" case for Content-Type headers added by mitmproxy. + + * Make UTF environment detection more robust. + + * Improved MIME-type detection for viewers. + + * Always read files in binary mode (Windows compatibility fix). + + * Some developer documentation. + + +15 May 2013: mitmproxy 0.9: + + * Upstream certs mode is now the default. + + * Add a WSGI container that lets you host in-proxy web applications. + + * Full transparent proxy support for Linux and OSX. + + * Introduce netlib, a common codebase for mitmproxy and pathod + (http://github.com/cortesi/netlib). + + * Full support for SNI. + + * Color palettes for mitmproxy, tailored for light and dark terminal + backgrounds. + + * Stream flows to file as responses arrive with the "W" shortcut in + mitmproxy. + + * Extend the filter language, including ~d domain match operator, ~a to + match asset flows (js, images, css). + + * Follow mode in mitmproxy ("F" shortcut) to "tail" flows as they arrive. + + * --dummy-certs option to specify and preserve the dummy certificate + directory. + + * Server replay from the current captured buffer. + + * Huge improvements in content views. We now have viewers for AMF, HTML, + JSON, Javascript, images, XML, URL-encoded forms, as well as hexadecimal + and raw views. + + * Add Set Headers, analagous to replacement hooks. Defines headers that are set + on flows, based on a matching pattern. + + * A graphical editor for path components in mitmproxy. + + * A small set of standard user-agent strings, which can be used easily in + the header editor. + + * Proxy authentication to limit access to mitmproxy + + * pathod: Proxy mode. You can now configure clients to use pathod as an + HTTP/S proxy. + + * pathoc: Proxy support, including using CONNECT to tunnel directly to + targets. + + * pathoc: client certificate support. + + * pathod: API improvements, bugfixes. + + +5 April 2012: mitmproxy 0.8: + + * Detailed tutorial for Android interception. Some features that land in + this release have finally made reliable Android interception possible. + + * Upstream-cert mode, which uses information from the upstream server to + generate interception certificates. + + * Replacement patterns that let you easily do global replacements in flows + matching filter patterns. Can be specified on the command-line, or edited + interactively. + + * Much more sophisticated and usable pretty printing of request bodies. + Support for auto-indentation of Javascript, inspection of image EXIF + data, and more. + + * Details view for flows, showing connection and SSL cert information (X + keyboard shortcut). + + * Server certificates are now stored and serialized in saved traffic for + later analysis. This means that the 0.8 serialization format is NOT + compatible with 0.7. + + * Many other improvements, including bugfixes, and expanded scripting API, + and more sophisticated certificate handling. + + +20 February 2012: mitmproxy 0.7: + + * New built-in key/value editor. This lets you interactively edit URL query + strings, headers and URL-encoded form data. + + * Extend script API to allow duplication and replay of flows. + + * API for easy manipulation of URL-encoded forms and query strings. + + * Add "D" shortcut in mitmproxy to duplicate a flow. + + * Reverse proxy mode. In this mode mitmproxy acts as an HTTP server, + forwarding all traffic to a specified upstream server. + + * UI improvements - use unicode characters to make GUI more compact, + improve spacing and layout throughout. + + * Add support for filtering by HTTP method. + + * Add the ability to specify an HTTP body size limit. + + * Move to typed netstrings for serialization format - this makes 0.7 + backwards-incompatible with serialized data from 0.6! + + * Significant improvements in speed and responsiveness of UI. + + * Many minor bugfixes and improvements. + + +7 August 2011: mitmproxy 0.6: + + * New scripting API that allows much more flexible and fine-grained + rewriting of traffic. See the docs for more info. + + * Support for gzip and deflate content encodings. A new "z" + keybinding in mitmproxy to let us quickly encode and decode content, plus + automatic decoding for the "pretty" view mode. + + * An event log, viewable with the "v" shortcut in mitmproxy, and the + "-e" command-line flag in mitmdump. + + * Huge performance improvements: mitmproxy interface, loading + large numbers of flows from file. + + * A new "replace" convenience method for all flow objects, that does a + universal regex-based string replacement. + + * Header management has been rewritten to maintain both case and order. + + * Improved stability for SSL interception. + + * Default expiry time on generated SSL certs has been dropped to avoid an + OpenSSL overflow bug that caused certificates to expire in the distant + past on some systems. + + * A "pretty" view mode for JSON and form submission data. + + * Expanded documentation and examples. + + * Countless other small improvements and bugfixes. + + +27 June 2011: mitmproxy 0.5: + + * An -n option to start the tools without binding to a proxy port. + + * Allow scripts, hooks, sticky cookies etc. to run on flows loaded from + save files. + + * Regularize command-line options for mitmproxy and mitmdump. + + * Add an "SSL exception" to mitmproxy's license to remove possible + distribution issues. + + * Add a --cert-wait-time option to make mitmproxy pause after a new SSL + certificate is generated. This can pave over small discrepancies in + system time between the client and server. + + * Handle viewing big request and response bodies more elegantly. Only + render the first 100k of large documents, and try to avoid running the + XML indenter on non-XML data. + + * BUGFIX: Make the "revert" keyboard shortcut in mitmproxy work after a + flow has been replayed. + + * BUGFIX: Repair a problem that sometimes caused SSL connections to consume + 100% of CPU. + + +30 March 2011: mitmproxy 0.4 + + * Full serialization of HTTP conversations + + * Client and server replay + + * On-the-fly generation of dummy SSL certificates + + * mitmdump has "grown up" into a powerful tcpdump-like tool for HTTP/S + + * Dozens of improvements to the mitmproxy console interface + + * Python scripting hooks for programmatic modification of traffic + + +1 March 2010: mitmproxy 0.2 + + * Big speed and responsiveness improvements, thanks to Thomas Roth + + * Support urwid 0.9.9 + + * Terminal beeping based on filter expressions + + * Filter expressions for terminal beeps, limits, interceptions and sticky + cookies can now be passed on the command line. + + * Save requests and responses to file + + * Split off non-interactive dump functionality into a new tool called + mitmdump + + * "A" will now accept all intercepted connections + + * Lots of bugfixes diff --git a/mitmproxy/CHANGELOG b/mitmproxy/CHANGELOG deleted file mode 100644 index b41b4a24..00000000 --- a/mitmproxy/CHANGELOG +++ /dev/null @@ -1,475 +0,0 @@ -15 January 2016: mitmproxy 0.16 - - * Completely revised HTTP2 implementation based on hyper-h2 (Thomas Kriechbaumer) - - * Export flows as cURL command, Python code or raw HTTP (Shadab Zafar) - - * Fixed compatibility with the Android Emulator (Will Coster) - - * Script Reloader: Inline scripts are reloaded automatically if modified (Matthew Shao) - - * Inline script hooks for TCP mode (Michael J. Bazzinotti) - - * Add default ciphers to support iOS9 App Transport Security (Jorge Villacorta) - - * Basic Authentication for mitmweb (Guillem Anguera) - - * Exempt connections from interception based on TLS Server Name Indication (David Weinstein) - - * Provide Python Wheels for faster installation - - * Numerous bugfixes and minor improvements - - -4 December 2015: mitmproxy 0.15 - - * Support for loading and converting older dumpfile formats (0.13 and up) - - * Content views for inline script (@chrisczub) - - * Better handling of empty header values (Benjamin Lee/@bltb) - - * Fix a gnarly memory leak in mitmdump - - * A number of bugfixes and small improvements - - -6 November 2015: mitmproxy 0.14 - - * Statistics: 399 commits, 13 contributors, 79 closed issues, 37 closed - PRs, 103 days - - * Docs: Greatly updated docs now hosted on ReadTheDocs! - http://docs.mitmproxy.org - - * Docs: Fixed Typos, updated URLs etc. (Nick Badger, Ben Lerner, Choongwoo - Han, onlywade, Jurriaan Bremer) - - * mitmdump: Colorized TTY output - - * mitmdump: Use mitmproxy's content views for human-readable output (Chris - Czub) - - * mitmproxy and mitmdump: Support for displaying UTF8 contents - - * mitmproxy: add command line switch to disable mouse interaction (Timothy - Elliott) - - * mitmproxy: bug fixes (Choongwoo Han, sethp-jive, FreeArtMan) - - * mitmweb: bug fixes (Colin Bendell) - - * libmproxy: Add ability to fall back to TCP passthrough for non-HTTP - connections. - - * libmproxy: Avoid double-connect in case of TLS Server Name Indication. - This yields a massive speedup for TLS handshakes. - - * libmproxy: Prevent unneccessary upstream connections (macmantrl) - - * Inline Scripts: New API for HTTP Headers: - http://docs.mitmproxy.org/en/latest/dev/models.html#netlib.http.Headers - - * Inline Scripts: Properly handle exceptions in `done` hook - - * Inline Scripts: Allow relative imports, provide `__file__` - - * Examples: Add probabilistic TLS passthrough as an inline script - - * netlib: Refactored HTTP protocol handling code - - * netlib: ALPN support - - * netlib: fixed a bug in the optional certificate verification. - - * netlib: Initial Python 3.5 support (this is the first prerequisite for - 3.x support in mitmproxy) - - -24 July 2015: mitmproxy 0.13 - - * Upstream certificate validation. See the --verify-upstream-cert, - --upstream-trusted-cadir and --upstream-trusted-ca parameters. Thanks to - Kyle Morton (github.com/kyle-m) for his work on this. - - * Add HTTP transparent proxy mode. This uses the host headers from HTTP - traffic (rather than SNI and IP address information from the OS) to - implement perform transparent proxying. Thanks to github.com/ijiro123 for - this feature. - - * Add ~src and ~dst REGEX filters, allowing matching on source and - destination addresses in the form of : - - * mitmproxy console: change g/G keyboard shortcuts to match less. Thanks to - Jose Luis Honorato (github.com/jlhonora). - - * mitmproxy console: Flow marking and unmarking. Marked flows are not - deleted when the flow list is cleared. Thanks to Jake Drahos - (github.com/drahosj). - - * mitmproxy console: add marking of flows - - * Remove the certforward feature. It was added to allow exploitation of - #gotofail, which is no longer a common vulnerability. Permitting this - hugely increased the complexity of packaging and distributing mitmproxy. - - - - -3 June 2015: mitmproxy 0.12.1 - - * mitmproxy console: mouse interaction - scroll in the flow list, click on - flow to view, click to switch between tabs. - - * Update our crypto defaults: SHA256, 2048 bit RSA, 4096 bit DH parameters. - - * BUGFIX: crash under some circumstances when copying to clipboard. - - * BUGFIX: occasional crash when deleting flows. - - -18 May 2015: mitmproxy 0.12 - - * mitmproxy console: Significant revamp of the UI. The major changes are - listed below, and in addition almost every aspect of the UI has - been tweaked, and performance has improved significantly. - - * mitmproxy console: A new options screen has been created ("o" shortcut), - and many options that were previously manipulated directly via a - keybinding have been moved there. - - * mitmproxy console: Big improvement in palettes. This includes improvements - to all colour schemes. Palettes now set the terminal background colour by - default, and a new --palette-transparent option has been added to disable - this. - - * mitmproxy console: g/G shortcuts throughout mitmproxy console to jump - to the beginning/end of the current view. - - * mitmproxy console: switch palettes on the fly from the options screen. - - * mitmproxy console: A cookie editor has been added for mitmproxy console - at long last. - - * mitmproxy console: Various components of requests and responses can be - copied to the clipboard from mitmproxy - thanks to @marceloglezer. - - * Support for creating new requests from scratch in mitmproxy console (@marceloglezer). - - * SSLKEYLOGFILE environment variable to specify a logging location for TLS - master keys. This can be used with tools like Wireshark to allow TLS - decoding. - - * Server facing SSL cipher suite specification (thanks to Jim Shaver). - - * Official support for transparent proxying on FreeBSD - thanks to Mike C - (http://github.com/mike-pt). - - * Many other small bugfixes and improvemenets throughout the project. - - -29 Dec 2014: mitmproxy 0.11.2: - - * Configuration files - mitmproxy.conf, mitmdump.conf, common.conf in the - .mitmproxy directory. - * Better handling of servers that reject connections that are not SNI. - * Many other small bugfixes and improvements. - - -15 November 2014: mitmproxy 0.11.1: - - * Bug fixes: connection leaks some crashes - - -7 November 2014: mitmproxy 0.11: - - * Performance improvements for mitmproxy console - - * SOCKS5 proxy mode allows mitmproxy to act as a SOCKS5 proxy server - - * Data streaming for response bodies exceeding a threshold - (bradpeabody@gmail.com) - - * Ignore hosts or IP addresses, forwarding both HTTP and HTTPS traffic - untouched - - * Finer-grained control of traffic replay, including options to ignore - contents or parameters when matching flows (marcelo.glezer@gmail.com) - - * Pass arguments to inline scripts - - * Configurable size limit on HTTP request and response bodies - - * Per-domain specification of interception certificates and keys (see - --cert option) - - * Certificate forwarding, relaying upstream SSL certificates verbatim (see - --cert-forward) - - * Search and highlighting for HTTP request and response bodies in - mitmproxy console (pedro@worcel.com) - - * Transparent proxy support on Windows - - * Improved error messages and logging - - * Support for FreeBSD in transparent mode, using pf (zbrdge@gmail.com) - - * Content view mode for WBXML (davidshaw835@air-watch.com) - - * Better documentation, with a new section on proxy modes - - * Generic TCP proxy mode - - * Countless bugfixes and other small improvements - - - -28 January 2014: mitmproxy 0.10: - - * Support for multiple scripts and multiple script arguments - - * Easy certificate install through the in-proxy web app, which is now - enabled by default - - * Forward proxy mode, that forwards proxy requests to an upstream HTTP server - - * Reverse proxy now works with SSL - - * Search within a request/response using the "/" and "n" shortcut keys - - * A view that beatifies CSS files if cssutils is available - - * Bug fix, documentation improvements, and more. - - -25 August 2013: mitmproxy 0.9.2: - - * Improvements to the mitmproxywrapper.py helper script for OSX. - - * Don't take minor version into account when checking for serialized file - compatibility. - - * Fix a bug causing resource exhaustion under some circumstances for SSL - connections. - - * Revamp the way we store interception certificates. We used to store these - on disk, they're now in-memory. This fixes a race condition related to - cert handling, and improves compatibility with Windows, where the rules - governing permitted file names are weird, resulting in errors for some - valid IDNA-encoded names. - - * Display transfer rates for responses in the flow list. - - * Many other small bugfixes and improvements. - - - - -16 June 2013: mitmproxy 0.9.1: - - * Use "correct" case for Content-Type headers added by mitmproxy. - - * Make UTF environment detection more robust. - - * Improved MIME-type detection for viewers. - - * Always read files in binary mode (Windows compatibility fix). - - * Some developer documentation. - - -15 May 2013: mitmproxy 0.9: - - * Upstream certs mode is now the default. - - * Add a WSGI container that lets you host in-proxy web applications. - - * Full transparent proxy support for Linux and OSX. - - * Introduce netlib, a common codebase for mitmproxy and pathod - (http://github.com/cortesi/netlib). - - * Full support for SNI. - - * Color palettes for mitmproxy, tailored for light and dark terminal - backgrounds. - - * Stream flows to file as responses arrive with the "W" shortcut in - mitmproxy. - - * Extend the filter language, including ~d domain match operator, ~a to - match asset flows (js, images, css). - - * Follow mode in mitmproxy ("F" shortcut) to "tail" flows as they arrive. - - * --dummy-certs option to specify and preserve the dummy certificate - directory. - - * Server replay from the current captured buffer. - - * Huge improvements in content views. We now have viewers for AMF, HTML, - JSON, Javascript, images, XML, URL-encoded forms, as well as hexadecimal - and raw views. - - * Add Set Headers, analagous to replacement hooks. Defines headers that are set - on flows, based on a matching pattern. - - * A graphical editor for path components in mitmproxy. - - * A small set of standard user-agent strings, which can be used easily in - the header editor. - - * Proxy authentication to limit access to mitmproxy - - -5 April 2012: mitmproxy 0.8: - - * Detailed tutorial for Android interception. Some features that land in - this release have finally made reliable Android interception possible. - - * Upstream-cert mode, which uses information from the upstream server to - generate interception certificates. - - * Replacement patterns that let you easily do global replacements in flows - matching filter patterns. Can be specified on the command-line, or edited - interactively. - - * Much more sophisticated and usable pretty printing of request bodies. - Support for auto-indentation of Javascript, inspection of image EXIF - data, and more. - - * Details view for flows, showing connection and SSL cert information (X - keyboard shortcut). - - * Server certificates are now stored and serialized in saved traffic for - later analysis. This means that the 0.8 serialization format is NOT - compatible with 0.7. - - * Many other improvements, including bugfixes, and expanded scripting API, - and more sophisticated certificate handling. - - -20 February 2012: mitmproxy 0.7: - - * New built-in key/value editor. This lets you interactively edit URL query - strings, headers and URL-encoded form data. - - * Extend script API to allow duplication and replay of flows. - - * API for easy manipulation of URL-encoded forms and query strings. - - * Add "D" shortcut in mitmproxy to duplicate a flow. - - * Reverse proxy mode. In this mode mitmproxy acts as an HTTP server, - forwarding all traffic to a specified upstream server. - - * UI improvements - use unicode characters to make GUI more compact, - improve spacing and layout throughout. - - * Add support for filtering by HTTP method. - - * Add the ability to specify an HTTP body size limit. - - * Move to typed netstrings for serialization format - this makes 0.7 - backwards-incompatible with serialized data from 0.6! - - * Significant improvements in speed and responsiveness of UI. - - * Many minor bugfixes and improvements. - - -7 August 2011: mitmproxy 0.6: - - * New scripting API that allows much more flexible and fine-grained - rewriting of traffic. See the docs for more info. - - * Support for gzip and deflate content encodings. A new "z" - keybinding in mitmproxy to let us quickly encode and decode content, plus - automatic decoding for the "pretty" view mode. - - * An event log, viewable with the "v" shortcut in mitmproxy, and the - "-e" command-line flag in mitmdump. - - * Huge performance improvements: mitmproxy interface, loading - large numbers of flows from file. - - * A new "replace" convenience method for all flow objects, that does a - universal regex-based string replacement. - - * Header management has been rewritten to maintain both case and order. - - * Improved stability for SSL interception. - - * Default expiry time on generated SSL certs has been dropped to avoid an - OpenSSL overflow bug that caused certificates to expire in the distant - past on some systems. - - * A "pretty" view mode for JSON and form submission data. - - * Expanded documentation and examples. - - * Countless other small improvements and bugfixes. - - -27 June 2011: mitmproxy 0.5: - - * An -n option to start the tools without binding to a proxy port. - - * Allow scripts, hooks, sticky cookies etc. to run on flows loaded from - save files. - - * Regularize command-line options for mitmproxy and mitmdump. - - * Add an "SSL exception" to mitmproxy's license to remove possible - distribution issues. - - * Add a --cert-wait-time option to make mitmproxy pause after a new SSL - certificate is generated. This can pave over small discrepancies in - system time between the client and server. - - * Handle viewing big request and response bodies more elegantly. Only - render the first 100k of large documents, and try to avoid running the - XML indenter on non-XML data. - - * BUGFIX: Make the "revert" keyboard shortcut in mitmproxy work after a - flow has been replayed. - - * BUGFIX: Repair a problem that sometimes caused SSL connections to consume - 100% of CPU. - - -30 March 2011: mitmproxy 0.4 - - * Full serialization of HTTP conversations - - * Client and server replay - - * On-the-fly generation of dummy SSL certificates - - * mitmdump has "grown up" into a powerful tcpdump-like tool for HTTP/S - - * Dozens of improvements to the mitmproxy console interface - - * Python scripting hooks for programmatic modification of traffic - - -1 March 2010: mitmproxy 0.2 - - * Big speed and responsiveness improvements, thanks to Thomas Roth - - * Support urwid 0.9.9 - - * Terminal beeping based on filter expressions - - * Filter expressions for terminal beeps, limits, interceptions and sticky - cookies can now be passed on the command line. - - * Save requests and responses to file - - * Split off non-interactive dump functionality into a new tool called - mitmdump - - * "A" will now accept all intercepted connections - - * Lots of bugfixes diff --git a/pathod/CHANGELOG b/pathod/CHANGELOG deleted file mode 100644 index 2de445b4..00000000 --- a/pathod/CHANGELOG +++ /dev/null @@ -1,83 +0,0 @@ -7 November 2014: pathod 0.11: - - * Hugely improved SSL support, including dynamic generation of certificates - using the mitproxy cacert - * pathoc -S dumps information on the remote SSL certificate chain - * Big improvements to fuzzing, including random spec selection and memoization to avoid repeating randomly generated patterns - * Reflected patterns, allowing you to embed a pathod server response specification in a pathoc request, resolving both on client side. This makes fuzzing proxies and other intermediate systems much better. - - -25 August 2013: pathod 0.9.2: - - * Adapt to interface changes in netlib - - -15 May 2013: pathod 0.9 (version synced with mitmproxy): - - * Pathod proxy mode. You can now configure clients to use pathod as an - HTTP/S proxy. - - * Pathoc proxy support, including using CONNECT to tunnel directly to - targets. - - * Pathoc client certificate support. - - * API improvements, bugfixes. - - -16 November 2012: pathod 0.3: - - A release focusing on shoring up our fuzzing capabilities, especially with - pathoc. - - * pathoc -q and -r options, output full request and response text. - - * pathod -q and -r options, add full request and response text to pathod's - log buffer. - - * pathoc and pathod -x option, makes -q and -r options log in hex dump - format. - - * pathoc -C option, specify response codes to ignore. - - * pathoc -T option, instructs pathoc to ignore timeouts. - - * pathoc -o option, a one-shot mode that exits after the first non-ignored - response. - - * pathoc and pathod -e option, which explains the resulting message by - expanding random and generated portions, and logging a reproducible - specification. - - * Streamline the specification langauge. HTTP response message is now - specified using the "r" mnemonic. - - * Add a "u" mnemonic for specifying User-Agent strings. Add a set of - standard user-agent strings accessible through shortcuts. - - * Major internal refactoring and cleanup. - - * Many bugfixes. - - -22 August 2012: pathod 0.2: - - * Add pathoc, a pathological HTTP client. - - * Add libpathod.test, a truss for using pathod in unit tests. - - * Add an injection operator to the specification language. - - * Allow Python escape sequences in value literals. - - * Allow execution of requests and responses from file, using the new + operator. - - * Add daemonization to Pathod, and make it more robust for public-facing use. - - * Let pathod pick an arbitrary open port if -p 0 is specified. - - * Move from Tornado to netlib, the network library written for mitmproxy. - - * Move the web application to Flask. - - * Massively expand the documentation. -- cgit v1.2.3 From 09abd7eb9a6dc10bbe71ca87e9da07dbe9b3ba54 Mon Sep 17 00:00:00 2001 From: Thomas Kriechbaumer Date: Wed, 17 Feb 2016 20:38:51 +0100 Subject: add issue template --- CONTRIBUTING.md | 39 --------------------------------------- README.rst | 27 ++++++++++++++++++++++++++- issue_template.md | 28 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+), 40 deletions(-) delete mode 100644 CONTRIBUTING.md create mode 100644 issue_template.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index ae948d73..00000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,39 +0,0 @@ -# Contributing - -Thank you for your interest in contributing to mitmproxy! - -# Bug Reports - -Bug Reports are very welcome - please file them on the GitHub [issue tracker](https://github.com/mitmproxy/mitmproxy/issues). -You can use the following template to structure your report: - -``` -##### Steps to reproduce the problem: -1. -2. -3. - -##### What is the expected behavior? - - -##### What went wrong? - - -##### Any other comments? - - ---- -mitmproxy version: -Operating System: -``` - -# Feature Requests - -We're happy to hear what you'd like to see in mitmproxy. Please file feature requests on the GitHub [issue tracker](https://github.com/mitmproxy/mitmproxy/issues). - -# Patches - -We're always happy to accept patches. Please submit them in the form of pull requests to the main [mitmproxy repository](https://github.com/mitmproxy/mitmproxy/). -If you're working on something cool, please do not hesistate and get in touch! - -Instructions for setting up a development environment can be found in the [README](README.rst). diff --git a/README.rst b/README.rst index d6285700..d816a763 100644 --- a/README.rst +++ b/README.rst @@ -82,7 +82,7 @@ Please ensure that all patches are accompanied by matching changes in the test suite. The project tries to maintain 100% test coverage. -Docs +Documentation ---- The mitmproxy documentation is build using Sphinx_, which is installed automatically if you set up a development @@ -100,6 +100,30 @@ The last command invokes `sphinx-autobuild`_, which watches the Sphinx directory the documentation when a change is detected. +Contributing +---- + +Thank you for your interest in contributing to mitmproxy! + +* Bug Reports + +Bug Reports are very welcome - please file them on the GitHub issue_tracker_. +Please make sure to fill out the template and provide as much information as +possible. + +* Feature Requests + +We're happy to hear what you'd like to see in mitmproxy. Please file feature +requests on the GitHub issue_tracker_. + +* Patches + +We're always happy to accept patches. Please submit them in the form of pull +requests to the this repository. If you're working on something cool, please do +not hesitate and get in touch! + + + .. |mitmproxy_site| image:: https://shields.mitmproxy.org/api/https%3A%2F%2F-mitmproxy.org-blue.svg :target: https://mitmproxy.org/ :alt: mitmproxy.org @@ -143,3 +167,4 @@ the documentation when a change is detected. .. _.env: https://github.com/mitmproxy/mitmproxy/blob/master/.env .. _Sphinx: http://sphinx-doc.org/ .. _sphinx-autobuild: https://pypi.python.org/pypi/sphinx-autobuild +.. _issue_tracker: https://github.com/mitmproxy/mitmproxy/issues diff --git a/issue_template.md b/issue_template.md new file mode 100644 index 00000000..01b736be --- /dev/null +++ b/issue_template.md @@ -0,0 +1,28 @@ +##### Steps to reproduce the problem: +1. Launch mitmproxy +2. Press X +3. Click Y + +##### What is the expected behavior? + +It should display Z. + +##### What went wrong? + +It crashed with this error/trace: ... + +##### Any other comments? + +None. + +--- + +mitmproxy version: (e.g.: 0.16, git commit hash) + +mitmproxy installed from: (e.g.: pip, binary package, source) + +Operating System: (e.g.: Windows, OSX, Linux, with specific version) + +OpenSSL version: (e.g.: 1.0.2f, run `openssl version` in your shell) + +pyOpenSSL version: (e.g.: 0.15.1, run `import OpenSSL; print(OpenSSL.__version__)` in Python) -- cgit v1.2.3 From 92597f82ea8e4747ce1836ecd5eb2479486e8647 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Thu, 18 Feb 2016 09:19:05 +1300 Subject: Docs and examples to top level --- .landscape.yml | 4 +- .travis.yml | 2 +- docs/.gitignore | 1 + docs/Makefile | 195 ++++ docs/_templates/page.html | 10 + docs/certinstall-webapp.png | Bin 0 -> 61683 bytes docs/certinstall.rst | 195 ++++ docs/conf.py | 219 ++++ docs/config.rst | 86 ++ docs/custom-routing.txt | 24 + docs/dev/addingviews.html | 52 + docs/dev/architecture.rst | 14 + docs/dev/exceptions.rst | 9 + docs/dev/models.rst | 59 ++ docs/dev/protocols.rst | 15 + docs/dev/proxy.rst | 12 + docs/dev/sslkeylogfile.rst | 14 + docs/dev/testing.rst | 47 + docs/favicon.ico | Bin 0 -> 5430 bytes docs/features/anticache.rst | 15 + docs/features/clientreplay.rst | 18 + docs/features/filters.rst | 39 + docs/features/passthrough.rst | 97 ++ docs/features/proxyauth.rst | 17 + docs/features/replacements.rst | 72 ++ docs/features/responsestreaming.rst | 69 ++ docs/features/reverseproxy.rst | 57 + docs/features/serverreplay.rst | 39 + docs/features/setheaders.rst | 19 + docs/features/socksproxy.rst | 10 + docs/features/sticky.rst | 41 + docs/features/tcpproxy.rst | 31 + docs/features/upstreamcerts.rst | 23 + docs/features/upstreamproxy.rst | 12 + docs/howmitmproxy.rst | 239 +++++ docs/index.rst | 83 ++ docs/install.rst | 103 ++ docs/introduction.rst | 24 + docs/mitmdump.rst | 66 ++ docs/mitmproxy-docs.png | Bin 0 -> 21323 bytes docs/mitmproxy-long.png | Bin 0 -> 123829 bytes docs/mitmproxy.rst | 126 +++ docs/modes.rst | 193 ++++ docs/schematics/_explicit.graffle/data.plist | 572 ++++++++++ docs/schematics/_explicit.graffle/image3.icns | Bin 0 -> 97327 bytes docs/schematics/_explicit.graffle/image6.tiff | Bin 0 -> 5075704 bytes docs/schematics/_explicit_https.graffle/data.plist | 1054 +++++++++++++++++++ .../schematics/_explicit_https.graffle/image3.icns | Bin 0 -> 97327 bytes .../schematics/_explicit_https.graffle/image6.tiff | Bin 0 -> 5075704 bytes docs/schematics/_transparent.graffle/data.plist | 771 ++++++++++++++ docs/schematics/_transparent.graffle/image3.icns | Bin 0 -> 97327 bytes docs/schematics/_transparent.graffle/image6.tiff | Bin 0 -> 5075704 bytes .../_transparent_https.graffle/data.plist | 1096 ++++++++++++++++++++ .../_transparent_https.graffle/image3.icns | Bin 0 -> 97327 bytes .../_transparent_https.graffle/image6.tiff | Bin 0 -> 5075704 bytes docs/schematics/architecture.pdf | Bin 0 -> 182446 bytes docs/schematics/architecture.png | Bin 0 -> 87365 bytes docs/schematics/architecture.vsdx | Bin 0 -> 60922 bytes .../how-mitmproxy-works-explicit-https.png | Bin 0 -> 78951 bytes docs/schematics/how-mitmproxy-works-explicit.png | Bin 0 -> 65305 bytes .../how-mitmproxy-works-transparent-https.png | Bin 0 -> 79758 bytes .../schematics/how-mitmproxy-works-transparent.png | Bin 0 -> 69375 bytes docs/schematics/proxy-modes-flowchart.png | Bin 0 -> 71622 bytes docs/schematics/proxy-modes-regular.png | Bin 0 -> 18283 bytes docs/schematics/proxy-modes-reverse.png | Bin 0 -> 16719 bytes docs/schematics/proxy-modes-transparent-1.png | Bin 0 -> 14558 bytes docs/schematics/proxy-modes-transparent-2.png | Bin 0 -> 23375 bytes docs/schematics/proxy-modes-transparent-3.png | Bin 0 -> 23855 bytes docs/schematics/proxy-modes-transparent-wrong.png | Bin 0 -> 14719 bytes docs/schematics/proxy-modes-upstream.png | Bin 0 -> 14781 bytes docs/schematics/proxy-modes.pdf | Bin 0 -> 335485 bytes docs/schematics/proxy-modes.vsdx | Bin 0 -> 191464 bytes docs/screenshots/firefox3-import.jpg | Bin 0 -> 55496 bytes docs/screenshots/firefox3-trust.jpg | Bin 0 -> 31495 bytes docs/screenshots/firefox3.jpg | Bin 0 -> 57366 bytes docs/screenshots/ios-gateway.png | Bin 0 -> 154469 bytes docs/screenshots/ios-installed.png | Bin 0 -> 80251 bytes docs/screenshots/ios-manual.png | Bin 0 -> 196431 bytes docs/screenshots/ios-profile.png | Bin 0 -> 83364 bytes docs/screenshots/ios-reverse.png | Bin 0 -> 66150 bytes docs/screenshots/ios-warning.png | Bin 0 -> 75604 bytes docs/screenshots/mitmproxy-flowview.png | Bin 0 -> 315864 bytes docs/screenshots/mitmproxy-intercept-filt.png | Bin 0 -> 18332 bytes docs/screenshots/mitmproxy-intercept-mid.png | Bin 0 -> 19841 bytes docs/screenshots/mitmproxy-intercept-options.png | Bin 0 -> 41281 bytes docs/screenshots/mitmproxy-intercept-result.png | Bin 0 -> 22855 bytes docs/screenshots/mitmproxy-kveditor-editmode.png | Bin 0 -> 44528 bytes docs/screenshots/mitmproxy-kveditor.png | Bin 0 -> 44852 bytes docs/screenshots/mitmproxy.png | Bin 0 -> 152596 bytes docs/screenshots/osx-addcert-alwaystrust.png | Bin 0 -> 47146 bytes docs/screenshots/win7-certstore-trustedroot.png | Bin 0 -> 39236 bytes docs/screenshots/win7-certstore.png | Bin 0 -> 37453 bytes docs/screenshots/win7-wizard.png | Bin 0 -> 66456 bytes docs/screenshots/winpythoninstaller.jpg | Bin 0 -> 46628 bytes docs/scripting/inlinescripts.rst | 231 +++++ docs/scripting/mitmproxy.rst | 27 + docs/transparent.rst | 24 + docs/transparent/linux.rst | 45 + docs/transparent/osx.rst | 70 ++ docs/tutorials/30second.rst | 66 ++ docs/tutorials/gamecenter.rst | 128 +++ docs/tutorials/leaderboard.png | Bin 0 -> 448368 bytes docs/tutorials/one.png | Bin 0 -> 141443 bytes docs/tutorials/supermega.png | Bin 0 -> 92889 bytes docs/tutorials/transparent-dhcp.rst | 89 ++ docs/tutorials/transparent-dhcp/step1_proxy.png | Bin 0 -> 246413 bytes .../tutorials/transparent-dhcp/step1_vbox_eth0.png | Bin 0 -> 28237 bytes .../tutorials/transparent-dhcp/step1_vbox_eth1.png | Bin 0 -> 28765 bytes .../transparent-dhcp/step2_proxied_vm.png | Bin 0 -> 36775 bytes examples/README | 30 + examples/add_header.py | 2 + examples/change_upstream_proxy.py | 24 + examples/custom_contentviews.py | 68 ++ examples/dns_spoofing.py | 50 + examples/dup_and_replay.py | 4 + examples/filt.py | 16 + examples/flowbasic | 44 + examples/flowwriter.py | 20 + examples/har_extractor.py | 253 +++++ examples/iframe_injector.py | 27 + examples/mitmproxywrapper.py | 166 +++ examples/modify_form.py | 5 + examples/modify_querystring.py | 6 + examples/modify_response_body.py | 18 + examples/nonblocking.py | 9 + examples/proxapp.py | 24 + examples/read_dumpfile | 20 + examples/redirect_requests.py | 22 + examples/sslstrip.py | 40 + examples/stickycookies | 42 + examples/stream.py | 5 + examples/stream_modify.py | 20 + examples/stub.py | 79 ++ examples/tcp_message.py | 24 + examples/tls_passthrough.py | 136 +++ examples/upsidedownternet.py | 17 + mitmproxy/docs/.gitignore | 1 - mitmproxy/docs/Makefile | 195 ---- mitmproxy/docs/_templates/page.html | 10 - mitmproxy/docs/certinstall-webapp.png | Bin 61683 -> 0 bytes mitmproxy/docs/certinstall.rst | 195 ---- mitmproxy/docs/conf.py | 219 ---- mitmproxy/docs/config.rst | 86 -- mitmproxy/docs/custom-routing.txt | 24 - mitmproxy/docs/dev/addingviews.html | 52 - mitmproxy/docs/dev/architecture.rst | 14 - mitmproxy/docs/dev/exceptions.rst | 9 - mitmproxy/docs/dev/models.rst | 59 -- mitmproxy/docs/dev/protocols.rst | 15 - mitmproxy/docs/dev/proxy.rst | 12 - mitmproxy/docs/dev/sslkeylogfile.rst | 14 - mitmproxy/docs/dev/testing.rst | 47 - mitmproxy/docs/favicon.ico | Bin 5430 -> 0 bytes mitmproxy/docs/features/anticache.rst | 15 - mitmproxy/docs/features/clientreplay.rst | 18 - mitmproxy/docs/features/filters.rst | 39 - mitmproxy/docs/features/passthrough.rst | 97 -- mitmproxy/docs/features/proxyauth.rst | 17 - mitmproxy/docs/features/replacements.rst | 72 -- mitmproxy/docs/features/responsestreaming.rst | 69 -- mitmproxy/docs/features/reverseproxy.rst | 57 - mitmproxy/docs/features/serverreplay.rst | 39 - mitmproxy/docs/features/setheaders.rst | 19 - mitmproxy/docs/features/socksproxy.rst | 10 - mitmproxy/docs/features/sticky.rst | 41 - mitmproxy/docs/features/tcpproxy.rst | 31 - mitmproxy/docs/features/upstreamcerts.rst | 23 - mitmproxy/docs/features/upstreamproxy.rst | 12 - mitmproxy/docs/howmitmproxy.rst | 239 ----- mitmproxy/docs/index.rst | 83 -- mitmproxy/docs/install.rst | 103 -- mitmproxy/docs/introduction.rst | 24 - mitmproxy/docs/mitmdump.rst | 66 -- mitmproxy/docs/mitmproxy-docs.png | Bin 21323 -> 0 bytes mitmproxy/docs/mitmproxy-long.png | Bin 123829 -> 0 bytes mitmproxy/docs/mitmproxy.rst | 126 --- mitmproxy/docs/modes.rst | 193 ---- .../docs/schematics/_explicit.graffle/data.plist | 572 ---------- .../docs/schematics/_explicit.graffle/image3.icns | Bin 97327 -> 0 bytes .../docs/schematics/_explicit.graffle/image6.tiff | Bin 5075704 -> 0 bytes .../schematics/_explicit_https.graffle/data.plist | 1054 ------------------- .../schematics/_explicit_https.graffle/image3.icns | Bin 97327 -> 0 bytes .../schematics/_explicit_https.graffle/image6.tiff | Bin 5075704 -> 0 bytes .../schematics/_transparent.graffle/data.plist | 771 -------------- .../schematics/_transparent.graffle/image3.icns | Bin 97327 -> 0 bytes .../schematics/_transparent.graffle/image6.tiff | Bin 5075704 -> 0 bytes .../_transparent_https.graffle/data.plist | 1096 -------------------- .../_transparent_https.graffle/image3.icns | Bin 97327 -> 0 bytes .../_transparent_https.graffle/image6.tiff | Bin 5075704 -> 0 bytes mitmproxy/docs/schematics/architecture.pdf | Bin 182446 -> 0 bytes mitmproxy/docs/schematics/architecture.png | Bin 87365 -> 0 bytes mitmproxy/docs/schematics/architecture.vsdx | Bin 60922 -> 0 bytes .../how-mitmproxy-works-explicit-https.png | Bin 78951 -> 0 bytes .../schematics/how-mitmproxy-works-explicit.png | Bin 65305 -> 0 bytes .../how-mitmproxy-works-transparent-https.png | Bin 79758 -> 0 bytes .../schematics/how-mitmproxy-works-transparent.png | Bin 69375 -> 0 bytes .../docs/schematics/proxy-modes-flowchart.png | Bin 71622 -> 0 bytes mitmproxy/docs/schematics/proxy-modes-regular.png | Bin 18283 -> 0 bytes mitmproxy/docs/schematics/proxy-modes-reverse.png | Bin 16719 -> 0 bytes .../docs/schematics/proxy-modes-transparent-1.png | Bin 14558 -> 0 bytes .../docs/schematics/proxy-modes-transparent-2.png | Bin 23375 -> 0 bytes .../docs/schematics/proxy-modes-transparent-3.png | Bin 23855 -> 0 bytes .../schematics/proxy-modes-transparent-wrong.png | Bin 14719 -> 0 bytes mitmproxy/docs/schematics/proxy-modes-upstream.png | Bin 14781 -> 0 bytes mitmproxy/docs/schematics/proxy-modes.pdf | Bin 335485 -> 0 bytes mitmproxy/docs/schematics/proxy-modes.vsdx | Bin 191464 -> 0 bytes mitmproxy/docs/screenshots/firefox3-import.jpg | Bin 55496 -> 0 bytes mitmproxy/docs/screenshots/firefox3-trust.jpg | Bin 31495 -> 0 bytes mitmproxy/docs/screenshots/firefox3.jpg | Bin 57366 -> 0 bytes mitmproxy/docs/screenshots/ios-gateway.png | Bin 154469 -> 0 bytes mitmproxy/docs/screenshots/ios-installed.png | Bin 80251 -> 0 bytes mitmproxy/docs/screenshots/ios-manual.png | Bin 196431 -> 0 bytes mitmproxy/docs/screenshots/ios-profile.png | Bin 83364 -> 0 bytes mitmproxy/docs/screenshots/ios-reverse.png | Bin 66150 -> 0 bytes mitmproxy/docs/screenshots/ios-warning.png | Bin 75604 -> 0 bytes mitmproxy/docs/screenshots/mitmproxy-flowview.png | Bin 315864 -> 0 bytes .../docs/screenshots/mitmproxy-intercept-filt.png | Bin 18332 -> 0 bytes .../docs/screenshots/mitmproxy-intercept-mid.png | Bin 19841 -> 0 bytes .../screenshots/mitmproxy-intercept-options.png | Bin 41281 -> 0 bytes .../screenshots/mitmproxy-intercept-result.png | Bin 22855 -> 0 bytes .../screenshots/mitmproxy-kveditor-editmode.png | Bin 44528 -> 0 bytes mitmproxy/docs/screenshots/mitmproxy-kveditor.png | Bin 44852 -> 0 bytes mitmproxy/docs/screenshots/mitmproxy.png | Bin 152596 -> 0 bytes .../docs/screenshots/osx-addcert-alwaystrust.png | Bin 47146 -> 0 bytes .../screenshots/win7-certstore-trustedroot.png | Bin 39236 -> 0 bytes mitmproxy/docs/screenshots/win7-certstore.png | Bin 37453 -> 0 bytes mitmproxy/docs/screenshots/win7-wizard.png | Bin 66456 -> 0 bytes mitmproxy/docs/screenshots/winpythoninstaller.jpg | Bin 46628 -> 0 bytes mitmproxy/docs/scripting/inlinescripts.rst | 231 ----- mitmproxy/docs/scripting/mitmproxy.rst | 27 - mitmproxy/docs/transparent.rst | 24 - mitmproxy/docs/transparent/linux.rst | 45 - mitmproxy/docs/transparent/osx.rst | 70 -- mitmproxy/docs/tutorials/30second.rst | 66 -- mitmproxy/docs/tutorials/gamecenter.rst | 128 --- mitmproxy/docs/tutorials/leaderboard.png | Bin 448368 -> 0 bytes mitmproxy/docs/tutorials/one.png | Bin 141443 -> 0 bytes mitmproxy/docs/tutorials/supermega.png | Bin 92889 -> 0 bytes mitmproxy/docs/tutorials/transparent-dhcp.rst | 89 -- .../tutorials/transparent-dhcp/step1_proxy.png | Bin 246413 -> 0 bytes .../tutorials/transparent-dhcp/step1_vbox_eth0.png | Bin 28237 -> 0 bytes .../tutorials/transparent-dhcp/step1_vbox_eth1.png | Bin 28765 -> 0 bytes .../transparent-dhcp/step2_proxied_vm.png | Bin 36775 -> 0 bytes mitmproxy/examples/README | 30 - mitmproxy/examples/add_header.py | 2 - mitmproxy/examples/change_upstream_proxy.py | 24 - mitmproxy/examples/custom_contentviews.py | 68 -- mitmproxy/examples/dns_spoofing.py | 50 - mitmproxy/examples/dup_and_replay.py | 4 - mitmproxy/examples/filt.py | 16 - mitmproxy/examples/flowbasic | 44 - mitmproxy/examples/flowwriter.py | 20 - mitmproxy/examples/har_extractor.py | 253 ----- mitmproxy/examples/iframe_injector.py | 27 - mitmproxy/examples/mitmproxywrapper.py | 166 --- mitmproxy/examples/modify_form.py | 5 - mitmproxy/examples/modify_querystring.py | 6 - mitmproxy/examples/modify_response_body.py | 18 - mitmproxy/examples/nonblocking.py | 9 - mitmproxy/examples/proxapp.py | 24 - mitmproxy/examples/read_dumpfile | 20 - mitmproxy/examples/redirect_requests.py | 22 - mitmproxy/examples/sslstrip.py | 40 - mitmproxy/examples/stickycookies | 42 - mitmproxy/examples/stream.py | 5 - mitmproxy/examples/stream_modify.py | 20 - mitmproxy/examples/stub.py | 79 -- mitmproxy/examples/tcp_message.py | 24 - mitmproxy/examples/tls_passthrough.py | 136 --- mitmproxy/examples/upsidedownternet.py | 17 - test/mitmproxy/test_examples.py | 2 +- 271 files changed, 7693 insertions(+), 7693 deletions(-) create mode 100644 docs/.gitignore create mode 100644 docs/Makefile create mode 100644 docs/_templates/page.html create mode 100644 docs/certinstall-webapp.png create mode 100644 docs/certinstall.rst create mode 100644 docs/conf.py create mode 100644 docs/config.rst create mode 100644 docs/custom-routing.txt create mode 100644 docs/dev/addingviews.html create mode 100644 docs/dev/architecture.rst create mode 100644 docs/dev/exceptions.rst create mode 100644 docs/dev/models.rst create mode 100644 docs/dev/protocols.rst create mode 100644 docs/dev/proxy.rst create mode 100644 docs/dev/sslkeylogfile.rst create mode 100644 docs/dev/testing.rst create mode 100644 docs/favicon.ico create mode 100644 docs/features/anticache.rst create mode 100644 docs/features/clientreplay.rst create mode 100644 docs/features/filters.rst create mode 100644 docs/features/passthrough.rst create mode 100644 docs/features/proxyauth.rst create mode 100644 docs/features/replacements.rst create mode 100644 docs/features/responsestreaming.rst create mode 100644 docs/features/reverseproxy.rst create mode 100644 docs/features/serverreplay.rst create mode 100644 docs/features/setheaders.rst create mode 100644 docs/features/socksproxy.rst create mode 100644 docs/features/sticky.rst create mode 100644 docs/features/tcpproxy.rst create mode 100644 docs/features/upstreamcerts.rst create mode 100644 docs/features/upstreamproxy.rst create mode 100644 docs/howmitmproxy.rst create mode 100644 docs/index.rst create mode 100644 docs/install.rst create mode 100644 docs/introduction.rst create mode 100644 docs/mitmdump.rst create mode 100644 docs/mitmproxy-docs.png create mode 100644 docs/mitmproxy-long.png create mode 100644 docs/mitmproxy.rst create mode 100644 docs/modes.rst create mode 100644 docs/schematics/_explicit.graffle/data.plist create mode 100644 docs/schematics/_explicit.graffle/image3.icns create mode 100644 docs/schematics/_explicit.graffle/image6.tiff create mode 100644 docs/schematics/_explicit_https.graffle/data.plist create mode 100644 docs/schematics/_explicit_https.graffle/image3.icns create mode 100644 docs/schematics/_explicit_https.graffle/image6.tiff create mode 100644 docs/schematics/_transparent.graffle/data.plist create mode 100644 docs/schematics/_transparent.graffle/image3.icns create mode 100644 docs/schematics/_transparent.graffle/image6.tiff create mode 100644 docs/schematics/_transparent_https.graffle/data.plist create mode 100644 docs/schematics/_transparent_https.graffle/image3.icns create mode 100644 docs/schematics/_transparent_https.graffle/image6.tiff create mode 100644 docs/schematics/architecture.pdf create mode 100644 docs/schematics/architecture.png create mode 100644 docs/schematics/architecture.vsdx create mode 100644 docs/schematics/how-mitmproxy-works-explicit-https.png create mode 100644 docs/schematics/how-mitmproxy-works-explicit.png create mode 100644 docs/schematics/how-mitmproxy-works-transparent-https.png create mode 100644 docs/schematics/how-mitmproxy-works-transparent.png create mode 100644 docs/schematics/proxy-modes-flowchart.png create mode 100644 docs/schematics/proxy-modes-regular.png create mode 100644 docs/schematics/proxy-modes-reverse.png create mode 100644 docs/schematics/proxy-modes-transparent-1.png create mode 100644 docs/schematics/proxy-modes-transparent-2.png create mode 100644 docs/schematics/proxy-modes-transparent-3.png create mode 100644 docs/schematics/proxy-modes-transparent-wrong.png create mode 100644 docs/schematics/proxy-modes-upstream.png create mode 100644 docs/schematics/proxy-modes.pdf create mode 100644 docs/schematics/proxy-modes.vsdx create mode 100644 docs/screenshots/firefox3-import.jpg create mode 100644 docs/screenshots/firefox3-trust.jpg create mode 100644 docs/screenshots/firefox3.jpg create mode 100644 docs/screenshots/ios-gateway.png create mode 100644 docs/screenshots/ios-installed.png create mode 100644 docs/screenshots/ios-manual.png create mode 100644 docs/screenshots/ios-profile.png create mode 100644 docs/screenshots/ios-reverse.png create mode 100644 docs/screenshots/ios-warning.png create mode 100644 docs/screenshots/mitmproxy-flowview.png create mode 100644 docs/screenshots/mitmproxy-intercept-filt.png create mode 100644 docs/screenshots/mitmproxy-intercept-mid.png create mode 100644 docs/screenshots/mitmproxy-intercept-options.png create mode 100644 docs/screenshots/mitmproxy-intercept-result.png create mode 100644 docs/screenshots/mitmproxy-kveditor-editmode.png create mode 100644 docs/screenshots/mitmproxy-kveditor.png create mode 100644 docs/screenshots/mitmproxy.png create mode 100644 docs/screenshots/osx-addcert-alwaystrust.png create mode 100644 docs/screenshots/win7-certstore-trustedroot.png create mode 100644 docs/screenshots/win7-certstore.png create mode 100644 docs/screenshots/win7-wizard.png create mode 100644 docs/screenshots/winpythoninstaller.jpg create mode 100644 docs/scripting/inlinescripts.rst create mode 100644 docs/scripting/mitmproxy.rst create mode 100644 docs/transparent.rst create mode 100644 docs/transparent/linux.rst create mode 100644 docs/transparent/osx.rst create mode 100644 docs/tutorials/30second.rst create mode 100644 docs/tutorials/gamecenter.rst create mode 100644 docs/tutorials/leaderboard.png create mode 100644 docs/tutorials/one.png create mode 100644 docs/tutorials/supermega.png create mode 100644 docs/tutorials/transparent-dhcp.rst create mode 100644 docs/tutorials/transparent-dhcp/step1_proxy.png create mode 100644 docs/tutorials/transparent-dhcp/step1_vbox_eth0.png create mode 100644 docs/tutorials/transparent-dhcp/step1_vbox_eth1.png create mode 100644 docs/tutorials/transparent-dhcp/step2_proxied_vm.png create mode 100644 examples/README create mode 100644 examples/add_header.py create mode 100644 examples/change_upstream_proxy.py create mode 100644 examples/custom_contentviews.py create mode 100644 examples/dns_spoofing.py create mode 100644 examples/dup_and_replay.py create mode 100644 examples/filt.py create mode 100644 examples/flowbasic create mode 100644 examples/flowwriter.py create mode 100644 examples/har_extractor.py create mode 100644 examples/iframe_injector.py create mode 100644 examples/mitmproxywrapper.py create mode 100644 examples/modify_form.py create mode 100644 examples/modify_querystring.py create mode 100644 examples/modify_response_body.py create mode 100644 examples/nonblocking.py create mode 100644 examples/proxapp.py create mode 100644 examples/read_dumpfile create mode 100644 examples/redirect_requests.py create mode 100644 examples/sslstrip.py create mode 100644 examples/stickycookies create mode 100644 examples/stream.py create mode 100644 examples/stream_modify.py create mode 100644 examples/stub.py create mode 100644 examples/tcp_message.py create mode 100644 examples/tls_passthrough.py create mode 100644 examples/upsidedownternet.py delete mode 100644 mitmproxy/docs/.gitignore delete mode 100644 mitmproxy/docs/Makefile delete mode 100644 mitmproxy/docs/_templates/page.html delete mode 100644 mitmproxy/docs/certinstall-webapp.png delete mode 100644 mitmproxy/docs/certinstall.rst delete mode 100644 mitmproxy/docs/conf.py delete mode 100644 mitmproxy/docs/config.rst delete mode 100644 mitmproxy/docs/custom-routing.txt delete mode 100644 mitmproxy/docs/dev/addingviews.html delete mode 100644 mitmproxy/docs/dev/architecture.rst delete mode 100644 mitmproxy/docs/dev/exceptions.rst delete mode 100644 mitmproxy/docs/dev/models.rst delete mode 100644 mitmproxy/docs/dev/protocols.rst delete mode 100644 mitmproxy/docs/dev/proxy.rst delete mode 100644 mitmproxy/docs/dev/sslkeylogfile.rst delete mode 100644 mitmproxy/docs/dev/testing.rst delete mode 100644 mitmproxy/docs/favicon.ico delete mode 100644 mitmproxy/docs/features/anticache.rst delete mode 100644 mitmproxy/docs/features/clientreplay.rst delete mode 100644 mitmproxy/docs/features/filters.rst delete mode 100644 mitmproxy/docs/features/passthrough.rst delete mode 100644 mitmproxy/docs/features/proxyauth.rst delete mode 100644 mitmproxy/docs/features/replacements.rst delete mode 100644 mitmproxy/docs/features/responsestreaming.rst delete mode 100644 mitmproxy/docs/features/reverseproxy.rst delete mode 100644 mitmproxy/docs/features/serverreplay.rst delete mode 100644 mitmproxy/docs/features/setheaders.rst delete mode 100644 mitmproxy/docs/features/socksproxy.rst delete mode 100644 mitmproxy/docs/features/sticky.rst delete mode 100644 mitmproxy/docs/features/tcpproxy.rst delete mode 100644 mitmproxy/docs/features/upstreamcerts.rst delete mode 100644 mitmproxy/docs/features/upstreamproxy.rst delete mode 100644 mitmproxy/docs/howmitmproxy.rst delete mode 100644 mitmproxy/docs/index.rst delete mode 100644 mitmproxy/docs/install.rst delete mode 100644 mitmproxy/docs/introduction.rst delete mode 100644 mitmproxy/docs/mitmdump.rst delete mode 100644 mitmproxy/docs/mitmproxy-docs.png delete mode 100644 mitmproxy/docs/mitmproxy-long.png delete mode 100644 mitmproxy/docs/mitmproxy.rst delete mode 100644 mitmproxy/docs/modes.rst delete mode 100644 mitmproxy/docs/schematics/_explicit.graffle/data.plist delete mode 100644 mitmproxy/docs/schematics/_explicit.graffle/image3.icns delete mode 100644 mitmproxy/docs/schematics/_explicit.graffle/image6.tiff delete mode 100644 mitmproxy/docs/schematics/_explicit_https.graffle/data.plist delete mode 100644 mitmproxy/docs/schematics/_explicit_https.graffle/image3.icns delete mode 100644 mitmproxy/docs/schematics/_explicit_https.graffle/image6.tiff delete mode 100644 mitmproxy/docs/schematics/_transparent.graffle/data.plist delete mode 100644 mitmproxy/docs/schematics/_transparent.graffle/image3.icns delete mode 100644 mitmproxy/docs/schematics/_transparent.graffle/image6.tiff delete mode 100644 mitmproxy/docs/schematics/_transparent_https.graffle/data.plist delete mode 100644 mitmproxy/docs/schematics/_transparent_https.graffle/image3.icns delete mode 100644 mitmproxy/docs/schematics/_transparent_https.graffle/image6.tiff delete mode 100644 mitmproxy/docs/schematics/architecture.pdf delete mode 100644 mitmproxy/docs/schematics/architecture.png delete mode 100644 mitmproxy/docs/schematics/architecture.vsdx delete mode 100644 mitmproxy/docs/schematics/how-mitmproxy-works-explicit-https.png delete mode 100644 mitmproxy/docs/schematics/how-mitmproxy-works-explicit.png delete mode 100644 mitmproxy/docs/schematics/how-mitmproxy-works-transparent-https.png delete mode 100644 mitmproxy/docs/schematics/how-mitmproxy-works-transparent.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-flowchart.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-regular.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-reverse.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-transparent-1.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-transparent-2.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-transparent-3.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-transparent-wrong.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes-upstream.png delete mode 100644 mitmproxy/docs/schematics/proxy-modes.pdf delete mode 100644 mitmproxy/docs/schematics/proxy-modes.vsdx delete mode 100644 mitmproxy/docs/screenshots/firefox3-import.jpg delete mode 100644 mitmproxy/docs/screenshots/firefox3-trust.jpg delete mode 100644 mitmproxy/docs/screenshots/firefox3.jpg delete mode 100644 mitmproxy/docs/screenshots/ios-gateway.png delete mode 100644 mitmproxy/docs/screenshots/ios-installed.png delete mode 100644 mitmproxy/docs/screenshots/ios-manual.png delete mode 100644 mitmproxy/docs/screenshots/ios-profile.png delete mode 100644 mitmproxy/docs/screenshots/ios-reverse.png delete mode 100644 mitmproxy/docs/screenshots/ios-warning.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-flowview.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-intercept-filt.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-intercept-mid.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-intercept-options.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-intercept-result.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-kveditor-editmode.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy-kveditor.png delete mode 100644 mitmproxy/docs/screenshots/mitmproxy.png delete mode 100644 mitmproxy/docs/screenshots/osx-addcert-alwaystrust.png delete mode 100644 mitmproxy/docs/screenshots/win7-certstore-trustedroot.png delete mode 100644 mitmproxy/docs/screenshots/win7-certstore.png delete mode 100644 mitmproxy/docs/screenshots/win7-wizard.png delete mode 100644 mitmproxy/docs/screenshots/winpythoninstaller.jpg delete mode 100644 mitmproxy/docs/scripting/inlinescripts.rst delete mode 100644 mitmproxy/docs/scripting/mitmproxy.rst delete mode 100644 mitmproxy/docs/transparent.rst delete mode 100644 mitmproxy/docs/transparent/linux.rst delete mode 100644 mitmproxy/docs/transparent/osx.rst delete mode 100644 mitmproxy/docs/tutorials/30second.rst delete mode 100644 mitmproxy/docs/tutorials/gamecenter.rst delete mode 100644 mitmproxy/docs/tutorials/leaderboard.png delete mode 100644 mitmproxy/docs/tutorials/one.png delete mode 100644 mitmproxy/docs/tutorials/supermega.png delete mode 100644 mitmproxy/docs/tutorials/transparent-dhcp.rst delete mode 100644 mitmproxy/docs/tutorials/transparent-dhcp/step1_proxy.png delete mode 100644 mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png delete mode 100644 mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png delete mode 100644 mitmproxy/docs/tutorials/transparent-dhcp/step2_proxied_vm.png delete mode 100644 mitmproxy/examples/README delete mode 100644 mitmproxy/examples/add_header.py delete mode 100644 mitmproxy/examples/change_upstream_proxy.py delete mode 100644 mitmproxy/examples/custom_contentviews.py delete mode 100644 mitmproxy/examples/dns_spoofing.py delete mode 100644 mitmproxy/examples/dup_and_replay.py delete mode 100644 mitmproxy/examples/filt.py delete mode 100644 mitmproxy/examples/flowbasic delete mode 100644 mitmproxy/examples/flowwriter.py delete mode 100644 mitmproxy/examples/har_extractor.py delete mode 100644 mitmproxy/examples/iframe_injector.py delete mode 100644 mitmproxy/examples/mitmproxywrapper.py delete mode 100644 mitmproxy/examples/modify_form.py delete mode 100644 mitmproxy/examples/modify_querystring.py delete mode 100644 mitmproxy/examples/modify_response_body.py delete mode 100644 mitmproxy/examples/nonblocking.py delete mode 100644 mitmproxy/examples/proxapp.py delete mode 100644 mitmproxy/examples/read_dumpfile delete mode 100644 mitmproxy/examples/redirect_requests.py delete mode 100644 mitmproxy/examples/sslstrip.py delete mode 100644 mitmproxy/examples/stickycookies delete mode 100644 mitmproxy/examples/stream.py delete mode 100644 mitmproxy/examples/stream_modify.py delete mode 100644 mitmproxy/examples/stub.py delete mode 100644 mitmproxy/examples/tcp_message.py delete mode 100644 mitmproxy/examples/tls_passthrough.py delete mode 100644 mitmproxy/examples/upsidedownternet.py diff --git a/.landscape.yml b/.landscape.yml index 1cf78412..d4f32733 100644 --- a/.landscape.yml +++ b/.landscape.yml @@ -1,6 +1,6 @@ ignore-paths: - - mitmproxy/docs - - mitmproxy/examples + - docs + - examples - mitmproxy/mitmproxy/contrib - mitmproxy/web max-line-length: 140 diff --git a/.travis.yml b/.travis.yml index 06b31773..5804b5c7 100644 --- a/.travis.yml +++ b/.travis.yml @@ -25,7 +25,7 @@ matrix: env: SCOPE="netlib" NO_ALPN=1 - python: 2.7 env: DOCS=1 - script: 'cd mitmproxy/docs && make html' + script: 'cd docs && make html' allow_failures: - python: pypy diff --git a/docs/.gitignore b/docs/.gitignore new file mode 100644 index 00000000..69fa449d --- /dev/null +++ b/docs/.gitignore @@ -0,0 +1 @@ +_build/ diff --git a/docs/Makefile b/docs/Makefile new file mode 100644 index 00000000..74bcda53 --- /dev/null +++ b/docs/Makefile @@ -0,0 +1,195 @@ +# Makefile for Sphinx documentation +# + +# You can set these variables from the command line. +SPHINXOPTS = +SPHINXBUILD = sphinx-build +PAPER = +BUILDDIR = _build + +# User-friendly check for sphinx-build +ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1) +$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/) +endif + +# Internal variables. +PAPEROPT_a4 = -D latex_paper_size=a4 +PAPEROPT_letter = -D latex_paper_size=letter +ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . +# the i18n builder cannot share the environment and doctrees with the others +I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . + +.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext + +help: + @echo "Please use \`make ' where is one of" + @echo " html to make standalone HTML files" + @echo " dirhtml to make HTML files named index.html in directories" + @echo " singlehtml to make a single large HTML file" + @echo " pickle to make pickle files" + @echo " json to make JSON files" + @echo " htmlhelp to make HTML files and a HTML help project" + @echo " qthelp to make HTML files and a qthelp project" + @echo " applehelp to make an Apple Help Book" + @echo " devhelp to make HTML files and a Devhelp project" + @echo " epub to make an epub" + @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" + @echo " latexpdf to make LaTeX files and run them through pdflatex" + @echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx" + @echo " text to make text files" + @echo " man to make manual pages" + @echo " texinfo to make Texinfo files" + @echo " info to make Texinfo files and run them through makeinfo" + @echo " gettext to make PO message catalogs" + @echo " changes to make an overview of all changed/added/deprecated items" + @echo " xml to make Docutils-native XML files" + @echo " pseudoxml to make pseudoxml-XML files for display purposes" + @echo " linkcheck to check all external links for integrity" + @echo " doctest to run all doctests embedded in the documentation (if enabled)" + @echo " coverage to run coverage check of the documentation (if enabled)" + +clean: + rm -rf $(BUILDDIR)/* + +html: + $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html + @echo + @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." + +dirhtml: + $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml + @echo + @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." + +singlehtml: + $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml + @echo + @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml." + +pickle: + $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle + @echo + @echo "Build finished; now you can process the pickle files." + +json: + $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json + @echo + @echo "Build finished; now you can process the JSON files." + +htmlhelp: + $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp + @echo + @echo "Build finished; now you can run HTML Help Workshop with the" \ + ".hhp project file in $(BUILDDIR)/htmlhelp." + +qthelp: + $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp + @echo + @echo "Build finished; now you can run "qcollectiongenerator" with the" \ + ".qhcp project file in $(BUILDDIR)/qthelp, like this:" + @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/mitmproxy.qhcp" + @echo "To view the help file:" + @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/mitmproxy.qhc" + +applehelp: + $(SPHINXBUILD) -b applehelp $(ALLSPHINXOPTS) $(BUILDDIR)/applehelp + @echo + @echo "Build finished. The help book is in $(BUILDDIR)/applehelp." + @echo "N.B. You won't be able to view it unless you put it in" \ + "~/Library/Documentation/Help or install it in your application" \ + "bundle." + +devhelp: + $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp + @echo + @echo "Build finished." + @echo "To view the help file:" + @echo "# mkdir -p $$HOME/.local/share/devhelp/mitmproxy" + @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/mitmproxy" + @echo "# devhelp" + +epub: + $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub + @echo + @echo "Build finished. The epub file is in $(BUILDDIR)/epub." + +latex: + $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex + @echo + @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." + @echo "Run \`make' in that directory to run these through (pdf)latex" \ + "(use \`make latexpdf' here to do that automatically)." + +latexpdf: + $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex + @echo "Running LaTeX files through pdflatex..." + $(MAKE) -C $(BUILDDIR)/latex all-pdf + @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." + +latexpdfja: + $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex + @echo "Running LaTeX files through platex and dvipdfmx..." + $(MAKE) -C $(BUILDDIR)/latex all-pdf-ja + @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." + +text: + $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text + @echo + @echo "Build finished. The text files are in $(BUILDDIR)/text." + +man: + $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man + @echo + @echo "Build finished. The manual pages are in $(BUILDDIR)/man." + +texinfo: + $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo + @echo + @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo." + @echo "Run \`make' in that directory to run these through makeinfo" \ + "(use \`make info' here to do that automatically)." + +info: + $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo + @echo "Running Texinfo files through makeinfo..." + make -C $(BUILDDIR)/texinfo info + @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo." + +gettext: + $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale + @echo + @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale." + +changes: + $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes + @echo + @echo "The overview file is in $(BUILDDIR)/changes." + +linkcheck: + $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck + @echo + @echo "Link check complete; look for any errors in the above output " \ + "or in $(BUILDDIR)/linkcheck/output.txt." + +doctest: + $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest + @echo "Testing of doctests in the sources finished, look at the " \ + "results in $(BUILDDIR)/doctest/output.txt." + +coverage: + $(SPHINXBUILD) -b coverage $(ALLSPHINXOPTS) $(BUILDDIR)/coverage + @echo "Testing of coverage in the sources finished, look at the " \ + "results in $(BUILDDIR)/coverage/python.txt." + +xml: + $(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml + @echo + @echo "Build finished. The XML files are in $(BUILDDIR)/xml." + +pseudoxml: + $(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml + @echo + @echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml." + +livehtml: + sphinx-autobuild -b html -z '../mitmproxy' -z '../../netlib/netlib' -r '___jb_(old|bak)___$$' $(ALLSPHINXOPTS) $(BUILDDIR)/html \ No newline at end of file diff --git a/docs/_templates/page.html b/docs/_templates/page.html new file mode 100644 index 00000000..8002396a --- /dev/null +++ b/docs/_templates/page.html @@ -0,0 +1,10 @@ +{% extends "!page.html" %} +{% block sidebartitle %} + + + + {{ super() }} +{% endblock %} \ No newline at end of file diff --git a/docs/certinstall-webapp.png b/docs/certinstall-webapp.png new file mode 100644 index 00000000..10e795cd Binary files /dev/null and b/docs/certinstall-webapp.png differ diff --git a/docs/certinstall.rst b/docs/certinstall.rst new file mode 100644 index 00000000..5a8cce64 --- /dev/null +++ b/docs/certinstall.rst @@ -0,0 +1,195 @@ +.. _certinstall: + +About Certificates +================== + +Introduction +------------ + +Mitmproxy can decrypt encrypted traffic on the fly, as long as the client +trusts its built-in certificate authority. Usually this means that the +mitmproxy CA certificates have to be installed on the client device. + +Quick Setup +----------- + +By far the easiest way to install the mitmproxy certificates is to use the +built-in certificate installation app. To do this, just start mitmproxy and +configure your target device with the correct proxy settings. Now start a +browser on the device, and visit the magic domain **mitm.it**. You should see +something like this: + +.. image:: certinstall-webapp.png + +Click on the relevant icon, follow the setup instructions for the platform +you're on and you are good to go. + + +Installing the mitmproxy CA certificate manually +------------------------------------------------ + +Sometimes using the quick install app is not an option - Java or the iOS +Simulator spring to mind - or you just need to do it manually for some other +reason. Below is a list of pointers to manual certificate installation +documentation for some common platforms. + +The mitmproxy CA cert is located in ``~/.mitmproxy`` after it has been generated at the first +start of mitmproxy. + + +iOS +^^^ + +http://kb.mit.edu/confluence/pages/viewpage.action?pageId=152600377 + +iOS Simulator +^^^^^^^^^^^^^ + +See https://github.com/ADVTOOLS/ADVTrustStore#how-to-use-advtruststore + +Java +^^^^ + +See http://docs.oracle.com/cd/E19906-01/820-4916/geygn/index.html + +Android/Android Simulator +^^^^^^^^^^^^^^^^^^^^^^^^^ + +See http://wiki.cacert.org/FAQ/ImportRootCert#Android_Phones_.26_Tablets + +Windows +^^^^^^^ + +See http://windows.microsoft.com/en-ca/windows/import-export-certificates-private-keys#1TC=windows-7 + +Windows (automated) +^^^^^^^^^^^^^^^^^^^ + +>>> certutil.exe -importpfx mitmproxy-ca-cert.p12 + +See also: https://technet.microsoft.com/en-us/library/cc732443.aspx + +Mac OS X +^^^^^^^^ + +See https://support.apple.com/kb/PH7297?locale=en_US + +Ubuntu/Debian +^^^^^^^^^^^^^ + +See http://askubuntu.com/questions/73287/how-do-i-install-a-root-certificate/94861#94861 + +Mozilla Firefox +^^^^^^^^^^^^^^^ + +See https://wiki.mozilla.org/MozillaRootCertificate#Mozilla_Firefox + +Chrome on Linux +^^^^^^^^^^^^^^^ + +See https://code.google.com/p/chromium/wiki/LinuxCertManagement + + +The mitmproxy certificate authority +----------------------------------- + +The first time **mitmproxy** or **mitmdump** is run, the mitmproxy Certificate +Authority (CA) is created in the config directory (``~/.mitmproxy`` by default). +This CA is used for on-the-fly generation of dummy certificates for each of the +SSL sites that your client visits. Since your browser won't trust the +mitmproxy CA out of the box, you will see an SSL certificate warning every +time you visit a new SSL domain through mitmproxy. When you are testing a +single site through a browser, just accepting the bogus SSL cert manually is +not too much trouble, but there are a many circumstances where you will want to +configure your testing system or browser to trust the mitmproxy CA as a +signing root authority. For security reasons, the mitmproxy CA is generated uniquely on the first start and is not shared between mitmproxy installations on different devices. + +Certificate Pinning +^^^^^^^^^^^^^^^^^^^ + +Some applications employ `Certificate Pinning`_ to prevent man-in-the-middle attacks. +This means that **mitmproxy** and **mitmdump's** certificates will not be +accepted by these applications without modifying them. It is recommended to use the +:ref:`passthrough` feature in order to prevent **mitmproxy** and **mitmdump** from intercepting +traffic to these specific domains. If you want to intercept the pinned connections, you need to patch the application manually. For Android and (jailbroken) iOS devices, various tools exist to accomplish this. + + +CA and cert files +----------------- + +The files created by mitmproxy in the .mitmproxy directory are as follows: + +===================== ========================================================================== +mitmproxy-ca.pem The certificate **and the private key** in PEM format. +mitmproxy-ca-cert.pem The certificate in PEM format. + Use this to distribute on most non-Windows platforms. +mitmproxy-ca-cert.p12 The certificate in PKCS12 format. For use on Windows. +mitmproxy-ca-cert.cer Same file as .pem, but with an extension expected by some Android devices. +===================== ========================================================================== + +Using a custom certificate +-------------------------- + +You can use your own certificate by passing the ``--cert`` option to +mitmproxy. Mitmproxy then uses the provided certificate for interception of the +specified domains instead of generating a certificate signed by its own CA. + +The certificate file is expected to be in the PEM format. You can include +intermediary certificates right below your leaf certificate, so that you PEM +file roughly looks like this: + +.. code-block:: none + + -----BEGIN PRIVATE KEY----- + + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + + -----END CERTIFICATE----- + + +For example, you can generate a certificate in this format using these instructions: + + +>>> openssl genrsa -out cert.key 2048 +>>> openssl req -new -x509 -key cert.key -out cert.crt + (Specify the mitm domain as Common Name, e.g. *.google.com) +>>> cat cert.key cert.crt > cert.pem +>>> mitmproxy --cert=cert.pem + + +Using a custom certificate authority +------------------------------------ + +By default, mitmproxy will use ``~/.mitmproxy/mitmproxy-ca.pem`` as +the certificate authority to generate certificates for all domains for which no +custom certificate is provided (see above). You can use your own certificate +authority by passing the ``--cadir DIRECTORY`` option to mitmproxy. Mitmproxy +will then look for ``mitmproxy-ca.pem`` in the specified directory. If +no such file exists, it will be generated automatically. + + +Using a client side certificate +------------------------------- + +You can use a client certificate by passing the ``--client-certs DIRECTORY|FILE`` +option to mitmproxy. Using a directory allows certs to be selected based on +hostname, while using a filename allows a single specific certificate to be used for +all SSL connections. Certificate files must be in the PEM format and should +contain both the unencrypted private key and the certificate. + +Multiple certs by Hostname +^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If you've specified a directory to ``--client-certs``, then the following +behavior will be taken: + +If you visit example.org, mitmproxy looks for a file named ``example.org.pem`` in the specified +directory and uses this as the client cert. + + + +.. _Certificate Pinning: http://security.stackexchange.com/questions/29988/what-is-certificate-pinning/ \ No newline at end of file diff --git a/docs/conf.py b/docs/conf.py new file mode 100644 index 00000000..01bcce1b --- /dev/null +++ b/docs/conf.py @@ -0,0 +1,219 @@ +# -*- coding: utf-8 -*- +# +# mitmproxy documentation build configuration file, created by +# sphinx-quickstart on Thu Sep 03 14:04:13 2015. +# +# This file is execfile()d with the current directory set to its +# containing dir. +# +# Note that not all possible configuration values are present in this +# autogenerated file. +# +# All configuration values have a default; values that are commented out +# serve to show the default. + +import sys +import os +import shlex + +# If extensions (or modules to document with autodoc) are in another directory, +# add these directories to sys.path here. If the directory is relative to the +# documentation root, use os.path.abspath to make it absolute, like shown here. +sys.path.insert(0, os.path.abspath('..')) + +import mitmproxy.version + +# -- General configuration ------------------------------------------------ + +# If your documentation needs a minimal Sphinx version, state it here. +#needs_sphinx = '1.0' + +# Add any Sphinx extension module names here, as strings. They can be +# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom +# ones. + +extensions = [ + 'sphinx.ext.autodoc', + 'sphinx.ext.doctest', + 'sphinx.ext.viewcode', + 'sphinx.ext.napoleon', + 'sphinxcontrib.documentedlist' +] + +# https://github.com/sphinx-doc/sphinx/pull/2053 +napoleon_include_special_with_doc = False + +autodoc_member_order = "bysource" + +# Add any paths that contain templates here, relative to this directory. +templates_path = ['_templates'] + +# The suffix(es) of source filenames. +# You can specify multiple suffix as a list of string: +# source_suffix = ['.rst', '.md'] +source_suffix = '.rst' + +# The encoding of source files. +#source_encoding = 'utf-8-sig' + +# The master toctree document. +master_doc = 'index' + +# General information about the project. +project = u'mitmproxy docs' +copyright = u'2015, the mitmproxy project' +author = u'The mitmproxy project' + +# The version info for the project you're documenting, acts as replacement for +# |version| and |release|, also used in various other places throughout the +# built documents. +# +# The short X.Y version. +version = mitmproxy.version.VERSION +# The full version, including alpha/beta/rc tags. +release = mitmproxy.version.VERSION + +# The language for content autogenerated by Sphinx. Refer to documentation +# for a list of supported languages. +# +# This is also used if you do content translation via gettext catalogs. +# Usually you set "language" from the command line for these cases. +language = None + +# There are two options for replacing |today|: either, you set today to some +# non-false value, then it is used: +#today = '' +# Else, today_fmt is used as the format for a strftime call. +#today_fmt = '%B %d, %Y' + +# List of patterns, relative to source directory, that match files and +# directories to ignore when looking for source files. +exclude_patterns = ['_build'] + +# The reST default role (used for this markup: `text`) to use for all +# documents. +#default_role = None + +# If true, '()' will be appended to :func: etc. cross-reference text. +#add_function_parentheses = True + +# If true, the current module name will be prepended to all description +# unit titles (such as .. function::). +#add_module_names = True + +# If true, sectionauthor and moduleauthor directives will be shown in the +# output. They are ignored by default. +#show_authors = False + +# The name of the Pygments (syntax highlighting) style to use. +pygments_style = 'sphinx' + +# A list of ignored prefixes for module index sorting. +modindex_common_prefix = ['mitmproxy.'] + +# If true, keep warnings as "system message" paragraphs in the built documents. +#keep_warnings = False + +# If true, `todo` and `todoList` produce output, else they produce nothing. +todo_include_todos = False + + +# -- Options for HTML output ---------------------------------------------- + +# The theme to use for HTML and HTML Help pages. See the documentation for +# a list of builtin themes. +html_theme = 'sphinx_rtd_theme' + +# Theme options are theme-specific and customize the look and feel of a theme +# further. For a list of options available for each theme, see the +# documentation. +html_theme_options = { + 'logo_only': True, +} + +# Add any paths that contain custom themes here, relative to this directory. +#html_theme_path = [] + +# The name for this set of Sphinx documents. If None, it defaults to +# " v documentation". +html_title = "mitmproxy %s documentation" % version + +# A shorter title for the navigation bar. Default is the same as html_title. +#html_short_title = None + +# The name of an image file (relative to this directory) to place at the top +# of the sidebar. +html_logo = "mitmproxy-docs.png" + +# The name of an image file (within the static path) to use as favicon of the +# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 +# pixels large. +html_favicon = "favicon.ico" + +# Add any paths that contain custom static files (such as style sheets) here, +# relative to this directory. They are copied after the builtin static files, +# so a file named "default.css" will overwrite the builtin "default.css". +# html_static_path = ['_static'] + +# Add any extra paths that contain custom files (such as robots.txt or +# .htaccess) here, relative to this directory. These files are copied +# directly to the root of the documentation. +#html_extra_path = [] + +# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, +# using the given strftime format. +#html_last_updated_fmt = '%b %d, %Y' + +# If true, SmartyPants will be used to convert quotes and dashes to +# typographically correct entities. +#html_use_smartypants = True + +# Custom sidebar templates, maps document names to template names. +#html_sidebars = {} + +# Additional templates that should be rendered to pages, maps page names to +# template names. +#html_additional_pages = {} + +# If false, no module index is generated. +#html_domain_indices = True + +# If false, no index is generated. +#html_use_index = True + +# If true, the index is split into individual pages for each letter. +#html_split_index = False + +# If true, links to the reST sources are added to the pages. +#html_show_sourcelink = True + +# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. +#html_show_sphinx = True + +# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. +#html_show_copyright = True + +# If true, an OpenSearch description file will be output, and all pages will +# contain a tag referring to it. The value of this option must be the +# base URL from which the finished HTML is served. +#html_use_opensearch = '' + +# This is the file name suffix for HTML files (e.g. ".xhtml"). +#html_file_suffix = None + +# Language to be used for generating the HTML full-text search index. +# Sphinx supports the following languages: +# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' +# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' +#html_search_language = 'en' + +# A dictionary with options for the search language support, empty by default. +# Now only 'ja' uses this config value +#html_search_options = {'type': 'default'} + +# The name of a javascript file (relative to the configuration directory) that +# implements a search results scorer. If empty, the default will be used. +#html_search_scorer = 'scorer.js' + +# Output file base name for HTML help builder. +htmlhelp_basename = 'mitmproxydoc' \ No newline at end of file diff --git a/docs/config.rst b/docs/config.rst new file mode 100644 index 00000000..634b8703 --- /dev/null +++ b/docs/config.rst @@ -0,0 +1,86 @@ +.. _config: + +Configuration +============= + +Mitmproxy is configured through a set of files in the users ~/.mitmproxy +directory. + +mitmproxy.conf + Settings for the :program:`mitmproxy`. This file can contain any options supported by + mitmproxy. + +mitmdump.conf + Settings for the :program:`mitmdump`. This file can contain any options supported by mitmdump. + +common.conf + Settings shared between all command-line tools. Settings in this file are over-ridden by those + in the tool-specific files. Only options shared by mitmproxy and mitmdump should be used in + this file. + +Syntax +------ + +Comments +^^^^^^^^ + +.. code-block:: none + + # this is a comment + ; this is also a comment (.ini style) + --- and this is a comment too (yaml style) + +Key/Value pairs +^^^^^^^^^^^^^^^ + +- Keys and values are case-sensitive +- Whitespace is ignored +- Lists are comma-delimited, and enclosed in square brackets + +.. code-block:: none + + name = value # (.ini style) + name: value # (yaml style) + --name value # (command-line option style) + + fruit = [apple, orange, lemon] + indexes = [1, 12, 35 , 40] + +Flags +^^^^^ + +These are boolean options that take no value but true/false. + +.. code-block:: none + + name = true # (.ini style) + name + --name # (command-line option style) + +Options +------- + +The options available in the config files are precisely those available as +command-line flags, with the key being the option's long name. To get a +complete list of these, use the :option:`--help` option on each of the tools. Be +careful to only specify common options in the **common.conf** file - +unsupported options in this file will be detected as an error on startup. + +Examples +-------- + +common.conf +^^^^^^^^^^^ + +Note that :option:`--port` is an option supported by all tools. + +.. code-block:: none + + port = 8080 + +mitmproxy.conf +^^^^^^^^^^^^^^ + +.. code-block:: none + + palette = light diff --git a/docs/custom-routing.txt b/docs/custom-routing.txt new file mode 100644 index 00000000..2ba2281f --- /dev/null +++ b/docs/custom-routing.txt @@ -0,0 +1,24 @@ +# Adapted from http://tldp.org/HOWTO/TransparentProxy-6.html (6.2 Second method) +# Note that the choice of firewall mark (3) and routing table (2) was fairly arbitrary. +# If you are already using policy routing or firewall marking for some other purpose, +# make sure you choose unique numbers here. Otherwise, don't worry about it. + + + +# On the router, run + +PROXY_IP=192.168.1.100 +TARGET_IP=192.168.1.110 + +iptables -t mangle -A PREROUTING -j ACCEPT -p tcp -m multiport --dports 80,443 -s ! $TARGET_IP +# Alternative to MITM the whole network: +# iptables -t mangle -A PREROUTING -j ACCEPT -p tcp -m multiport --dports 80,443 -s $PROXY_IP +iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp -m multiport --dports 80,443 +ip rule add fwmark 3 table 2 +ip route add default via $PROXY_IP dev br0 table 2 + + + +# On the proxy machine, run + +iptables -A PREROUTING -t nat -i eth0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-port 8080 diff --git a/docs/dev/addingviews.html b/docs/dev/addingviews.html new file mode 100644 index 00000000..12623a31 --- /dev/null +++ b/docs/dev/addingviews.html @@ -0,0 +1,52 @@ +As discussed in [the Flow View section of the mitmproxy +overview](@!urlTo("mitmproxy.html")!@), mitmproxy allows you to inspect and +manipulate flows. When inspecting a single flow, mitmproxy uses a number of +heuristics to show a friendly view of various content types; if mitmproxy +cannot show a friendly view, mitmproxy defaults to a __raw__ view. + +Each content type invokes a different flow viewer to parse the data and display +the friendly view. Users can add custom content viewers by adding a view class +to contentview.py, discussed below. + +## Adding a new View class to contentview.py + +The content viewers used by mitmproxy to present a friendly view of various +content types are stored in contentview.py. Reviewing this file shows a number +of classes named ViewSomeDataType, each with the properties: __name__, +__prompt__, and __content\_types__ and a function named __\_\_call\_\___. + +Adding a new content viewer to parse a data type is as simple as writing a new +View class. Your new content viewer View class should have the same properties +as the other View classes: __name__, __prompt__, and __content\_types__ and a +__\_\_call\_\___ function to parse the content of the request/response. + +* The __name__ property should be a string describing the contents and new content viewer; +* The __prompt__ property should be a two item tuple: + + - __1__: A string that will be used to display the new content viewer's type; and + - __2__: A one character string that will be the hotkey used to select the new content viewer from the Flow View screen; + +* The __content\_types__ property should be a list of strings of HTTP Content\-Types that the new content viewer can parse. + * Note that mitmproxy will use the content\_types to try and heuristically show a friendly view of content and that you can override the built-in views by populating content\_types with values for content\_types that are already parsed -- e.g. "image/png". + +After defining the __name__, __prompt__, and __content\_types__ properties of +the class, you should write the __\_\_call\_\___ function, which will parse the +request/response data and provide a friendly view of the data. The +__\_\_call\_\___ function should take the following arguments: __self__, +__hdrs__, __content__, __limit__; __hdrs__ is a ODictCaseless object containing +the headers of the request/response; __content__ is the content of the +request/response, and __limit__ is an integer representing the amount of data +to display in the view window. + +The __\_\_call\_\___ function returns two values: (1) a string describing the +parsed data; and (2) the parsed data for friendly display. The parsed data to +be displayed should be a list of strings formatted for display. You can use +the __\_view\_text__ function in contentview.py to format text for display. +Alternatively, you can display content as a series of key-value pairs; to do +so, prepare a list of lists, where each list item is a two item list -- a key +that describes the data, and then the data itself; after preparing the list of +lists, use the __common.format\_keyvals__ function on it to prepare it as text +for display. + +If the new content viewer fails or throws an exception, mitmproxy will default +to a __raw__ view. diff --git a/docs/dev/architecture.rst b/docs/dev/architecture.rst new file mode 100644 index 00000000..e7995141 --- /dev/null +++ b/docs/dev/architecture.rst @@ -0,0 +1,14 @@ +.. _architecture: + +Architecture +============ + +To give you a better understanding of how mitmproxy works, mitmproxy's +high-level architecture is detailed in the following graphic: + +.. image:: ../schematics/architecture.png + +:download:`architecture.pdf <../schematics/architecture.pdf>` + +Please don't refrain from asking any further +questions on the mailing list, the Slack channel or the GitHub issue tracker. diff --git a/docs/dev/exceptions.rst b/docs/dev/exceptions.rst new file mode 100644 index 00000000..e890476b --- /dev/null +++ b/docs/dev/exceptions.rst @@ -0,0 +1,9 @@ +.. _exceptions: + +Exceptions +========== + +.. automodule:: mitmproxy.exceptions + :show-inheritance: + :members: + :undoc-members: diff --git a/docs/dev/models.rst b/docs/dev/models.rst new file mode 100644 index 00000000..7a949941 --- /dev/null +++ b/docs/dev/models.rst @@ -0,0 +1,59 @@ +.. _models: + +Models +====== + +.. automodule:: netlib.http + + .. autoclass:: Request + + .. rubric:: Data + .. autoattribute:: first_line_format + .. autoattribute:: method + .. autoattribute:: scheme + .. autoattribute:: host + .. autoattribute:: port + .. autoattribute:: path + .. autoattribute:: http_version + .. autoattribute:: headers + .. autoattribute:: content + .. autoattribute:: timestamp_start + .. autoattribute:: timestamp_end + .. rubric:: Computed Properties and Convenience Methods + .. autoattribute:: text + .. autoattribute:: url + .. autoattribute:: pretty_host + .. autoattribute:: pretty_url + .. autoattribute:: query + .. autoattribute:: cookies + .. autoattribute:: path_components + .. automethod:: anticache + .. automethod:: anticomp + .. automethod:: constrain_encoding + .. autoattribute:: urlencoded_form + .. autoattribute:: multipart_form + + .. autoclass:: Response + + .. rubric:: Data + .. autoattribute:: http_version + .. autoattribute:: status_code + .. autoattribute:: reason + .. autoattribute:: headers + .. autoattribute:: content + .. autoattribute:: timestamp_start + .. autoattribute:: timestamp_end + .. rubric:: Computed Properties and Convenience Methods + .. autoattribute:: text + .. autoattribute:: cookies + + .. autoclass:: Headers + :members: + :special-members: + :no-undoc-members: + + .. autoclass:: decoded + +.. automodule:: mitmproxy.models + :show-inheritance: + :members: HTTPFlow, Error, ClientConnection, ServerConnection \ No newline at end of file diff --git a/docs/dev/protocols.rst b/docs/dev/protocols.rst new file mode 100644 index 00000000..ceb5c2fd --- /dev/null +++ b/docs/dev/protocols.rst @@ -0,0 +1,15 @@ +.. _protocols: + +Protocols +========= + +.. automodule:: mitmproxy.protocol + + .. autoclass:: Layer + :members: + :special-members: + + .. autoclass:: ServerConnectionMixin + :members: + + .. autoexception:: Kill diff --git a/docs/dev/proxy.rst b/docs/dev/proxy.rst new file mode 100644 index 00000000..888fb946 --- /dev/null +++ b/docs/dev/proxy.rst @@ -0,0 +1,12 @@ +.. _proxy: + +Proxy Server +============ + +.. automodule:: mitmproxy.proxy + + .. autoclass:: ProxyServer + .. autoclass:: DummyServer + .. autoclass:: ProxyConfig + .. autoclass:: RootContext + :members: diff --git a/docs/dev/sslkeylogfile.rst b/docs/dev/sslkeylogfile.rst new file mode 100644 index 00000000..04b86cc4 --- /dev/null +++ b/docs/dev/sslkeylogfile.rst @@ -0,0 +1,14 @@ +.. _sslkeylogfile: + +TLS Master Secrets +================== + +The SSL master keys can be logged by mitmproxy so that external programs can decrypt TLS +connections both from and to the proxy. Key logging is enabled by setting the environment variable +:envvar:`SSLKEYLOGFILE` so that it points to a writable text file. +Recent versions of WireShark can use these log files to decrypt packets. +You can specify the key file path in WireShark via +:samp:`Edit -> Preferences -> Protocols -> SSL -> (Pre)-Master-Secret log filename`. + +Note that :envvar:`SSLKEYLOGFILE` is respected by other programs as well, e.g. Firefox and Chrome. +If this creates any issues, you can set :envvar:`MITMPROXY_SSLKEYLOGFILE` alternatively. diff --git a/docs/dev/testing.rst b/docs/dev/testing.rst new file mode 100644 index 00000000..e3b86bf3 --- /dev/null +++ b/docs/dev/testing.rst @@ -0,0 +1,47 @@ +.. _testing: + +Testing +======= + +All the mitmproxy projects strive to maintain 100% code coverage. In general, +patches and pull requests will be declined unless they're accompanied by a +suitable extension to the test suite. + +Our tests are written for the `py.test`_ or nose_ test frameworks. +At the point where you send your pull request, a command like this: + +>>> py.test -n 4 --cov mitmproxy + +Should give output something like this: + +.. code-block:: none + + > ---------- coverage: platform darwin, python 2.7.2-final-0 -- + > Name Stmts Miss Cover Missing + > ---------------------------------------------------- + > mitmproxy/__init__ 0 0 100% + > mitmproxy/app 4 0 100% + > mitmproxy/cmdline 100 0 100% + > mitmproxy/controller 69 0 100% + > mitmproxy/dump 150 0 100% + > mitmproxy/encoding 39 0 100% + > mitmproxy/filt 201 0 100% + > mitmproxy/flow 891 0 100% + > mitmproxy/proxy 427 0 100% + > mitmproxy/script 27 0 100% + > mitmproxy/utils 133 0 100% + > mitmproxy/version 4 0 100% + > ---------------------------------------------------- + > TOTAL 2045 0 100% + > ---------------------------------------------------- + > Ran 251 tests in 11.864s + + +There are exceptions to the coverage requirement - for instance, much of the +console interface code can't sensibly be unit tested. These portions are +excluded from coverage analysis either in the **.coveragerc** file, or using +**#pragma no-cover** directives. To keep our coverage analysis relevant, we use +these measures as sparingly as possible. + +.. _nose: https://nose.readthedocs.org/en/latest/ +.. _py.test: https://pytest.org/ diff --git a/docs/favicon.ico b/docs/favicon.ico new file mode 100644 index 00000000..3c3b891c Binary files /dev/null and b/docs/favicon.ico differ diff --git a/docs/features/anticache.rst b/docs/features/anticache.rst new file mode 100644 index 00000000..65d22bab --- /dev/null +++ b/docs/features/anticache.rst @@ -0,0 +1,15 @@ +.. _anticache: + +Anticache +========= +When the :option:`--anticache` option is passed to mitmproxy, it removes headers +(``if-none-match`` and ``if-modified-since``) that might elicit a +``304 not modified`` response from the server. This is useful when you want to make +sure you capture an HTTP exchange in its totality. It's also often used during +:ref:`clientreplay`, when you want to make sure the server responds with complete data. + + +================== ====================== +command-line :option:`--anticache` +mitmproxy shortcut :kbd:`o` then :kbd:`a` +================== ====================== diff --git a/docs/features/clientreplay.rst b/docs/features/clientreplay.rst new file mode 100644 index 00000000..b0eb6792 --- /dev/null +++ b/docs/features/clientreplay.rst @@ -0,0 +1,18 @@ +.. _clientreplay: + +Client-side replay +================== + +Client-side replay does what it says on the tin: you provide a previously saved +HTTP conversation, and mitmproxy replays the client requests one by one. Note +that mitmproxy serializes the requests, waiting for a response from the server +before starting the next request. This might differ from the recorded +conversation, where requests may have been made concurrently. + +You may want to use client-side replay in conjunction with the +:ref:`anticache` option, to make sure the server responds with complete data. + +================== ================= +command-line :option:`-c path` +mitmproxy shortcut :kbd:`c` +================== ================= diff --git a/docs/features/filters.rst b/docs/features/filters.rst new file mode 100644 index 00000000..509b5d6b --- /dev/null +++ b/docs/features/filters.rst @@ -0,0 +1,39 @@ +.. _filters: + +Filter expressions +================== + +Many commands in :program:`mitmproxy` and :program:`mitmdump` take a filter expression. +Filter expressions consist of the following operators: + +.. documentedlist:: + :header: "Expression" "Description" + :listobject: mitmproxy.filt.help + +- Regexes are Python-style +- Regexes can be specified as quoted strings +- Header matching (~h, ~hq, ~hs) is against a string of the form "name: value". +- Strings with no operators are matched against the request URL. +- The default binary operator is &. + +Examples +-------- + +URL containing "google.com": + +.. code-block:: none + + google\.com + +Requests whose body contains the string "test": + +.. code-block:: none + + ~q ~b test + +Anything but requests with a text/html content type: + +.. code-block:: none + + !(~q & ~t "text/html") + diff --git a/docs/features/passthrough.rst b/docs/features/passthrough.rst new file mode 100644 index 00000000..b7b5df84 --- /dev/null +++ b/docs/features/passthrough.rst @@ -0,0 +1,97 @@ +.. _passthrough: + +Ignore Domains +============== + +There are two main reasons why you may want to exempt some traffic from mitmproxy's interception +mechanism: + +- **Certificate pinning:** Some traffic is is protected using `Certificate Pinning`_ and + mitmproxy's interception leads to errors. For example, the Twitter app, Windows Update or + the Apple App Store fail to work if mitmproxy is active. +- **Convenience:** You really don't care about some parts of the traffic and just want them to go + away. + +If you want to peek into (SSL-protected) non-HTTP connections, check out the :ref:`tcpproxy` +feature. +If you want to ignore traffic from mitmproxy's processing because of large response bodies, +take a look at the :ref:`responsestreaming` feature. + +How it works +------------ + +================== ============================= +command-line :option:`--ignore regex` +mitmproxy shortcut :kbd:`o` then :kbd:`I` +================== ============================= + + +mitmproxy allows you to specify a regex which is matched against a ``host:port`` string +(e.g. "example.com:443") to determine hosts that should be excluded. + +There are two important quirks to consider: + +- **In transparent mode, the ignore pattern is matched against the IP and ClientHello SNI host.** While we usually infer the + hostname from the Host header if the :option:`--host` argument is passed to mitmproxy, we do not + have access to this information before the SSL handshake. If the client uses SNI however, then we treat the SNI host as an ignore target. +- In regular mode, explicit HTTP requests are never ignored. [#explicithttp]_ The ignore pattern is + applied on CONNECT requests, which initiate HTTPS or clear-text WebSocket connections. + +Tutorial +-------- + +If you just want to ignore one specific domain, there's usually a bulletproof method to do so: + +1. Run mitmproxy or mitmdump in verbose mode (:option:`-v`) and observe the ``host:port`` + information in the serverconnect messages. mitmproxy will filter on these. +2. Take the ``host:port`` string, surround it with ^ and $, escape all dots (. becomes \\.) + and use this as your ignore pattern: + +.. code-block:: none + :emphasize-lines: 6,7,9 + + >>> mitmdump -v + 127.0.0.1:50588: clientconnect + 127.0.0.1:50588: request + -> CONNECT example.com:443 HTTP/1.1 + 127.0.0.1:50588: Set new server address: example.com:443 + 127.0.0.1:50588: serverconnect + -> example.com:443 + ^C + >>> mitmproxy --ignore ^example\.com:443$ + + +Here are some other examples for ignore patterns: + +.. code-block:: none + + # Exempt traffic from the iOS App Store (the regex is lax, but usually just works): + --ignore apple.com:443 + # "Correct" version without false-positives: + --ignore '^(.+\.)?apple\.com:443$' + + # Ignore example.com, but not its subdomains: + --ignore '^example.com:' + + # Ignore everything but example.com and mitmproxy.org: + --ignore '^(?!example\.com)(?!mitmproxy\.org)' + + # Transparent mode: + --ignore 17\.178\.96\.59:443 + # IP address range: + --ignore 17\.178\.\d+\.\d+:443 + + +.. seealso:: + + - :ref:`tcpproxy` + - :ref:`responsestreaming` + +.. rubric:: Footnotes + +.. [#explicithttp] This stems from an limitation of explicit HTTP proxying: + A single connection can be re-used for multiple target domains - a + ``GET http://example.com/`` request may be followed by a ``GET http://evil.com/`` request on the + same connection. If we start to ignore the connection after the first request, + we would miss the relevant second one. +.. _Certificate Pinning: https://security.stackexchange.com/questions/29988/what-is-certificate-pinning diff --git a/docs/features/proxyauth.rst b/docs/features/proxyauth.rst new file mode 100644 index 00000000..bfd32fbd --- /dev/null +++ b/docs/features/proxyauth.rst @@ -0,0 +1,17 @@ +.. _proxyauth: + +Proxy Authentication +==================== + + +Asks the user for authentication before they are permitted to use the proxy. +Authentication headers are stripped from the flows, so they are not passed to +upstream servers. For now, only HTTP Basic authentication is supported. The +proxy auth options are not compatible with the transparent, socks or reverse proxy +mode. + +================== ============================= +command-line :option:`--nonanonymous`, + :option:`--singleuser USER`, + :option:`--htpasswd PATH` +================== ============================= diff --git a/docs/features/replacements.rst b/docs/features/replacements.rst new file mode 100644 index 00000000..8f760866 --- /dev/null +++ b/docs/features/replacements.rst @@ -0,0 +1,72 @@ +.. _replacements: + +Replacements +============ + +Mitmproxy lets you specify an arbitrary number of patterns that define text +replacements within flows. Each pattern has 3 components: a filter that defines +which flows a replacement applies to, a regular expression that defines what +gets replaced, and a target value that defines what is substituted in. + +Replace hooks fire when either a client request or a server response is +received. Only the matching flow component is affected: so, for example, if a +replace hook is triggered on server response, the replacement is only run on +the Response object leaving the Request intact. You control whether the hook +triggers on the request, response or both using the filter pattern. If you need +finer-grained control than this, it's simple to create a script using the +replacement API on Flow components. + +Replacement hooks are extremely handy in interactive testing of applications. +For instance you can use a replace hook to replace the text "XSS" with a +complicated XSS exploit, and then "inject" the exploit simply by interacting +with the application through the browser. When used with tools like Firebug and +mitmproxy's own interception abilities, replacement hooks can be an amazingly +flexible and powerful feature. + + +On the command-line +------------------- + +The replacement hook command-line options use a compact syntax to make it easy +to specify all three components at once. The general form is as follows: + +.. code-block:: none + + /patt/regex/replacement + +Here, **patt** is a mitmproxy filter expression, **regex** is a valid Python +regular expression, and **replacement** is a string literal. The first +character in the expression (``/`` in this case) defines what the separation +character is. Here's an example of a valid expression that replaces "foo" with +"bar" in all requests: + +.. code-block:: none + + :~q:foo:bar + +In practice, it's pretty common for the replacement literal to be long and +complex. For instance, it might be an XSS exploit that weighs in at hundreds or +thousands of characters. To cope with this, there's a variation of the +replacement hook specifier that lets you load the replacement text from a file. +So, you might start **mitmdump** as follows: + +>>> mitmdump --replace-from-file :~q:foo:~/xss-exploit + +This will load the replacement text from the file ``~/xss-exploit``. + +Both the :option:`--replace` and :option:`--replace-from-file` flags can be passed multiple +times. + + +Interactively +------------- + +The :kbd:`R` shortcut key in the mitmproxy options menu (:kbd:`o`) lets you add and edit +replacement hooks using a built-in editor. The context-sensitive help (:kbd:`?`) has +complete usage information. + +================== ============================= +command-line :option:`--replace`, + :option:`--replace-from-file` +mitmproxy shortcut :kbd:`o` then :kbd:`R` +================== ============================= diff --git a/docs/features/responsestreaming.rst b/docs/features/responsestreaming.rst new file mode 100644 index 00000000..8975c1f8 --- /dev/null +++ b/docs/features/responsestreaming.rst @@ -0,0 +1,69 @@ +.. _responsestreaming: + +Response Streaming +================== + +By using mitmproxy's streaming feature, response contents can be passed to the client incrementally +before they have been fully received by the proxy. This is especially useful for large binary files +such as videos, where buffering the whole file slows down the client's browser. + +By default, mitmproxy will read the entire response, perform any indicated +manipulations on it and then send the (possibly modified) response to +the client. In some cases this is undesirable and you may wish to "stream" +the response back to the client. When streaming is enabled, the response is +not buffered on the proxy but directly sent back to the client instead. + +On the command-line +------------------- + +Streaming can be enabled on the command line for all response bodies exceeding a certain size. +The SIZE argument understands k/m/g suffixes, e.g. 3m for 3 megabytes. + +================== ============================= +command-line :option:`--stream SIZE` +================== ============================= + +.. warning:: + + When response streaming is enabled, **streamed response contents will not be + recorded or preserved in any way.** + +.. note:: + + When response streaming is enabled, the response body cannot be modified by the usual means. + +Customizing Response Streaming +------------------------------ + +You can also use an :ref:`inlinescripts` to customize exactly +which responses are streamed. + +Responses that should be tagged for streaming by setting their ``.stream`` attribute to ``True``: + +.. literalinclude:: ../../examples/stream.py + :caption: examples/stream.py + :language: python + +Implementation Details +---------------------- + +When response streaming is enabled, portions of the code which would have otherwise performed +changes on the response body will see an empty response body instead +(:py:data:`netlib.http.CONTENT_MISSING`). Any modifications will be ignored. + +Streamed responses are usually sent in chunks of 4096 bytes. If the response is sent with a +``Transfer-Encoding: chunked`` header, the response will be streamed one chunk at a time. + +Modifying streamed data +----------------------- + +If the ``.stream`` attribute is callable, ``.stream`` will wrap the generator that yields all +chunks. + +.. literalinclude:: ../../examples/stream_modify.py + :caption: examples/stream_modify.py + :language: python + +.. seealso:: + + - :ref:`passthrough` diff --git a/docs/features/reverseproxy.rst b/docs/features/reverseproxy.rst new file mode 100644 index 00000000..87065e73 --- /dev/null +++ b/docs/features/reverseproxy.rst @@ -0,0 +1,57 @@ +.. _reverseproxy: + +Reverse Proxy +============= + +In reverse proxy mode, mitmproxy accepts standard HTTP(S) requests and forwards +them to the specified upstream server. This is in contrast to :ref:`upstreamproxy`, in which +mitmproxy forwards HTTP(S) proxy requests to an upstream proxy server. + +================== ===================================== +command-line :option:`-R http[s]://hostname[:port]` +================== ===================================== + +Here, **http[s]** signifies if the proxy should use TLS to connect to the server. +mitmproxy always accepts both encrypted and unencrypted requests and transforms +them to what the server expects. + +.. code-block:: none + + >>> mitmdump -R https://httpbin.org -p 80 + >>> curl http://localhost/ + # requests will be transparently upgraded to TLS by mitmproxy + + >>> mitmdump -R https://httpbin.org -p 443 + >>> curl https://localhost/ + # mitmproxy will use TLS on both ends. + + +Host Header +----------- + +In reverse proxy mode, mitmproxy does not rewrite the host header. While often useful, this +may lead to issues with public web servers. For example, consider the following scenario: + +.. code-block:: none + :emphasize-lines: 5 + + >>> mitmdump -d -R http://example.com/ + >>> curl http://localhost:8080/ + + >> GET https://example.com/ + Host: localhost:8080 + User-Agent: curl/7.35.0 + [...] + + << 404 Not Found 345B + +Since the Host header doesn't match "example.com", an error is returned. +There are two ways to solve this: + +1. Modify the hosts file of your OS so that "example.com" resolves to your proxy's IP. + Then, access example.com directly. Make sure that your proxy can still resolve the original IP + or specify an IP in mitmproxy. +2. Use mitmproxy's :ref:`setheaders` feature to rewrite the host header: + ``--setheader :~q:Host:example.com``. + However, keep in mind that absolute URLs within the returned document or HTTP redirects will + cause the client application to bypass the proxy. diff --git a/docs/features/serverreplay.rst b/docs/features/serverreplay.rst new file mode 100644 index 00000000..261a1bd6 --- /dev/null +++ b/docs/features/serverreplay.rst @@ -0,0 +1,39 @@ +.. _serverreplay: + +Server-side replay +================== + +Server-side replay lets us replay server responses from a saved HTTP +conversation. + +Matching requests with responses +-------------------------------- + +By default, :program:`mitmproxy` excludes request headers when matching incoming +requests with responses from the replay file. This works in most circumstances, +and makes it possible to replay server responses in situations where request +headers would naturally vary, e.g. using a different user agent. +The :option:`--rheader headername` command-line option allows you to override +this behaviour by specifying individual headers that should be included in matching. + + +Response refreshing +------------------- + +Simply replaying server responses without modification will often result in +unexpected behaviour. For example cookie timeouts that were in the future at +the time a conversation was recorded might be in the past at the time it is +replayed. By default, :program:`mitmproxy` refreshes server responses before sending +them to the client. The **date**, **expires** and **last-modified** headers are +all updated to have the same relative time offset as they had at the time of +recording. So, if they were in the past at the time of recording, they will be +in the past at the time of replay, and vice versa. Cookie expiry times are +updated in a similar way. + +You can turn off response refreshing using the :option:`--norefresh` argument, or using +the :kbd:`o` options shortcut within :program:`mitmproxy`. + +================== ================= +command-line :option:`-S path` +mitmproxy shortcut :kbd:`S` +================== ================= diff --git a/docs/features/setheaders.rst b/docs/features/setheaders.rst new file mode 100644 index 00000000..cbc8b6a5 --- /dev/null +++ b/docs/features/setheaders.rst @@ -0,0 +1,19 @@ +.. _setheaders: + +Set Headers +=========== + +This feature lets you specify a set of headers to be added to requests or +responses, based on a filter pattern. You can specify these either on the +command-line, or through an interactive editor in mitmproxy. + +Example: Set the **Host** header to "example.com" for all requests. + +.. code-block:: none + + mitmdump -R http://example.com --setheader :~q:Host:example.com + +================== ============================= +command-line :option:`--setheader PATTERN` +mitmproxy shortcut :kbd:`o` then :kbd:`H` +================== ============================= diff --git a/docs/features/socksproxy.rst b/docs/features/socksproxy.rst new file mode 100644 index 00000000..76d4cda9 --- /dev/null +++ b/docs/features/socksproxy.rst @@ -0,0 +1,10 @@ +.. _socksproxy: + +SOCKS Mode +========== + +In this mode, mitmproxy acts as a SOCKS5 proxy server. + +================== ================= +command-line :option:`--socks` +================== ================= diff --git a/docs/features/sticky.rst b/docs/features/sticky.rst new file mode 100644 index 00000000..a79cbe8d --- /dev/null +++ b/docs/features/sticky.rst @@ -0,0 +1,41 @@ +.. _sticky: + +Sticky cookies and auth +======================= + +Sticky cookies +-------------- + +When the sticky cookie option is set, __mitmproxy__ will add the cookie most +recently set by the server to any cookie-less request. Consider a service that +sets a cookie to track the session after authentication. Using sticky cookies, +you can fire up mitmproxy, and authenticate to a service as you usually would +using a browser. After authentication, you can request authenticated resources +through mitmproxy as if they were unauthenticated, because mitmproxy will +automatically add the session tracking cookie to requests. Among other things, +this lets you script interactions with authenticated resources (using tools +like wget or curl) without having to worry about authentication. + +Sticky cookies are especially powerful when used in conjunction with :ref:`clientreplay` - you can +record the authentication process once, and simply replay it on startup every time you need +to interact with the secured resources. + +================== ====================== +command-line :option:`-t FILTER` +mitmproxy shortcut :kbd:`o` then :kbd:`t` +================== ====================== + + +Sticky auth +----------- + +The sticky auth option is analogous to the sticky cookie option, in that HTTP +**Authorization** headers are simply replayed to the server once they have been +seen. This is enough to allow you to access a server resource using HTTP Basic +authentication through the proxy. Note that :program:`mitmproxy` doesn't (yet) support +replay of HTTP Digest authentication. + +================== ====================== +command-line :option:`-u FILTER` +mitmproxy shortcut :kbd:`o` then :kbd:`A` +================== ====================== diff --git a/docs/features/tcpproxy.rst b/docs/features/tcpproxy.rst new file mode 100644 index 00000000..fd0746a2 --- /dev/null +++ b/docs/features/tcpproxy.rst @@ -0,0 +1,31 @@ +.. _tcpproxy: + +TCP Proxy +========= + +WebSockets or other non-HTTP protocols are not supported by mitmproxy yet. However, you can exempt +hostnames from processing, so that mitmproxy acts as a generic TCP forwarder. +This feature is closely related to the :ref:`passthrough` functionality, +but differs in two important aspects: + +- The raw TCP messages are printed to the event log. +- SSL connections will be intercepted. + +Please note that message interception or modification are not possible yet. +If you are not interested in the raw TCP messages, you should use the ignore domains feature. + +How it works +------------ + +================== ====================== +command-line :option:`--tcp HOST` +mitmproxy shortcut :kbd:`o` then :kbd:`T` +================== ====================== + +For a detailed description how the hostname pattern works, please look at the :ref:`passthrough` +feature. + +.. seealso:: + + - :ref:`passthrough` + - :ref:`responsestreaming` diff --git a/docs/features/upstreamcerts.rst b/docs/features/upstreamcerts.rst new file mode 100644 index 00000000..af2e2226 --- /dev/null +++ b/docs/features/upstreamcerts.rst @@ -0,0 +1,23 @@ +.. _upstreamcerts: + +Upstream Certificates +===================== + +When mitmproxy receives a connection destined for an SSL-protected service, it +freezes the connection before reading its request data, and makes a connection +to the upstream server to "sniff" the contents of its SSL certificate. The +information gained - the **Common Name** and **Subject Alternative Names** - is +then used to generate the interception certificate, which is sent to the client +so the connection can continue. + +This rather intricate little dance lets us seamlessly generate correct +certificates even if the client has specified only an IP address rather than the +hostname. It also means that we don't need to sniff additional data to generate +certs in transparent mode. + +Upstream cert sniffing is on by default, and can optionally be turned off. + +================== ============================= +command-line :option:`--no-upstream-cert` +mitmproxy shortcut :kbd:`o` then :kbd:`U` +================== ============================= diff --git a/docs/features/upstreamproxy.rst b/docs/features/upstreamproxy.rst new file mode 100644 index 00000000..e06833c2 --- /dev/null +++ b/docs/features/upstreamproxy.rst @@ -0,0 +1,12 @@ +.. _upstreamproxy: + +Upstream proxy mode +=================== + +In this mode, mitmproxy accepts proxy requests and unconditionally forwards all +requests to a specified upstream proxy server. This is in contrast to :ref:`reverseproxy`, +in which mitmproxy forwards ordinary HTTP requests to an upstream server. + +================== =================================== +command-line :option:`-U http://hostname[:port]` +================== =================================== diff --git a/docs/howmitmproxy.rst b/docs/howmitmproxy.rst new file mode 100644 index 00000000..b0b187d3 --- /dev/null +++ b/docs/howmitmproxy.rst @@ -0,0 +1,239 @@ +How mitmproxy works +=================== + +Mitmproxy is an enormously flexible tool. Knowing exactly how the proxying +process works will help you deploy it creatively, and take into account its +fundamental assumptions and how to work around them. This document explains +mitmproxy's proxy mechanism in detail, starting with the simplest unencrypted +explicit proxying, and working up to the most complicated interaction - +transparent proxying of SSL-protected traffic [#ssl]_ in the presence of `Server Name Indication`_. + +Explicit HTTP +------------- + +Configuring the client to use mitmproxy as an explicit proxy is the simplest +and most reliable way to intercept traffic. The proxy protocol is codified in the +`HTTP RFC`_, so the behaviour of both +the client and the server is well defined, and usually reliable. In the +simplest possible interaction with mitmproxy, a client connects directly to the +proxy, and makes a request that looks like this: + +.. code-block:: http + + GET http://example.com/index.html HTTP/1.1 + +This is a proxy GET request - an extended form of the vanilla HTTP GET request +that includes a schema and host specification, and it includes all the +information mitmproxy needs to proceed. + +.. image:: schematics/how-mitmproxy-works-explicit.png + :align: center + +1. The client connects to the proxy and makes a request. +2. Mitmproxy connects to the upstream server and simply forwards the request on. + + +Explicit HTTPS +-------------- + +The process for an explicitly proxied HTTPS connection is quite different. The +client connects to the proxy and makes a request that looks like this: + +.. code-block:: http + + CONNECT example.com:443 HTTP/1.1 + +A conventional proxy can neither view nor manipulate an SSL-encrypted data +stream, so a CONNECT request simply asks the proxy to open a pipe between the +client and server. The proxy here is just a facilitator - it blindly forwards +data in both directions without knowing anything about the contents. The +negotiation of the SSL connection happens over this pipe, and the subsequent +flow of requests and responses are completely opaque to the proxy. + +The MITM in mitmproxy +^^^^^^^^^^^^^^^^^^^^^ + +This is where mitmproxy's fundamental trick comes into play. The MITM in its +name stands for Man-In-The-Middle - a reference to the process we use to +intercept and interfere with these theoretically opaque data streams. The basic +idea is to pretend to be the server to the client, and pretend to be the client +to the server, while we sit in the middle decoding traffic from both sides. The +tricky part is that the `Certificate Authority`_ system is +designed to prevent exactly this attack, by allowing a trusted third-party to +cryptographically sign a server's SSL certificates to verify that they are +legit. If this signature doesn't match or is from a non-trusted party, a secure +client will simply drop the connection and refuse to proceed. Despite the many +shortcomings of the CA system as it exists today, this is usually fatal to +attempts to MITM an SSL connection for analysis. Our answer to this conundrum +is to become a trusted Certificate Authority ourselves. Mitmproxy includes a +full CA implementation that generates interception certificates on the fly. To +get the client to trust these certificates, we :ref:`register mitmproxy as a trusted +CA with the device manually `. + +Complication 1: What's the remote hostname? +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +To proceed with this plan, we need to know the domain name to use in the +interception certificate - the client will verify that the certificate is for +the domain it's connecting to, and abort if this is not the case. At first +blush, it seems that the CONNECT request above gives us all we need - in this +example, both of these values are "example.com". But what if the client had +initiated the connection as follows: + +.. code-block:: http + + CONNECT 10.1.1.1:443 HTTP/1.1 + +Using the IP address is perfectly legitimate because it gives us enough +information to initiate the pipe, even though it doesn't reveal the remote +hostname. + +Mitmproxy has a cunning mechanism that smooths this over - :ref:`upstream +certificate sniffing `. As soon as we +see the CONNECT request, we pause the client part of the conversation, and +initiate a simultaneous connection to the server. We complete the SSL handshake +with the server, and inspect the certificates it used. Now, we use the Common +Name in the upstream SSL certificates to generate the dummy certificate for the +client. Voila, we have the correct hostname to present to the client, even if +it was never specified. + + +Complication 2: Subject Alternative Name +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Enter the next complication. Sometimes, the certificate Common Name is not, in +fact, the hostname that the client is connecting to. This is because of the +optional `Subject Alternative Name`_ field in the SSL certificate +that allows an arbitrary number of alternative domains to be specified. If the +expected domain matches any of these, the client will proceed, even though the +domain doesn't match the certificate Common Name. The answer here is simple: +when we extract the CN from the upstream cert, we also extract the SANs, and +add them to the generated dummy certificate. + + +Complication 3: Server Name Indication +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +One of the big limitations of vanilla SSL is that each certificate requires its +own IP address. This means that you couldn't do virtual hosting where multiple +domains with independent certificates share the same IP address. In a world +with a rapidly shrinking IPv4 address pool this is a problem, and we have a +solution in the form of the `Server Name Indication`_ extension to +the SSL and TLS protocols. This lets the client specify the remote server name +at the start of the SSL handshake, which then lets the server select the right +certificate to complete the process. + +SNI breaks our upstream certificate sniffing process, because when we connect +without using SNI, we get served a default certificate that may have nothing to +do with the certificate expected by the client. The solution is another tricky +complication to the client connection process. After the client connects, we +allow the SSL handshake to continue until just _after_ the SNI value has been +passed to us. Now we can pause the conversation, and initiate an upstream +connection using the correct SNI value, which then serves us the correct +upstream certificate, from which we can extract the expected CN and SANs. + +Putting it all together +^^^^^^^^^^^^^^^^^^^^^^^ + +Lets put all of this together into the complete explicitly proxied HTTPS flow. + +.. image:: schematics/how-mitmproxy-works-explicit-https.png + :align: center + +1. The client makes a connection to mitmproxy, and issues an HTTP CONNECT request. +2. Mitmproxy responds with a ``200 Connection Established``, as if it has set up the CONNECT pipe. +3. The client believes it's talking to the remote server, and initiates the SSL connection. + It uses SNI to indicate the hostname it is connecting to. +4. Mitmproxy connects to the server, and establishes an SSL connection using the SNI hostname + indicated by the client. +5. The server responds with the matching SSL certificate, which contains the CN and SAN values + needed to generate the interception certificate. +6. Mitmproxy generates the interception cert, and continues the + client SSL handshake paused in step 3. +7. The client sends the request over the established SSL connection. +8. Mitmproxy passes the request on to the server over the SSL connection initiated in step 4. + +Transparent HTTP +---------------- + +When a transparent proxy is used, the HTTP/S connection is redirected into a +proxy at the network layer, without any client configuration being required. +This makes transparent proxying ideal for those situations where you can't +change client behaviour - proxy-oblivious Android applications being a common +example. + +To achieve this, we need to introduce two extra components. The first is a +redirection mechanism that transparently reroutes a TCP connection destined for +a server on the Internet to a listening proxy server. This usually takes the +form of a firewall on the same host as the proxy server - `iptables`_ on Linux or +pf_ on OSX. Once the client has initiated the connection, it makes a vanilla HTTP request, +which might look something like this: + +.. code-block:: http + + GET /index.html HTTP/1.1 + +Note that this request differs from the explicit proxy variation, in that it +omits the scheme and hostname. How, then, do we know which upstream host to +forward the request to? The routing mechanism that has performed the +redirection keeps track of the original destination for us. Each routing +mechanism has a different way of exposing this data, so this introduces the +second component required for working transparent proxying: a host module that +knows how to retrieve the original destination address from the router. In +mitmproxy, this takes the form of a built-in set of +modules_ that know how to talk to each platform's redirection mechanism. +Once we have this information, the process is fairly straight-forward. + +.. image:: schematics/how-mitmproxy-works-transparent.png + :align: center + +1. The client makes a connection to the server. +2. The router redirects the connection to mitmproxy, which is typically listening on a local port + of the same host. Mitmproxy then consults the routing mechanism to establish what the original + destination was. +3. Now, we simply read the client's request... +4. ... and forward it upstream. + +Transparent HTTPS +----------------- + +The first step is to determine whether we should treat an incoming connection +as HTTPS. The mechanism for doing this is simple - we use the routing mechanism +to find out what the original destination port is. By default, we treat all +traffic destined for ports 443 and 8443 as SSL. + +From here, the process is a merger of the methods we've described for +transparently proxying HTTP, and explicitly proxying HTTPS. We use the routing +mechanism to establish the upstream server address, and then proceed as for +explicit HTTPS connections to establish the CN and SANs, and cope with SNI. + +.. image:: schematics/how-mitmproxy-works-transparent-https.png + :align: center + +1. The client makes a connection to the server. +2. The router redirects the connection to mitmproxy, which is typically listening on a local port + of the same host. Mitmproxy then consults the routing mechanism to establish what the original + destination was. +3. The client believes it's talking to the remote server, and initiates the SSL connection. + It uses SNI to indicate the hostname it is connecting to. +4. Mitmproxy connects to the server, and establishes an SSL connection using the SNI hostname + indicated by the client. +5. The server responds with the matching SSL certificate, which contains the CN and SAN values + needed to generate the interception certificate. +6. Mitmproxy generates the interception cert, and continues the client SSL handshake paused in + step 3. +7. The client sends the request over the established SSL connection. +8. Mitmproxy passes the request on to the server over the SSL connection initiated in step 4. + +.. rubric:: Footnotes + +.. [#ssl] I use "SSL" to refer to both SSL and TLS in the generic sense, unless otherwise + specified. + +.. _Server Name Indication: https://en.wikipedia.org/wiki/Server_Name_Indication +.. _HTTP RFC: https://tools.ietf.org/html/rfc7230 +.. _Certificate Authority: https://en.wikipedia.org/wiki/Certificate_authority +.. _Subject Alternative Name: https://en.wikipedia.org/wiki/SubjectAltName +.. _iptables: http://www.netfilter.org/ +.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) +.. _modules: https://github.com/mitmproxy/mitmproxy/tree/master/mitmproxy/platform diff --git a/docs/index.rst b/docs/index.rst new file mode 100644 index 00000000..4bca07d1 --- /dev/null +++ b/docs/index.rst @@ -0,0 +1,83 @@ +.. include:: introduction.rst + + +.. toctree:: + :hidden: + :maxdepth: 1 + + introduction + install + certinstall + howmitmproxy + modes + +.. toctree:: + :hidden: + :caption: Tools + + mitmproxy + mitmdump + config + +.. toctree:: + :hidden: + :caption: Features + + features/anticache + features/filters + features/replacements + features/clientreplay + features/serverreplay + features/setheaders + features/passthrough + features/proxyauth + features/reverseproxy + features/responsestreaming + features/socksproxy + features/sticky + features/tcpproxy + features/upstreamproxy + features/upstreamcerts + +.. toctree:: + :hidden: + :caption: Transparent Proxying + + transparent + transparent/linux + transparent/osx + +.. toctree:: + :hidden: + :caption: Scripting + + scripting/inlinescripts + scripting/mitmproxy + + +.. toctree:: + :hidden: + :caption: Tutorials + + tutorials/30second + tutorials/gamecenter + tutorials/transparent-dhcp + +.. toctree:: + :hidden: + :caption: Hacking + + dev/architecture + dev/testing + dev/sslkeylogfile + dev/protocols + dev/proxy + dev/exceptions + dev/models + +.. Indices and tables + ================== + + * :ref:`genindex` + * :ref:`modindex` + diff --git a/docs/install.rst b/docs/install.rst new file mode 100644 index 00000000..3300807b --- /dev/null +++ b/docs/install.rst @@ -0,0 +1,103 @@ +.. _install: + +Installation +============ + +.. _install-ubuntu: + +Installation On Ubuntu +---------------------- + +Ubuntu comes with Python but we need to install pip, python-dev and several libraries. +This was tested on a fully patched installation of Ubuntu 14.04. + +>>> sudo apt-get install python-pip python-dev libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev +>>> sudo pip install mitmproxy + +Once installation is complete you can run :ref:`mitmproxy` or :ref:`mitmdump` from a terminal. + +On **Ubuntu 12.04** (and other systems with an outdated version of pip), +you may need to update pip using ``pip install -U pip`` before installing mitmproxy. + +Installation From Source (Ubuntu) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If you would like to install mitmproxy directly from the master branch on GitHub or would like to +get set up to contribute to the project, install the dependencies as you would for a regular +mitmproxy installation (see :ref:`install-ubuntu`). +Then see the Hacking_ section of the README on GitHub. + + + +Installation On Mac OS X +------------------------ + +The easiest way to get up and running on OSX is to download the pre-built binary packages from +`mitmproxy.org`_. + +There are a few bits of customization you might want to do to make mitmproxy comfortable to use on +OSX. The default color scheme is optimized for a dark background terminal, but you can select a +palette for a light terminal background with the ``--palette`` option. +You can use the OSX **open** program to create a simple and effective ``~/.mailcap`` file to view +request and response bodies: + +.. code-block:: none + + application/*; /usr/bin/open -Wn %s + audio/*; /usr/bin/open -Wn %s + image/*; /usr/bin/open -Wn %s + video/*; /usr/bin/open -Wn %s + +Once installation is complete you can run :ref:`mitmproxy` or :ref:`mitmdump` from a terminal. + + +Installation From Source (Mac OS X) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If you would like to install mitmproxy directly from the master branch on GitHub or would like to +get set up to contribute to the project, there are a few OS X specific things to keep in mind. + +- Make sure that XCode is installed from the App Store, and that the command-line tools have been + downloaded (XCode/Preferences/Downloads). +- If you're running a Python interpreter installed with homebrew (or similar), you may have to + install some dependencies by hand. + +Then see the Hacking_ section of the README on GitHub. + +Installation On Windows +----------------------- + +.. note:: + Please note that mitmdump is the only component of mitmproxy that is supported on Windows at + the moment. + + **There is no interactive user interface on Windows.** + + +First, install the latest version of Python 2.7 from the `Python website`_. +If you already have an older version of Python 2.7 installed, make sure to install pip_ +(pip is included in Python 2.7.9+ by default). + +Next, add Python and the Python Scripts directory to your **PATH** variable. +You can do this easily by running the following in powershell: + +>>> [Environment]::SetEnvironmentVariable("Path", "$env:Path;C:\Python27;C:\Python27\Scripts", "User") + +Now, you can install mitmproxy by running + +>>> pip install mitmproxy + +Once the installation is complete, you can run :ref:`mitmdump` from a command prompt. + +Installation From Source (Windows) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If you would like to install mitmproxy directly from the master branch on GitHub or would like to +get set up to contribute to the project, install Python as outlined above, then see the +Hacking_ section of the README on GitHub. + + +.. _Hacking: https://github.com/mitmproxy/mitmproxy/blob/master/README.rst#hacking +.. _mitmproxy.org: https://mitmproxy.org/ +.. _`Python website`: https://www.python.org/downloads/windows/ +.. _pip: https://pip.pypa.io/en/latest/installing.html diff --git a/docs/introduction.rst b/docs/introduction.rst new file mode 100644 index 00000000..058f39f9 --- /dev/null +++ b/docs/introduction.rst @@ -0,0 +1,24 @@ +Introduction +============ + +**mitmproxy** is an interactive, SSL-capable man-in-the-middle proxy for HTTP +with a console interface. + +**mitmdump** is the command-line version of mitmproxy. Think tcpdump for HTTP. + +Documentation, tutorials and distribution packages can be found on the +mitmproxy website: `mitmproxy.org `_ + + +.. rubric:: Features + + +- Intercept HTTP requests and responses and modify them on the fly. +- Save complete HTTP conversations for later replay and analysis. +- Replay the client-side of an HTTP conversations. +- Replay HTTP responses of a previously recorded server. +- Reverse proxy mode to forward traffic to a specified server. +- Transparent proxy mode on OSX and Linux. +- Make scripted changes to HTTP traffic using Python. +- SSL certificates for interception are generated on the fly. +- And much, much more. diff --git a/docs/mitmdump.rst b/docs/mitmdump.rst new file mode 100644 index 00000000..d9b4a26b --- /dev/null +++ b/docs/mitmdump.rst @@ -0,0 +1,66 @@ +.. _mitmdump: +.. program:: mitmdump + +mitmdump +======== + + +**mitmdump** is the command-line companion to mitmproxy. It provides +tcpdump-like functionality to let you view, record, and programmatically +transform HTTP traffic. See the :option:`--help` flag output for complete +documentation. + + + +Examples +-------- + +Saving traffic +^^^^^^^^^^^^^^ + +>>> mitmdump -w outfile + +Start up mitmdump in proxy mode, and write all traffic to **outfile**. + + +Filtering saved traffic +^^^^^^^^^^^^^^^^^^^^^^^ + +>>> mitmdump -nr infile -w outfile "~m post" + +Start mitmdump without binding to the proxy port (:option:`-n`), read all flows from +infile, apply the specified filter expression (only match POSTs), and write to +outfile. + + +Client replay +^^^^^^^^^^^^^ + +>>> mitmdump -nc outfile + +Start mitmdump without binding to the proxy port (:option:`-n`), then replay all +requests from outfile (:option:`-c filename`). Flags combine in the obvious way, so +you can replay requests from one file, and write the resulting flows to +another: + +>>> mitmdump -nc srcfile -w dstfile + +See the :ref:`clientreplay` section for more information. + + +Running a script +^^^^^^^^^^^^^^^^ + +>>> mitmdump -s examples/add_header.py + +This runs the **add_header.py** example script, which simply adds a new header +to all responses. + +Scripted data transformation +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +>>> mitmdump -ns examples/add_header.py -r srcfile -w dstfile + +This command loads flows from **srcfile**, transforms it according to the +specified script, then writes it back to **dstfile**. + diff --git a/docs/mitmproxy-docs.png b/docs/mitmproxy-docs.png new file mode 100644 index 00000000..273fb8db Binary files /dev/null and b/docs/mitmproxy-docs.png differ diff --git a/docs/mitmproxy-long.png b/docs/mitmproxy-long.png new file mode 100644 index 00000000..f9397d1e Binary files /dev/null and b/docs/mitmproxy-long.png differ diff --git a/docs/mitmproxy.rst b/docs/mitmproxy.rst new file mode 100644 index 00000000..fa3b57c7 --- /dev/null +++ b/docs/mitmproxy.rst @@ -0,0 +1,126 @@ +.. _mitmproxy: +.. program:: mitmproxy + +mitmproxy +========= + + +**mitmproxy** is a console tool that allows interactive examination and +modification of HTTP traffic. It differs from mitmdump in that all flows are +kept in memory, which means that it's intended for taking and manipulating +small-ish samples. Use the :kbd:`?` shortcut key to view, context-sensitive +documentation from any **mitmproxy** screen. + +Flow list +--------- + +The flow list shows an index of captured flows in chronological order. + +.. image:: screenshots/mitmproxy.png + +- **1**: A GET request, returning a 302 Redirect response. +- **2**: A GET request, returning 16.75kb of text/html data. +- **3**: A replayed request. +- **4**: Intercepted flows are indicated with orange text. The user may edit + these flows, and then accept them (using the :kbd:`a` key) to continue. In this + case, the request has been intercepted on the way to the server. +- **5**: A response intercepted from the server on the way to the client. +- **6**: The event log can be toggled on and off using the :kbd:`e` shortcut key. This + pane shows events and errors that may not result in a flow that shows up in the + flow pane. +- **7**: Flow count. +- **8**: Various information on mitmproxy's state. In this case, we have an + interception pattern set to ``.*``. +- **9**: Bind address indicator - mitmproxy is listening on port 8080 of all + interfaces. + + +Flow view +--------- + +The **Flow View** lets you inspect and manipulate a single flow: + +.. image:: screenshots/mitmproxy-flowview.png + +- **1**: Flow summary. +- **2**: The Request/Response tabs, showing you which part of the flow you are + currently viewing. In the example above, we're viewing the Response. Hit :kbd:`tab` + to switch between the Response and the Request. +- **3**: Headers. +- **4**: Body. +- **5**: View Mode indicator. In this case, we're viewing the body in **hex** mode. The other + available modes are **pretty**, which uses a number of heuristics to show you a friendly + view of various content types, and **raw**, which shows you exactly what's there without any + changes. You can change modes using the :kbd:`m` key. + + +Grid Editor +----------- + +Much of the data that we'd like to interact with in mitmproxy is structured. +For instance, headers, queries and form data can all be thought of as a list of +key/value pairs. Mitmproxy has a built-in editor that lays this type of data +out in a grid for easy manipulation. + +At the moment, the Grid Editor is used in four parts of mitmproxy: + + - Editing request or response headers (:kbd:`e` for edit, then :kbd:`h` for headers in flow view) + - Editing a query string (:kbd:`e` for edit, then :kbd:`q` for query in flow view) + - Editing a URL-encoded form (:kbd:`e` for edit, then :kbd:`f` for form in flow view) + - Editing replacement patterns (:kbd:`o` for options, then :kbd:`R` for Replacement Patterns) + +If there is is no data, an empty editor will be started to let you add some. +Here is the editor showing the headers from a request: + +.. image:: screenshots/mitmproxy-kveditor.png + +To edit, navigate to the key or value you want to modify using the arrow or vi +navigation keys, and press enter. The background color will change to show that +you are in edit mode for the specified field: + +.. image:: screenshots/mitmproxy-kveditor-editmode.png + +Modify the field as desired, then press escape to exit edit mode when you're +done. You can also add a row (:kbd:`a` key), delete a row (:kbd:`d` key), spawn an +external editor on a field (:kbd:`e` key). Be sure to consult the context-sensitive +help (:kbd:`?` key) for more. + +Example: Interception +--------------------- + +**mitmproxy**'s interception functionality lets you pause an HTTP request or +response, inspect and modify it, and then accept it to send it on to the server +or client. + + +1: Set an interception pattern +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: screenshots/mitmproxy-intercept-filt.png + +We press :kbd:`i` to set an interception pattern. In this case, the ``~q`` filter +pattern tells **mitmproxy** to intercept all requests. For complete filter +syntax, see the :ref:`filters` section of the documentation, +or the built-in help function in **mitmproxy**. + +2: Intercepted connections are indicated with orange text: +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: screenshots/mitmproxy-intercept-mid.png + +3: You can now view and modify the request: +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: screenshots/mitmproxy-intercept-options.png + +In this case, we viewed the request by selecting it, pressed :kbd:`e` for "edit" +and :kbd:`m` for "method" to change the HTTP request method. + +4: Accept the intercept to continue: +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: screenshots/mitmproxy-intercept-result.png + +Finally, we press :kbd:`a` to accept the modified request, which is then sent on to +the server. In this case, we changed the request from an HTTP GET to +OPTIONS, and Google's server has responded with a 405 "Method not allowed". diff --git a/docs/modes.rst b/docs/modes.rst new file mode 100644 index 00000000..2c87b2a3 --- /dev/null +++ b/docs/modes.rst @@ -0,0 +1,193 @@ +.. _modes: + +Modes of Operation +================== + +Mitmproxy has four modes of operation that allow you to use mitmproxy in a +variety of scenarios: + +- **Regular** (the default) +- **Transparent** +- **Reverse Proxy** +- **Upstream Proxy** + + +Now, which one should you pick? Use this flow chart: + +.. image:: schematics/proxy-modes-flowchart.png + :align: center + +Regular Proxy +------------- + +Mitmproxy's regular mode is the simplest and the easiest to set up. + +1. Start mitmproxy. +2. Configure your client to use mitmproxy by explicitly setting an HTTP proxy. +3. Quick Check: You should already be able to visit an unencrypted HTTP site through the proxy. +4. Open the magic domain **mitm.it** and install the certificate for your device. + +.. note:: + Unfortunately, some applications bypass the system HTTP proxy settings - Android applications + are a common example. In these cases, you need to use mitmproxy's transparent mode. + +If you are proxying an external device, your network will probably look like this: + +.. image:: schematics/proxy-modes-regular.png + :align: center + +The square brackets signify the source and destination IP addresses. Your +client explicitly connects to mitmproxy and mitmproxy explicitly connects +to the target server. + +Transparent Proxy +----------------- + +In transparent mode, traffic is directed into a proxy at the network layer, +without any client configuration required. This makes transparent proxying +ideal for situations where you can't change client behaviour. In the graphic +below, a machine running mitmproxy has been inserted between the router and +the internet: + +.. image:: schematics/proxy-modes-transparent-1.png + :align: center + +The square brackets signify the source and destination IP addresses. Round +brackets mark the next hop on the *Ethernet/data link* layer. This distinction +is important: when the packet arrives at the mitmproxy machine, it must still +be addressed to the target server. This means that Network Address Translation +should not be applied before the traffic reaches mitmproxy, since this would +remove the target information, leaving mitmproxy unable to determine the real +destination. + +.. image:: schematics/proxy-modes-transparent-wrong.png + :align: center + +Common Configurations +^^^^^^^^^^^^^^^^^^^^^ + +There are many ways to configure your network for transparent proxying. We'll +look at two common scenarios: + +1. Configuring the client to use a custom gateway/router/"next hop" +2. Implementing custom routing on the router + +In most cases, the first option is recommended due to its ease of use. + +(a) Custom Gateway +~~~~~~~~~~~~~~~~~~ + +One simple way to get traffic to the mitmproxy machine with the destination IP +intact, is to simply configure the client with the mitmproxy box as the +default gateway. + +.. image:: schematics/proxy-modes-transparent-2.png + :align: center + +In this scenario, we would: + +1. Configure the proxy machine for transparent mode. You can find instructions + in the :ref:`transparent` section. +2. Configure the client to use the proxy machine's IP as the default gateway. +3. Quick Check: At this point, you should already be able to visit an + unencrypted HTTP site over the proxy. +4. Open the magic domain **mitm.it** and install the certificate + for your device. + +Setting the custom gateway on clients can be automated by serving the settings +out to clients over DHCP. This lets set up an interception network where all +clients are proxied automatically, which can save time and effort. + +.. admonition:: Troubleshooting Transparent Mode + :class: note + + Incorrect transparent mode configurations are a frequent source of + error. If it doesn't work for you, try the following things: + + - Open mitmproxy's event log (press :kbd:`e`) - do you see clientconnect messages? + If not, the packets are not arriving at the proxy. One common cause is the occurrence of ICMP + redirects, which means that your machine is telling the client that there's a faster way to + the internet by contacting your router directly (see the :ref:`transparent` section on how to + disable them). If in doubt, Wireshark_ may help you to see whether something arrives at your + machine or not. + - Make sure you have not explicitly configured an HTTP proxy on the client. + This is not needed in transparent mode. + - Re-check the instructions in the :ref:`transparent` section. Anything you missed? + + If you encounter any other pitfalls that should be listed here, please let us know! + +(b) Custom Routing +~~~~~~~~~~~~~~~~~~ + +In some cases, you may need more fine-grained control of which traffic reaches +the mitmproxy instance, and which doesn't. You may, for instance, choose only +to divert traffic to some hosts into the transparent proxy. There are a huge +number of ways to accomplish this, and much will depend on the router or +packet filter you're using. In most cases, the configuration will look like +this: + +.. image:: schematics/proxy-modes-transparent-3.png + :align: center + + +Reverse Proxy +------------- + +mitmproxy is usually used with a client that uses the proxy to access the +Internet. Using reverse proxy mode, you can use mitmproxy to act like a normal +HTTP server: + +.. image:: schematics/proxy-modes-reverse.png + :align: center + +There are various use-cases: + +- Say you have an internal API running at http://example.local/. You could now + set up mitmproxy in reverse proxy mode at http://debug.example.local/ and + dynamically point clients to this new API endpoint, which provides them + with the same data and you with debug information. Similarly, you could move + your real server to a different IP/port and set up mitmproxy in the original + place to debug and or redirect all sessions. + +- Say you're a web developer working on http://example.com/ (with a development + version running on http://localhost:8000/). You can modify your hosts file so that + example.com points to 127.0.0.1 and then run mitmproxy in reverse proxy mode + on port 80. You can test your app on the example.com domain and get all + requests recorded in mitmproxy. + +- Say you have some toy project that should get SSL support. Simply set up + mitmproxy as a reverse proxy on port 443 and you're done (``mitmdump -p 443 -R + http://localhost:80/``). Mitmproxy auto-detects TLS traffic and intercepts it dynamically. + There are better tools for this specific task, but mitmproxy is very quick and simple way to + set up an SSL-speaking server. + +- Want to add a non-SSL-capable compression proxy in front of your server? You + could even spawn a mitmproxy instance that terminates SSL (``-R http://...``), + point it to the compression proxy and let the compression proxy point to a + SSL-initiating mitmproxy (``-R https://...``), which then points to the real + server. As you see, it's a fairly flexible thing. + +.. admonition:: Caveat: Interactive Use + :class: warning + + Reverse Proxy mode is usually not sufficient to create a copy of an interactive website at + different URL. The HTML served to the client remains unchanged - as soon as the user clicks on + an non-relative URL (or downloads a non-relative image resource), traffic no longer passes + through mitmproxy. + +Upstream Proxy +-------------- + +If you want to chain proxies by adding mitmproxy in front of a different proxy +appliance, you can use mitmproxy's upstream mode. In upstream mode, all +requests are unconditionally transferred to an upstream proxy of your choice. + +.. image:: schematics/proxy-modes-upstream.png + :align: center + +mitmproxy supports both explicit HTTP and explicit HTTPS in upstream proxy +mode. You could in theory chain multiple mitmproxy instances in a row, but +that doesn't make any sense in practice (i.e. outside of our tests). + + +.. _Wireshark: https://wireshark.org/ diff --git a/docs/schematics/_explicit.graffle/data.plist b/docs/schematics/_explicit.graffle/data.plist new file mode 100644 index 00000000..bc5ef104 --- /dev/null +++ b/docs/schematics/_explicit.graffle/data.plist @@ -0,0 +1,572 @@ + + + + + ActiveLayerIndex + 0 + ApplicationVersion + + com.omnigroup.OmniGraffle.MacAppStore + 139.16 + + AutoAdjust + + BackgroundGraphic + + Bounds + {{0, 0}, {559.19998741149902, 782.79998779296875}} + Class + SolidGraphic + ID + 2 + Style + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + BaseZoom + 0 + CanvasOrigin + {0, 0} + ColumnAlign + 1 + ColumnSpacing + 36 + CreationDate + 2013-01-02 19:31:53 +0000 + Creator + Aldo Cortesi + DisplayScale + 1.000 cm = 1.000 cm + GraphDocumentVersion + 8 + GraphicsList + + + Class + LineGraphic + ID + 4074 + Points + + {300.4483540852865, 420.70833897590637} + {344.88497416178387, 420.70833897590654} + {362.21830749511713, 420.04167230923986} + {413.55166625976557, 419.70833905537921} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4070 + Points + + {84.896692911783873, 420.66667453447985} + {129.33331298828122, 420.66667453448002} + {146.66664632161454, 420.00000786781334} + {198.00000508626297, 419.66667461395269} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{326.00000000000023, 391.39999198913591}, {62, 24}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4063 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 2: Forwarded \ +Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{110, 403.39997863769622}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4061 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 1: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{430.83098347981803, 515.99999999999989}, {36, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4026 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Server} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{40.499999999999993, 486.66666666666663}, {31, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4025 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Client} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} + Class + ShapedGraphic + ID + 4004 + ImageID + 6 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + Bounds + {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} + Class + ShapedGraphic + ID + 4023 + Shape + Rectangle + Style + + fill + + Color + + b + 0 + g + 0.463735 + r + 1 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 mitmproxy} + + + + Bounds + {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} + Class + ShapedGraphic + ID + 134 + ImageID + 3 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + GridInfo + + GuidesLocked + NO + GuidesVisible + YES + HPages + 1 + ImageCounter + 7 + ImageLinkBack + + + + + ImageList + + image6.tiff + image3.icns + + KeepToScale + + Layers + + + Lock + NO + Name + Layer 1 + Print + YES + View + YES + + + LayoutInfo + + Animate + NO + circoMinDist + 18 + circoSeparation + 0.0 + layoutEngine + dot + neatoSeparation + 0.0 + twopiSeparation + 0.0 + + LinksVisible + NO + MagnetsVisible + NO + MasterSheets + + ModificationDate + 2013-01-03 02:27:49 +0000 + Modifier + Aldo Cortesi + NotesVisible + NO + Orientation + 2 + OriginVisible + NO + PageBreaks + YES + PrintInfo + + NSBottomMargin + + float + 41 + + NSHorizonalPagination + + coded + BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG + + NSLeftMargin + + float + 18 + + NSPaperSize + + size + {595.19998741149902, 841.79998779296875} + + NSPrintReverseOrientation + + int + 0 + + NSRightMargin + + float + 18 + + NSTopMargin + + float + 18 + + + PrintOnePage + + ReadOnly + NO + RowAlign + 1 + RowSpacing + 36 + SheetTitle + Canvas 1 + SmartAlignmentGuidesActive + YES + SmartDistanceGuidesActive + YES + UniqueID + 1 + UseEntirePage + + VPages + 1 + WindowInfo + + CurrentSheet + 0 + ExpandedCanvases + + + name + Canvas 1 + + + Frame + {{300, 236}, {974, 874}} + ListView + + OutlineWidth + 142 + RightSidebar + + ShowRuler + + Sidebar + + SidebarWidth + 120 + VisibleRegion + {{0, 202}, {550, 469.33333333333337}} + Zoom + 1.5 + ZoomValues + + + Canvas 1 + 1.5 + 1 + + + + + diff --git a/docs/schematics/_explicit.graffle/image3.icns b/docs/schematics/_explicit.graffle/image3.icns new file mode 100644 index 00000000..964df4b8 Binary files /dev/null and b/docs/schematics/_explicit.graffle/image3.icns differ diff --git a/docs/schematics/_explicit.graffle/image6.tiff b/docs/schematics/_explicit.graffle/image6.tiff new file mode 100644 index 00000000..bd6ed534 Binary files /dev/null and b/docs/schematics/_explicit.graffle/image6.tiff differ diff --git a/docs/schematics/_explicit_https.graffle/data.plist b/docs/schematics/_explicit_https.graffle/data.plist new file mode 100644 index 00000000..306630a0 --- /dev/null +++ b/docs/schematics/_explicit_https.graffle/data.plist @@ -0,0 +1,1054 @@ + + + + + ActiveLayerIndex + 0 + ApplicationVersion + + com.omnigroup.OmniGraffle.MacAppStore + 139.16 + + AutoAdjust + + BackgroundGraphic + + Bounds + {{0, 0}, {559.19998741149902, 782.79998779296875}} + Class + SolidGraphic + ID + 2 + Style + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + BaseZoom + 0 + CanvasOrigin + {0, 0} + ColumnAlign + 1 + ColumnSpacing + 36 + CreationDate + 2013-01-02 19:31:53 +0000 + Creator + Aldo Cortesi + DisplayScale + 1.000 cm = 1.000 cm + GraphDocumentVersion + 8 + GraphicsList + + + Class + LineGraphic + ID + 4075 + Points + + {299.94835408528644, 473.66668184598285} + {344.38497416178376, 473.66668184598302} + {361.71830749511713, 473.00001517931634} + {413.05166625976557, 472.66668192545569} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4074 + Points + + {300.4483540852865, 420.70833897590637} + {344.88497416178387, 420.70833897590654} + {362.21830749511713, 420.04167230923986} + {413.55166625976557, 419.70833905537921} + + Style + + stroke + + HeadArrow + 0 + Legacy + + TailArrow + FilledArrow + + + + + Class + LineGraphic + ID + 4073 + Points + + {300.44835408528655, 367.66666611035561} + {344.88497416178393, 367.66666611035578} + {362.21830749511719, 366.99999944368909} + {413.55166625976568, 366.66666618982845} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4072 + Points + + {84.896697998046875, 526.66670727729809} + {129.33331807454422, 526.6667072772982} + {146.66665140787754, 526.00004061063157} + {198.00001017252598, 525.66670735677087} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4071 + Points + + {84.896687825520942, 472.91668446858688} + {197.99999491373694, 472.66668319702148} + + Style + + stroke + + HeadArrow + 0 + Legacy + + TailArrow + FilledArrow + + + + + Class + LineGraphic + ID + 4070 + Points + + {84.896692911783873, 420.66667453447985} + {129.33331298828122, 420.66667453448002} + {146.66664632161454, 420.00000786781334} + {198.00000508626297, 419.66667461395269} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{316.49998792012531, 326.66665395100904}, {65, 36}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4069 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 4: Initiate SSL \ +handshake \ +with SNI} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{317.00000000000006, 456.66707356770831}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4067 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 8: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.187746683756515, 509.33333333333331}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4066 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 7: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.1877466837567, 441.50006103515642}, {76, 24}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4065 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 6: Complete SSL\ +handshake} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{316.99998982747411, 403.66686820983904}, {64, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4063 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 5: CN & SANs} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.187741597493542, 380.00018183390387}, {65, 36}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4061 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 3: Initiate SSL \ +handshake \ +with SNI} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.187745571136503, 338.66666666666669}, {84, 24}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4060 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 2: 200 Connection \ +Established} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.187741915384976, 283.66659164428717}, {64, 24}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4058 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 1: CONNECT \ +request} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ID + 4041 + Points + + {84.896692911783944, 366.91666793823208} + {198, 366.66666666666669} + + Style + + stroke + + HeadArrow + 0 + Legacy + + TailArrow + FilledArrow + + + + + Class + LineGraphic + ID + 31 + Points + + {84.896687825520857, 314.66666126251221} + {129.33330790201822, 314.66666126251238} + {146.66664123535153, 313.99999459584569} + {198, 313.66666134198505} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{430.83098347981803, 515.99999999999989}, {36, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4026 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Server} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{40.499999999999993, 486.66666666666663}, {31, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4025 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Client} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} + Class + ShapedGraphic + ID + 4004 + ImageID + 6 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + Bounds + {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} + Class + ShapedGraphic + ID + 4023 + Shape + Rectangle + Style + + fill + + Color + + b + 0 + g + 0.463735 + r + 1 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 mitmproxy} + + + + Bounds + {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} + Class + ShapedGraphic + ID + 134 + ImageID + 3 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + GridInfo + + GuidesLocked + NO + GuidesVisible + YES + HPages + 1 + ImageCounter + 7 + ImageLinkBack + + + + + ImageList + + image6.tiff + image3.icns + + KeepToScale + + Layers + + + Lock + NO + Name + Layer 1 + Print + YES + View + YES + + + LayoutInfo + + Animate + NO + circoMinDist + 18 + circoSeparation + 0.0 + layoutEngine + dot + neatoSeparation + 0.0 + twopiSeparation + 0.0 + + LinksVisible + NO + MagnetsVisible + NO + MasterSheets + + ModificationDate + 2013-01-03 02:14:45 +0000 + Modifier + Aldo Cortesi + NotesVisible + NO + Orientation + 2 + OriginVisible + NO + PageBreaks + YES + PrintInfo + + NSBottomMargin + + float + 41 + + NSHorizonalPagination + + coded + BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG + + NSLeftMargin + + float + 18 + + NSPaperSize + + size + {595.19998741149902, 841.79998779296875} + + NSPrintReverseOrientation + + int + 0 + + NSRightMargin + + float + 18 + + NSTopMargin + + float + 18 + + + PrintOnePage + + ReadOnly + NO + RowAlign + 1 + RowSpacing + 36 + SheetTitle + Canvas 1 + SmartAlignmentGuidesActive + YES + SmartDistanceGuidesActive + YES + UniqueID + 1 + UseEntirePage + + VPages + 1 + WindowInfo + + CurrentSheet + 0 + ExpandedCanvases + + + name + Canvas 1 + + + Frame + {{271, 336}, {974, 874}} + ListView + + OutlineWidth + 142 + RightSidebar + + ShowRuler + + Sidebar + + SidebarWidth + 120 + VisibleRegion + {{0, 202}, {550, 469.33333333333337}} + Zoom + 1.5 + ZoomValues + + + Canvas 1 + 1.5 + 1 + + + + + diff --git a/docs/schematics/_explicit_https.graffle/image3.icns b/docs/schematics/_explicit_https.graffle/image3.icns new file mode 100644 index 00000000..964df4b8 Binary files /dev/null and b/docs/schematics/_explicit_https.graffle/image3.icns differ diff --git a/docs/schematics/_explicit_https.graffle/image6.tiff b/docs/schematics/_explicit_https.graffle/image6.tiff new file mode 100644 index 00000000..bd6ed534 Binary files /dev/null and b/docs/schematics/_explicit_https.graffle/image6.tiff differ diff --git a/docs/schematics/_transparent.graffle/data.plist b/docs/schematics/_transparent.graffle/data.plist new file mode 100644 index 00000000..722b4a44 --- /dev/null +++ b/docs/schematics/_transparent.graffle/data.plist @@ -0,0 +1,771 @@ + + + + + ActiveLayerIndex + 0 + ApplicationVersion + + com.omnigroup.OmniGraffle.MacAppStore + 139.16 + + AutoAdjust + + BackgroundGraphic + + Bounds + {{0, 0}, {559.19998741149902, 782.79998779296875}} + Class + SolidGraphic + ID + 2 + Style + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + BaseZoom + 0 + CanvasOrigin + {0, 0} + ColumnAlign + 1 + ColumnSpacing + 36 + CreationDate + 2013-01-02 19:31:53 +0000 + Creator + Aldo Cortesi + DisplayScale + 1.000 cm = 1.000 cm + GraphDocumentVersion + 8 + GraphicsList + + + Bounds + {{101.18773396809897, 358.41662979125977}, {62, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4079 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 2: Redirection} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{102.18775939941409, 405.16666666666663}, {78, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4078 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 3: HTTP Request} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ControlPoints + + {-29.333333333333343, 15.666671991348267} + {-14, -7.3333333333333712} + + ID + 37 + Points + + {196.99999491373691, 331.83332316080725} + {198.00000508626303, 402.49998982747394} + + Style + + stroke + + Bezier + + HeadArrow + FilledArrow + Legacy + + LineType + 1 + TailArrow + 0 + + + + + Bounds + {{205.34387397766082, 289.3333333333328}, {84, 52.666667938232422}} + Class + ShapedGraphic + ID + 4076 + Shape + Rectangle + Style + + fill + + Color + + b + 0.547829 + g + 1 + r + 0.790866 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 router} + + + + Class + LineGraphic + ID + 4075 + Points + + {304.061024983724, 422.16667167345679} + {348.49764506022132, 422.16667167345696} + {365.83097839355469, 421.50000500679027} + {417.16433715820312, 421.16667175292963} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{321.11267089843761, 405.16706339518225}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4067 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 4: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{101.18773682912195, 295.66660690307623}, {62, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4058 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 1: Connection} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ID + 4041 + Points + + {85.896713256836037, 421.41666793823208} + {199.00002034505209, 421.16666666666669} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 31 + Points + + {84.896687825520857, 314.66666126251221} + {129.33330790201822, 314.66666126251238} + {146.66664123535153, 313.99999459584569} + {198, 313.66666134198505} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{430.83098347981803, 515.99999999999989}, {36, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4026 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Server} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{40.499999999999993, 486.66666666666663}, {31, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4025 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Client} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} + Class + ShapedGraphic + ID + 4004 + ImageID + 6 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + Bounds + {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} + Class + ShapedGraphic + ID + 4023 + Shape + Rectangle + Style + + fill + + Color + + b + 0 + g + 0.463735 + r + 1 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 mitmproxy} + + + + Bounds + {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} + Class + ShapedGraphic + ID + 134 + ImageID + 3 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + GridInfo + + GuidesLocked + NO + GuidesVisible + YES + HPages + 1 + ImageCounter + 7 + ImageLinkBack + + + + + ImageList + + image6.tiff + image3.icns + + KeepToScale + + Layers + + + Lock + NO + Name + Layer 1 + Print + YES + View + YES + + + LayoutInfo + + Animate + NO + circoMinDist + 18 + circoSeparation + 0.0 + layoutEngine + dot + neatoSeparation + 0.0 + twopiSeparation + 0.0 + + LinksVisible + NO + MagnetsVisible + NO + MasterSheets + + ModificationDate + 2013-01-03 04:13:10 +0000 + Modifier + Aldo Cortesi + NotesVisible + NO + Orientation + 2 + OriginVisible + NO + PageBreaks + YES + PrintInfo + + NSBottomMargin + + float + 41 + + NSHorizonalPagination + + coded + BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG + + NSLeftMargin + + float + 18 + + NSPaperSize + + size + {595.19998741149902, 841.79998779296875} + + NSPrintReverseOrientation + + int + 0 + + NSRightMargin + + float + 18 + + NSTopMargin + + float + 18 + + + PrintOnePage + + ReadOnly + NO + RowAlign + 1 + RowSpacing + 36 + SheetTitle + Canvas 1 + SmartAlignmentGuidesActive + YES + SmartDistanceGuidesActive + YES + UniqueID + 1 + UseEntirePage + + VPages + 1 + WindowInfo + + CurrentSheet + 0 + ExpandedCanvases + + + name + Canvas 1 + + + Frame + {{295, 141}, {974, 874}} + ListView + + OutlineWidth + 142 + RightSidebar + + ShowRuler + + Sidebar + + SidebarWidth + 120 + VisibleRegion + {{0, 208}, {550, 469.33333333333337}} + Zoom + 1.5 + ZoomValues + + + Canvas 1 + 1.5 + 1 + + + + + diff --git a/docs/schematics/_transparent.graffle/image3.icns b/docs/schematics/_transparent.graffle/image3.icns new file mode 100644 index 00000000..964df4b8 Binary files /dev/null and b/docs/schematics/_transparent.graffle/image3.icns differ diff --git a/docs/schematics/_transparent.graffle/image6.tiff b/docs/schematics/_transparent.graffle/image6.tiff new file mode 100644 index 00000000..bd6ed534 Binary files /dev/null and b/docs/schematics/_transparent.graffle/image6.tiff differ diff --git a/docs/schematics/_transparent_https.graffle/data.plist b/docs/schematics/_transparent_https.graffle/data.plist new file mode 100644 index 00000000..9c1395d7 --- /dev/null +++ b/docs/schematics/_transparent_https.graffle/data.plist @@ -0,0 +1,1096 @@ + + + + + ActiveLayerIndex + 0 + ApplicationVersion + + com.omnigroup.OmniGraffle.MacAppStore + 139.16 + + AutoAdjust + + BackgroundGraphic + + Bounds + {{0, 0}, {559.19998741149902, 782.79998779296875}} + Class + SolidGraphic + ID + 2 + Style + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + BaseZoom + 0 + CanvasOrigin + {0, 0} + ColumnAlign + 1 + ColumnSpacing + 36 + CreationDate + 2013-01-02 19:31:53 +0000 + Creator + Aldo Cortesi + DisplayScale + 1.000 cm = 1.000 cm + GraphDocumentVersion + 8 + GraphicsList + + + Class + LineGraphic + ID + 4075 + Points + + {299.99999999999994, 470.90565482775372} + {344.43662007649726, 470.90565482775389} + {361.76995340983063, 470.23898816108721} + {413.10331217447907, 469.90565490722656} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4074 + Points + + {300.5, 417.94731195767724} + {344.93662007649738, 417.94731195767741} + {362.26995340983063, 417.28064529101073} + {413.60331217447907, 416.94731203715008} + + Style + + stroke + + HeadArrow + 0 + Legacy + + TailArrow + FilledArrow + + + + + Class + LineGraphic + ID + 4073 + Points + + {300.50000000000006, 364.90563909212648} + {344.93662007649743, 364.90563909212665} + {362.26995340983069, 364.23897242545996} + {413.60331217447919, 363.90563917159932} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{316.55163383483881, 323.90562693277991}, {65, 36}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4069 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 4: Initiate SSL \ +handshake \ +with SNI} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{317.05164591471356, 453.90604654947919}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4067 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 8: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{317.05163574218761, 400.90584119160991}, {64, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4063 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 5: CN & SANs} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ID + 4072 + Points + + {85.333343505859332, 525.3331921100596} + {129.7699635823565, 525.3331921100596} + {147.10329691568987, 524.66652544339308} + {198.4366556803383, 524.33319218953238} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Class + LineGraphic + ID + 4071 + Points + + {85.3333333333334, 471.58316930134964} + {198.43664042154924, 471.33316802978419} + + Style + + stroke + + HeadArrow + 0 + Legacy + + TailArrow + FilledArrow + + + + + Class + LineGraphic + ID + 4070 + Points + + {85.33333841959633, 419.33315936724267} + {129.76995849609349, 419.33315936724279} + {147.10329182942687, 418.66649270057616} + {198.4366505940753, 418.33315944671557} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{97.957725524902315, 508.66666666666663}, {49, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4066 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 7: Request} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.624392191569157, 440.16654586791918}, {76, 24}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4065 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 6: Complete SSL\ +handshake} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.624387105305999, 377.33333333333331}, {65, 36}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4061 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 3: Initiate SSL \ +handshake \ +with SNI} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{94.624387105305971, 344.58320871988946}, {62, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4079 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 2: Redirection} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ControlPoints + + {-29.333333333333343, 15.666671991348267} + {-14, -7.3333333333333712} + + ID + 37 + Points + + {197.43664042154938, 317.99990208943694} + {198.4366505940755, 388.66656875610363} + + Style + + stroke + + Bezier + + HeadArrow + FilledArrow + Legacy + + LineType + 1 + TailArrow + 0 + + + + + Bounds + {{205.34387397766082, 289.3333333333328}, {84, 52.666667938232422}} + Class + ShapedGraphic + ID + 4076 + Shape + Rectangle + Style + + fill + + Color + + b + 0.547829 + g + 1 + r + 0.790866 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 router} + + + + Bounds + {{97.957725842793792, 284.99970499674527}, {62, 12}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + FontInfo + + Font + Helvetica + Size + 12 + + ID + 4058 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs20 \cf0 1: Connection} + VerticalPad + 0 + + Wrap + NO + + + Class + LineGraphic + ID + 31 + Points + + {85.333333333333329, 300.8332401911419} + {129.76995340983069, 300.83324019114207} + {147.10328674316401, 300.16657352447538} + {198.43664550781247, 299.83324027061474} + + Style + + stroke + + HeadArrow + FilledArrow + Legacy + + TailArrow + 0 + + + + + Bounds + {{430.83098347981803, 515.99999999999989}, {36, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4026 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Server} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{40.499999999999993, 486.66666666666663}, {31, 14}} + Class + ShapedGraphic + FitText + YES + Flow + Resize + ID + 4025 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + Text + + Pad + 0 + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf0 Client} + VerticalPad + 0 + + Wrap + NO + + + Bounds + {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} + Class + ShapedGraphic + ID + 4004 + ImageID + 6 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + Bounds + {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} + Class + ShapedGraphic + ID + 4023 + Shape + Rectangle + Style + + fill + + Color + + b + 0 + g + 0.463735 + r + 1 + + + + Text + + Text + {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 +\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} +{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} +\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc + +\f0\fs24 \cf2 mitmproxy} + + + + Bounds + {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} + Class + ShapedGraphic + ID + 134 + ImageID + 3 + Shape + Rectangle + Style + + fill + + Draws + NO + + shadow + + Draws + NO + + stroke + + Draws + NO + + + + + GridInfo + + GuidesLocked + NO + GuidesVisible + YES + HPages + 1 + ImageCounter + 7 + ImageLinkBack + + + + + ImageList + + image6.tiff + image3.icns + + KeepToScale + + Layers + + + Lock + NO + Name + Layer 1 + Print + YES + View + YES + + + LayoutInfo + + Animate + NO + circoMinDist + 18 + circoSeparation + 0.0 + layoutEngine + dot + neatoSeparation + 0.0 + twopiSeparation + 0.0 + + LinksVisible + NO + MagnetsVisible + NO + MasterSheets + + ModificationDate + 2013-01-03 04:16:32 +0000 + Modifier + Aldo Cortesi + NotesVisible + NO + Orientation + 2 + OriginVisible + NO + PageBreaks + YES + PrintInfo + + NSBottomMargin + + float + 41 + + NSHorizonalPagination + + coded + BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG + + NSLeftMargin + + float + 18 + + NSPaperSize + + size + {595.19998741149902, 841.79998779296875} + + NSPrintReverseOrientation + + int + 0 + + NSRightMargin + + float + 18 + + NSTopMargin + + float + 18 + + + PrintOnePage + + ReadOnly + NO + RowAlign + 1 + RowSpacing + 36 + SheetTitle + Canvas 1 + SmartAlignmentGuidesActive + YES + SmartDistanceGuidesActive + YES + UniqueID + 1 + UseEntirePage + + VPages + 1 + WindowInfo + + CurrentSheet + 0 + ExpandedCanvases + + + name + Canvas 1 + + + Frame + {{869, 248}, {974, 874}} + ListView + + OutlineWidth + 142 + RightSidebar + + ShowRuler + + Sidebar + + SidebarWidth + 120 + VisibleRegion + {{0, 208}, {550, 469.33333333333337}} + Zoom + 1.5 + ZoomValues + + + Canvas 1 + 1.5 + 1 + + + + + diff --git a/docs/schematics/_transparent_https.graffle/image3.icns b/docs/schematics/_transparent_https.graffle/image3.icns new file mode 100644 index 00000000..964df4b8 Binary files /dev/null and b/docs/schematics/_transparent_https.graffle/image3.icns differ diff --git a/docs/schematics/_transparent_https.graffle/image6.tiff b/docs/schematics/_transparent_https.graffle/image6.tiff new file mode 100644 index 00000000..bd6ed534 Binary files /dev/null and b/docs/schematics/_transparent_https.graffle/image6.tiff differ diff --git a/docs/schematics/architecture.pdf b/docs/schematics/architecture.pdf new file mode 100644 index 00000000..77f5ad58 Binary files /dev/null and b/docs/schematics/architecture.pdf differ diff --git a/docs/schematics/architecture.png b/docs/schematics/architecture.png new file mode 100644 index 00000000..67d6c718 Binary files /dev/null and b/docs/schematics/architecture.png differ diff --git a/docs/schematics/architecture.vsdx b/docs/schematics/architecture.vsdx new file mode 100644 index 00000000..c4ff13d2 Binary files /dev/null and b/docs/schematics/architecture.vsdx differ diff --git a/docs/schematics/how-mitmproxy-works-explicit-https.png b/docs/schematics/how-mitmproxy-works-explicit-https.png new file mode 100644 index 00000000..1f1ca023 Binary files /dev/null and b/docs/schematics/how-mitmproxy-works-explicit-https.png differ diff --git a/docs/schematics/how-mitmproxy-works-explicit.png b/docs/schematics/how-mitmproxy-works-explicit.png new file mode 100644 index 00000000..c9ba26a7 Binary files /dev/null and b/docs/schematics/how-mitmproxy-works-explicit.png differ diff --git a/docs/schematics/how-mitmproxy-works-transparent-https.png b/docs/schematics/how-mitmproxy-works-transparent-https.png new file mode 100644 index 00000000..559cddd2 Binary files /dev/null and b/docs/schematics/how-mitmproxy-works-transparent-https.png differ diff --git a/docs/schematics/how-mitmproxy-works-transparent.png b/docs/schematics/how-mitmproxy-works-transparent.png new file mode 100644 index 00000000..3994d681 Binary files /dev/null and b/docs/schematics/how-mitmproxy-works-transparent.png differ diff --git a/docs/schematics/proxy-modes-flowchart.png b/docs/schematics/proxy-modes-flowchart.png new file mode 100644 index 00000000..e9568dac Binary files /dev/null and b/docs/schematics/proxy-modes-flowchart.png differ diff --git a/docs/schematics/proxy-modes-regular.png b/docs/schematics/proxy-modes-regular.png new file mode 100644 index 00000000..95bada08 Binary files /dev/null and b/docs/schematics/proxy-modes-regular.png differ diff --git a/docs/schematics/proxy-modes-reverse.png b/docs/schematics/proxy-modes-reverse.png new file mode 100644 index 00000000..071d3fc8 Binary files /dev/null and b/docs/schematics/proxy-modes-reverse.png differ diff --git a/docs/schematics/proxy-modes-transparent-1.png b/docs/schematics/proxy-modes-transparent-1.png new file mode 100644 index 00000000..002e0e76 Binary files /dev/null and b/docs/schematics/proxy-modes-transparent-1.png differ diff --git a/docs/schematics/proxy-modes-transparent-2.png b/docs/schematics/proxy-modes-transparent-2.png new file mode 100644 index 00000000..41997b05 Binary files /dev/null and b/docs/schematics/proxy-modes-transparent-2.png differ diff --git a/docs/schematics/proxy-modes-transparent-3.png b/docs/schematics/proxy-modes-transparent-3.png new file mode 100644 index 00000000..ee26cb4f Binary files /dev/null and b/docs/schematics/proxy-modes-transparent-3.png differ diff --git a/docs/schematics/proxy-modes-transparent-wrong.png b/docs/schematics/proxy-modes-transparent-wrong.png new file mode 100644 index 00000000..ca501e93 Binary files /dev/null and b/docs/schematics/proxy-modes-transparent-wrong.png differ diff --git a/docs/schematics/proxy-modes-upstream.png b/docs/schematics/proxy-modes-upstream.png new file mode 100644 index 00000000..d40a6494 Binary files /dev/null and b/docs/schematics/proxy-modes-upstream.png differ diff --git a/docs/schematics/proxy-modes.pdf b/docs/schematics/proxy-modes.pdf new file mode 100644 index 00000000..f07ea05e Binary files /dev/null and b/docs/schematics/proxy-modes.pdf differ diff --git a/docs/schematics/proxy-modes.vsdx b/docs/schematics/proxy-modes.vsdx new file mode 100644 index 00000000..0128a142 Binary files /dev/null and b/docs/schematics/proxy-modes.vsdx differ diff --git a/docs/screenshots/firefox3-import.jpg b/docs/screenshots/firefox3-import.jpg new file mode 100644 index 00000000..47fcd672 Binary files /dev/null and b/docs/screenshots/firefox3-import.jpg differ diff --git a/docs/screenshots/firefox3-trust.jpg b/docs/screenshots/firefox3-trust.jpg new file mode 100644 index 00000000..50a2f341 Binary files /dev/null and b/docs/screenshots/firefox3-trust.jpg differ diff --git a/docs/screenshots/firefox3.jpg b/docs/screenshots/firefox3.jpg new file mode 100644 index 00000000..6c4613b6 Binary files /dev/null and b/docs/screenshots/firefox3.jpg differ diff --git a/docs/screenshots/ios-gateway.png b/docs/screenshots/ios-gateway.png new file mode 100644 index 00000000..2489cba3 Binary files /dev/null and b/docs/screenshots/ios-gateway.png differ diff --git a/docs/screenshots/ios-installed.png b/docs/screenshots/ios-installed.png new file mode 100644 index 00000000..2071e441 Binary files /dev/null and b/docs/screenshots/ios-installed.png differ diff --git a/docs/screenshots/ios-manual.png b/docs/screenshots/ios-manual.png new file mode 100644 index 00000000..3977acfe Binary files /dev/null and b/docs/screenshots/ios-manual.png differ diff --git a/docs/screenshots/ios-profile.png b/docs/screenshots/ios-profile.png new file mode 100644 index 00000000..5bcd5a0d Binary files /dev/null and b/docs/screenshots/ios-profile.png differ diff --git a/docs/screenshots/ios-reverse.png b/docs/screenshots/ios-reverse.png new file mode 100644 index 00000000..6ab5b7c0 Binary files /dev/null and b/docs/screenshots/ios-reverse.png differ diff --git a/docs/screenshots/ios-warning.png b/docs/screenshots/ios-warning.png new file mode 100644 index 00000000..d882c514 Binary files /dev/null and b/docs/screenshots/ios-warning.png differ diff --git a/docs/screenshots/mitmproxy-flowview.png b/docs/screenshots/mitmproxy-flowview.png new file mode 100644 index 00000000..154963fe Binary files /dev/null and b/docs/screenshots/mitmproxy-flowview.png differ diff --git a/docs/screenshots/mitmproxy-intercept-filt.png b/docs/screenshots/mitmproxy-intercept-filt.png new file mode 100644 index 00000000..60556ee7 Binary files /dev/null and b/docs/screenshots/mitmproxy-intercept-filt.png differ diff --git a/docs/screenshots/mitmproxy-intercept-mid.png b/docs/screenshots/mitmproxy-intercept-mid.png new file mode 100644 index 00000000..d5b03922 Binary files /dev/null and b/docs/screenshots/mitmproxy-intercept-mid.png differ diff --git a/docs/screenshots/mitmproxy-intercept-options.png b/docs/screenshots/mitmproxy-intercept-options.png new file mode 100644 index 00000000..8dc4ad2c Binary files /dev/null and b/docs/screenshots/mitmproxy-intercept-options.png differ diff --git a/docs/screenshots/mitmproxy-intercept-result.png b/docs/screenshots/mitmproxy-intercept-result.png new file mode 100644 index 00000000..7d9f5c94 Binary files /dev/null and b/docs/screenshots/mitmproxy-intercept-result.png differ diff --git a/docs/screenshots/mitmproxy-kveditor-editmode.png b/docs/screenshots/mitmproxy-kveditor-editmode.png new file mode 100644 index 00000000..a8315ee5 Binary files /dev/null and b/docs/screenshots/mitmproxy-kveditor-editmode.png differ diff --git a/docs/screenshots/mitmproxy-kveditor.png b/docs/screenshots/mitmproxy-kveditor.png new file mode 100644 index 00000000..144b9701 Binary files /dev/null and b/docs/screenshots/mitmproxy-kveditor.png differ diff --git a/docs/screenshots/mitmproxy.png b/docs/screenshots/mitmproxy.png new file mode 100644 index 00000000..42a10e32 Binary files /dev/null and b/docs/screenshots/mitmproxy.png differ diff --git a/docs/screenshots/osx-addcert-alwaystrust.png b/docs/screenshots/osx-addcert-alwaystrust.png new file mode 100644 index 00000000..4c5cc704 Binary files /dev/null and b/docs/screenshots/osx-addcert-alwaystrust.png differ diff --git a/docs/screenshots/win7-certstore-trustedroot.png b/docs/screenshots/win7-certstore-trustedroot.png new file mode 100644 index 00000000..e15a87f5 Binary files /dev/null and b/docs/screenshots/win7-certstore-trustedroot.png differ diff --git a/docs/screenshots/win7-certstore.png b/docs/screenshots/win7-certstore.png new file mode 100644 index 00000000..f8ce54bd Binary files /dev/null and b/docs/screenshots/win7-certstore.png differ diff --git a/docs/screenshots/win7-wizard.png b/docs/screenshots/win7-wizard.png new file mode 100644 index 00000000..eff6ad09 Binary files /dev/null and b/docs/screenshots/win7-wizard.png differ diff --git a/docs/screenshots/winpythoninstaller.jpg b/docs/screenshots/winpythoninstaller.jpg new file mode 100644 index 00000000..0473c66a Binary files /dev/null and b/docs/screenshots/winpythoninstaller.jpg differ diff --git a/docs/scripting/inlinescripts.rst b/docs/scripting/inlinescripts.rst new file mode 100644 index 00000000..89bff2c1 --- /dev/null +++ b/docs/scripting/inlinescripts.rst @@ -0,0 +1,231 @@ +.. _inlinescripts: + +Inline Scripts +============== + +**mitmproxy** has a powerful scripting API that allows you to modify flows +on-the-fly or rewrite previously saved flows locally. + +The mitmproxy scripting API is event driven - a script is simply a Python +module that exposes a set of event methods. Here's a complete mitmproxy script +that adds a new header to every HTTP response before it is returned to the +client: + +.. literalinclude:: ../../examples/add_header.py + :caption: examples/add_header.py + :language: python + +The first argument to each event method is an instance of +:py:class:`~mitmproxy.script.ScriptContext` that lets the script interact with the global mitmproxy +state. The **response** event also gets an instance of :py:class:`~mitmproxy.script.ScriptContext`, +which we can use to manipulate the response itself. + +We can now run this script using mitmdump or mitmproxy as follows: + +>>> mitmdump -s add_header.py + +The new header will be added to all responses passing through the proxy. + +Examples +-------- + +mitmproxy comes with a variety of example inline scripts, which demonstrate many basic tasks. +We encourage you to either browse them locally or on `GitHub`_. + + +Events +------ + +The ``context`` argument passed to each event method is always a +:py:class:`~mitmproxy.script.ScriptContext` instance. It is guaranteed to be the same object +for the scripts lifetime and is not shared between multiple inline scripts. You can safely use it +to store any form of state you require. + +Script Lifecycle Events +^^^^^^^^^^^^^^^^^^^^^^^ + +.. py:function:: start(context, argv) + + Called once on startup, before any other events. + + :param List[str] argv: The inline scripts' arguments. + For example, ``mitmproxy -s 'example.py --foo 42'`` sets argv to ``["--foo", "42"]``. + +.. py:function:: done(context) + + Called once on script shutdown, after any other events. + +Connection Events +^^^^^^^^^^^^^^^^^ + +.. py:function:: clientconnect(context, root_layer) + + Called when a client initiates a connection to the proxy. Note that + a connection can correspond to multiple HTTP requests. + + .. versionchanged:: 0.14 + + :param Layer root_layer: The root layer (see :ref:`protocols` for an explanation what the root + layer is), which provides transparent access to all attributes of the + :py:class:`~mitmproxy.proxy.RootContext`. For example, ``root_layer.client_conn.address`` + gives the remote address of the connecting client. + +.. py:function:: clientdisconnect(context, root_layer) + + Called when a client disconnects from the proxy. + + .. versionchanged:: 0.14 + + :param Layer root_layer: see :py:func:`clientconnect` + +.. py:function:: serverconnect(context, server_conn) + + Called before the proxy initiates a connection to the target server. Note that + a connection can correspond to multiple HTTP requests. + + :param ServerConnection server_conn: The server connection object. It is guaranteed to have a + non-None ``address`` attribute. + +.. py:function:: serverdisconnect(context, server_conn) + + Called when the proxy has closed the server connection. + + .. versionadded:: 0.14 + + :param ServerConnection server_conn: see :py:func:`serverconnect` + +HTTP Events +^^^^^^^^^^^ + +.. py:function:: request(context, flow) + + Called when a client request has been received. The ``flow`` object is + guaranteed to have a non-None ``request`` attribute. + + :param HTTPFlow flow: The flow containing the request which has been received. + The object is guaranteed to have a non-None ``request`` attribute. + +.. py:function:: responseheaders(context, flow) + + Called when the headers of a server response have been received. + This will always be called before the response hook. + + :param HTTPFlow flow: The flow containing the request and response. + The object is guaranteed to have non-None ``request`` and + ``response`` attributes. ``response.content`` will be ``None``, + as the response body has not been read yet. + +.. py:function:: response(context, flow) + + Called when a server response has been received. + + :param HTTPFlow flow: The flow containing the request and response. + The object is guaranteed to have non-None ``request`` and + ``response`` attributes. ``response.body`` will contain the raw response body, + unless response streaming has been enabled. + +.. py:function:: error(context, flow) + + Called when a flow error has occurred, e.g. invalid server responses, or + interrupted connections. This is distinct from a valid server HTTP error + response, which is simply a response with an HTTP error code. + + :param HTTPFlow flow: The flow containing the error. + It is guaranteed to have non-None ``error`` attribute. + +TCP Events +^^^^^^^^^^ + +.. py:function:: tcp_message(context, tcp_msg) + + .. warning:: API is subject to change + + If the proxy is in :ref:`TCP mode `, this event is called when it + receives a TCP payload from the client or server. + + The sender and receiver are identifiable. The message is user-modifiable. + + :param TcpMessage tcp_msg: see *examples/tcp_message.py* + +API +--- + +The canonical API documentation is the code, which you can browse here, locally or on `GitHub`_. +*Use the Source, Luke!* + +The main classes you will deal with in writing mitmproxy scripts are: + +:py:class:`~mitmproxy.script.ScriptContext` + - A handle for interacting with mitmproxy's Flow Master from within scripts. +:py:class:`~mitmproxy.models.ClientConnection` + - Describes a client connection. +:py:class:`~mitmproxy.models.ServerConnection` + - Describes a server connection. +:py:class:`~mitmproxy.models.HTTPFlow` + - A collection of objects representing a single HTTP transaction. +:py:class:`~mitmproxy.models.HTTPRequest` + - An HTTP request. +:py:class:`~mitmproxy.models.HTTPResponse` + - An HTTP response. +:py:class:`~mitmproxy.models.Error` + - A communications error. +:py:class:`netlib.http.Headers` + - A dictionary-like object for managing HTTP headers. +:py:class:`netlib.certutils.SSLCert` + - Exposes information SSL certificates. +:py:class:`mitmproxy.flow.FlowMaster` + - The "heart" of mitmproxy, usually subclassed as :py:class:`mitmproxy.dump.DumpMaster` or + :py:class:`mitmproxy.console.ConsoleMaster`. + +Script Context +-------------- + +.. autoclass:: mitmproxy.script.ScriptContext + :members: + :undoc-members: + +Running scripts in parallel +--------------------------- + +We have a single flow primitive, so when a script is blocking, other requests are not processed. +While that's usually a very desirable behaviour, blocking scripts can be run threaded by using the +:py:obj:`mitmproxy.script.concurrent` decorator. +**If your script does not block, you should avoid the overhead of the decorator.** + +.. literalinclude:: ../../examples/nonblocking.py + :caption: examples/nonblocking.py + :language: python + +Make scripts configurable with arguments +---------------------------------------- + +Sometimes, you want to pass runtime arguments to the inline script. This can be simply done by +surrounding the script call with quotes, e.g. ```mitmdump -s 'script.py --foo 42'``. +The arguments are then exposed in the start event: + +.. literalinclude:: ../../examples/modify_response_body.py + :caption: examples/modify_response_body.py + :language: python + +Running scripts on saved flows +------------------------------ + +Sometimes, we want to run a script on :py:class:`~mitmproxy.models.Flow` objects that are already +complete. This happens when you start a script, and then load a saved set of flows from a file +(see the "scripted data transformation" example `here `_). +It also happens when you run a one-shot script on a single flow through the ``|`` (pipe) shortcut +in mitmproxy. + +In this case, there are no client connections, and the events are run in the following order: +**start**, **request**, **responseheaders**, **response**, **error**, **done**. +If the flow doesn't have a **response** or **error** associated with it, the matching events will +be skipped. + +Spaces in the script path +------------------------- + +By default, spaces are interpreted as a separator between the inline script and its arguments +(e.g. ``-s 'foo.py 42'``). Consequently, the script path needs to be wrapped in a separate pair of +quotes if it contains spaces: ``-s '\'./foo bar/baz.py\' 42'``. + +.. _GitHub: https://github.com/mitmproxy/mitmproxy diff --git a/docs/scripting/mitmproxy.rst b/docs/scripting/mitmproxy.rst new file mode 100644 index 00000000..1626eb5a --- /dev/null +++ b/docs/scripting/mitmproxy.rst @@ -0,0 +1,27 @@ +.. _mitmproxy: + +mitmproxy +========= + +.. note:: + + We strongly encourage you to use :ref:`inlinescripts` rather than mitmproxy. + - Inline Scripts are equally powerful and provide an easier syntax. + - Most examples are written as inline scripts. + - Multiple inline scripts can be used together. + - Inline Scripts can either be executed headless with mitmdump or within the mitmproxy UI. + + +All of mitmproxy's basic functionality is exposed through the **mitmproxy** +library. The example below shows a simple implementation of the "sticky cookie" +functionality included in the interactive mitmproxy program. Traffic is +monitored for ``Cookie`` and ``Set-Cookie`` headers, and requests are rewritten +to include a previously seen cookie if they don't already have one. In effect, +this lets you log in to a site using your browser, and then make subsequent +requests using a tool like curl, which will then seem to be part of the +authenticated session. + + +.. literalinclude:: ../../examples/stickycookies + :caption: examples/stickycookies + :language: python diff --git a/docs/transparent.rst b/docs/transparent.rst new file mode 100644 index 00000000..eb77c76c --- /dev/null +++ b/docs/transparent.rst @@ -0,0 +1,24 @@ +.. _transparent: + +Transparent Proxying +==================== + +When a transparent proxy is used, traffic is redirected into a proxy at the +network layer, without any client configuration being required. This makes +transparent proxying ideal for those situations where you can't change client +behaviour - proxy-oblivious Android applications being a common example. + +To set up transparent proxying, we need two new components. The first is a +redirection mechanism that transparently reroutes a TCP connection destined for +a server on the Internet to a listening proxy server. This usually takes the +form of a firewall on the same host as the proxy server - iptables_ on Linux +or pf_ on OSX. When the proxy receives a redirected connection, it sees a vanilla +HTTP request, without a host specification. This is where the second new component +comes in - a host module that allows us to query the redirector for the original +destination of the TCP connection. + +At the moment, mitmproxy supports transparent proxying on OSX Lion and above, +and all current flavors of Linux. + +.. _iptables: http://www.netfilter.org/ +.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) diff --git a/docs/transparent/linux.rst b/docs/transparent/linux.rst new file mode 100644 index 00000000..ce79128c --- /dev/null +++ b/docs/transparent/linux.rst @@ -0,0 +1,45 @@ +.. _linux: + +Linux +===== + +On Linux, mitmproxy integrates with the iptables redirection mechanism to +achieve transparent mode. + + 1. :ref:`Install the mitmproxy certificate on the test device ` + + 2. Enable IP forwarding: + + >>> sysctl -w net.ipv4.ip_forward=1 + + You may also want to consider enabling this permanently in ``/etc/sysctl.conf``. + + 3. If your target machine is on the same physical network and you configured it to use a custom + gateway, disable ICMP redirects: + + >>> echo 0 | sudo tee /proc/sys/net/ipv4/conf/*/send_redirects + + You may also want to consider enabling this permanently in ``/etc/sysctl.conf`` + as demonstrated `here `_. + + 4. Create an iptables ruleset that redirects the desired traffic to the + mitmproxy port. Details will differ according to your setup, but the + ruleset should look something like this: + + .. code-block:: none + + iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 + iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080 + + 5. Fire up mitmproxy. You probably want a command like this: + + >>> mitmproxy -T --host + + The :option:`-T` flag turns on transparent mode, and the :option:`--host` + argument tells mitmproxy to use the value of the Host header for URL display. + + 6. Finally, configure your test device to use the host on which mitmproxy is + running as the default gateway. + + +For a detailed walkthrough, have a look at the :ref:`transparent-dhcp` tutorial. diff --git a/docs/transparent/osx.rst b/docs/transparent/osx.rst new file mode 100644 index 00000000..1791105f --- /dev/null +++ b/docs/transparent/osx.rst @@ -0,0 +1,70 @@ +.. _osx: + +OSX +=== + +OSX Lion integrated the pf_ packet filter from the OpenBSD project, +which mitmproxy uses to implement transparent mode on OSX. +Note that this means we don't support transparent mode for earlier versions of OSX. + + 1. :ref:`Install the mitmproxy certificate on the test device ` + + 2. Enable IP forwarding: + + >>> sudo sysctl -w net.inet.ip.forwarding=1 + + 3. Place the following two lines in a file called, say, **pf.conf**: + + .. code-block:: none + + rdr on en2 inet proto tcp to any port 80 -> 127.0.0.1 port 8080 + rdr on en2 inet proto tcp to any port 443 -> 127.0.0.1 port 8080 + + These rules tell pf to redirect all traffic destined for port 80 or 443 + to the local mitmproxy instance running on port 8080. You should + replace ``en2`` with the interface on which your test device will appear. + + 4. Configure pf with the rules: + + >>> sudo pfctl -f pf.conf + + 5. And now enable it: + + >>> sudo pfctl -e + + 6. Configure sudoers to allow mitmproxy to access pfctl. Edit the file + **/etc/sudoers** on your system as root. Add the following line to the end + of the file: + + .. code-block:: none + + ALL ALL=NOPASSWD: /sbin/pfctl -s state + + Note that this allows any user on the system to run the command + ``/sbin/pfctl -s state`` as root without a password. This only allows + inspection of the state table, so should not be an undue security risk. If + you're special feel free to tighten the restriction up to the user running + mitmproxy. + + 7. Fire up mitmproxy. You probably want a command like this: + + >>> mitmproxy -T --host + + The :option:`-T` flag turns on transparent mode, and the :option:`--host` + argument tells mitmproxy to use the value of the Host header for URL display. + + 8. Finally, configure your test device to use the host on which mitmproxy is + running as the default gateway. + +.. note:: + + Note that the **rdr** rules in the pf.conf given above only apply to inbound + traffic. **This means that they will NOT redirect traffic coming from the box + running pf itself.** We can't distinguish between an outbound connection from a + non-mitmproxy app, and an outbound connection from mitmproxy itself - if you + want to intercept your OSX traffic, you should use an external host to run + mitmproxy. None the less, pf is flexible to cater for a range of creative + possibilities, like intercepting traffic emanating from VMs. See the + **pf.conf** man page for more. + +.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) diff --git a/docs/tutorials/30second.rst b/docs/tutorials/30second.rst new file mode 100644 index 00000000..4c8bf326 --- /dev/null +++ b/docs/tutorials/30second.rst @@ -0,0 +1,66 @@ +.. _30second: + +Client playback: a 30 second example +==================================== + +My local cafe is serviced by a rickety and unreliable wireless network, +generously sponsored with ratepayers' money by our city council. After +connecting, you are redirected to an SSL-protected page that prompts you for a +username and password. Once you've entered your details, you are free to enjoy +the intermittent dropouts, treacle-like speeds and incorrectly configured +transparent proxy. + +I tend to automate this kind of thing at the first opportunity, on the theory +that time spent now will be more than made up in the long run. In this case, I +might use Firebug_ to ferret out the form post +parameters and target URL, then fire up an editor to write a little script +using Python's urllib_ to simulate a submission. +That's a lot of futzing about. With mitmproxy we can do the job +in literally 30 seconds, without having to worry about any of the details. +Here's how. + +1. Run mitmdump to record our HTTP conversation to a file. +---------------------------------------------------------- + +>>> mitmdump -w wireless-login + +2. Point your browser at the mitmdump instance. +----------------------------------------------- + +I use a tiny Firefox addon called `Toggle Proxy`_ to switch quickly to and from mitmproxy. +I'm assuming you've already :ref:`configured +your browser with mitmproxy's SSL certificate +authority `. + +3. Log in as usual. +------------------- + +And that's it! You now have a serialized version of the login process in the +file wireless-login, and you can replay it at any time like this: + +>>> mitmdump -c wireless-login + +Embellishments +-------------- + +We're really done at this point, but there are a couple of embellishments we +could make if we wanted. I use wicd_ to +automatically join wireless networks I frequent, and it lets me specify a +command to run after connecting. I used the client replay command above and +voila! - totally hands-free wireless network startup. + +We might also want to prune requests that download CSS, JS, images and so +forth. These add only a few moments to the time it takes to replay, but they're +not really needed and I somehow feel compelled to trim them anyway. So, we fire up +the mitmproxy console tool on our serialized conversation, like so: + +>>> mitmproxy -r wireless-login + +We can now go through and manually delete (using the :kbd:`d` keyboard shortcut) +everything we want to trim. When we're done, we use :kbd:`w` to save the +conversation back to the file. + +.. _Firebug: https://getfirebug.com/ +.. _urllib: https://docs.python.org/library/urllib.html +.. _Toggle Proxy: https://addons.mozilla.org/en-us/firefox/addon/toggle-proxy-51740/ +.. _wicd: https://launchpad.net/wicd diff --git a/docs/tutorials/gamecenter.rst b/docs/tutorials/gamecenter.rst new file mode 100644 index 00000000..9dce5df8 --- /dev/null +++ b/docs/tutorials/gamecenter.rst @@ -0,0 +1,128 @@ +.. _gamecenter: + +Setting highscores on Apple's GameCenter +======================================== + +The setup +--------- + +In this tutorial, I'm going to show you how simple it is to creatively +interfere with Apple Game Center traffic using mitmproxy. To set things up, +:ref:`install the mitmproxy root certificate `. Then +start mitmproxy on your desktop, and configure the iPhone to use it as a proxy. + + +Taking a look at the Game Center traffic +---------------------------------------- + +Lets take a first look at the Game Center traffic. The game I'll use in this +tutorial is `Super Mega Worm`_ - a great little retro-apocalyptic sidescroller for the iPhone: + +.. image:: supermega.png + :align: center + + +After finishing a game (take your time), watch the traffic flowing through +mitmproxy: + +.. image:: one.png + :align: center + +We see a bunch of things we might expect - initialisation, the retrieval of +leaderboards and so forth. Then, right at the end, there's a POST to this +tantalising URL: + +.. code-block:: none + + https://service.gc.apple.com/WebObjects/GKGameStatsService.woa/wa/submitScore + +The contents of the submission are particularly interesting: + +.. code-block:: xml + + + + + scores + + + category + SMW_Adv_USA1 + context + 0 + score-value + 0 + timestamp + 1363515361321 + + + + + + +This is a `property list`_, containing an identifier for the game, +a score (55, in this case), and a timestamp. Looks pretty simple to mess with. + +Modifying and replaying the score submission +-------------------------------------------- + +Lets edit the score submission. First, select it in mitmproxy, then press +:kbd:`enter` to view it. Make sure you're viewing the request, not the response - +you can use :kbd:`tab` to flick between the two. Now press :kbd:`e` for edit. You'll +be prompted for the part of the request you want to change - press :kbd:`r` for +raw body. Your preferred editor (taken from the EDITOR environment variable) will +now fire up. Lets bump the score up to something a bit more ambitious: + +.. code-block:: xml + + + + + scores + + + category + SMW_Adv_USA1 + context + 0 + score-value + 2200272667 + timestamp + 1363515361321 + + + + + + +Save the file and exit your editor. + +The final step is to replay this modified request. Simply press :kbd:`r` for replay. + + +The glorious result and some intrigue +------------------------------------- + +.. image:: leaderboard.png + :align: center + +And that's it - according to the records, I am the greatest Super Mega Worm +player of all time. + +There's a curious addendum to this tale. When I first wrote this tutorial, all +the top competitors' scores were the same: 2,147,483,647 (this is no longer the +case, because there are now so many fellow cheaters using this tutorial). If +you think that number seems familiar, you're right: it's 2^31-1, the maximum +value you can fit into a signed 32-bit int. Now let me tell you another +peculiar thing about Super Mega Worm - at the end of every game, it submits +your highest previous score to the Game Center, not your current score. This +means that it stores your highscore somewhere, and I'm guessing that it reads +that stored score back into a signed integer. So, if you _were_ to cheat by the +relatively pedestrian means of modifying the saved score on your jailbroken +phone, then 2^31-1 might well be the maximum score you could get. Then again, +if the game itself stores its score in a signed 32-bit int, you could get the +same score through perfect play, effectively beating the game. So, which is it +in this case? I'll leave that for you to decide. + +.. _Super Mega Worm: https://itunes.apple.com/us/app/super-mega-worm/id388541990?mt=8 +.. _property list: https://en.wikipedia.org/wiki/Property_list diff --git a/docs/tutorials/leaderboard.png b/docs/tutorials/leaderboard.png new file mode 100644 index 00000000..c1be8df5 Binary files /dev/null and b/docs/tutorials/leaderboard.png differ diff --git a/docs/tutorials/one.png b/docs/tutorials/one.png new file mode 100644 index 00000000..78a636cf Binary files /dev/null and b/docs/tutorials/one.png differ diff --git a/docs/tutorials/supermega.png b/docs/tutorials/supermega.png new file mode 100644 index 00000000..d416f71f Binary files /dev/null and b/docs/tutorials/supermega.png differ diff --git a/docs/tutorials/transparent-dhcp.rst b/docs/tutorials/transparent-dhcp.rst new file mode 100644 index 00000000..ce285b63 --- /dev/null +++ b/docs/tutorials/transparent-dhcp.rst @@ -0,0 +1,89 @@ +.. _transparent-dhcp: + +Transparently proxify virtual machines +====================================== + +This walkthrough illustrates how to set up transparent proxying with mitmproxy. +We use VirtualBox VMs with an Ubuntu proxy machine in this example, +but the general *Internet <--> Proxy VM <--> (Virtual) Internal Network* setup can be applied to +other setups. + +1. Configure Proxy VM +--------------------- + +On the proxy machine, **eth0** is connected to the internet. **eth1** is connected to the internal +network that will be proxified and configured to use a static ip (192.168.3.1). + +VirtualBox configuration +^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: transparent-dhcp/step1_vbox_eth0.png + +.. image:: transparent-dhcp/step1_vbox_eth1.png + +VM Network Configuration +^^^^^^^^^^^^^^^^^^^^^^^^ + +.. image:: transparent-dhcp/step1_proxy.png + :align: center + +2. Configure DHCP and DNS +------------------------- + +We use dnsmasq to provide DHCP and DNS in our internal network. +Dnsmasq is a lightweight server designed to provide DNS (and optionally +DHCP and TFTP) services to a small-scale network. + +- Before we get to that, we need to fix some Ubuntu quirks: + **Ubuntu >12.04** runs an internal dnsmasq instance (listening on loopback only) by default + `[1] `_. For our use case, this needs + to be disabled by changing ``dns=dnsmasq`` to ``#dns=dnsmasq`` in + **/etc/NetworkManager/NetworkManager.conf** and running + + >>> sudo restart network-manager + + afterwards. +- Now, dnsmasq can be be installed and configured: + + >>> sudo apt-get install dnsmasq + + Replace **/etc/dnsmasq.conf** with the following configuration: + + .. code-block:: none + + # Listen for DNS requests on the internal network + interface=eth1 + # Act as a DHCP server, assign IP addresses to clients + dhcp-range=192.168.3.10,192.168.3.100,96h + # Broadcast gateway and dns server information + dhcp-option=option:router,192.168.3.1 + dhcp-option=option:dns-server,192.168.3.1 + + Apply changes: + + >>> sudo service dnsmasq restart + + Your **proxied machine** in the internal virtual network should now receive an IP address via DHCP: + + .. image:: transparent-dhcp/step2_proxied_vm.png + +3. Redirect traffic to mitmproxy +------------------------------------------ + +To redirect traffic to mitmproxy, we need to add two iptables rules: + +.. code-block:: none + + iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080 + iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8080 + +4. Run mitmproxy +---------------- + +Finally, we can run mitmproxy in transparent mode with + +>>> mitmproxy -T + +The proxied machine cannot to leak any data outside of HTTP or DNS requests. +If required, you can now :ref:`install the mitmproxy certificates on the proxied machine +`. diff --git a/docs/tutorials/transparent-dhcp/step1_proxy.png b/docs/tutorials/transparent-dhcp/step1_proxy.png new file mode 100644 index 00000000..a0c94484 Binary files /dev/null and b/docs/tutorials/transparent-dhcp/step1_proxy.png differ diff --git a/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png b/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png new file mode 100644 index 00000000..4b7b4e9b Binary files /dev/null and b/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png differ diff --git a/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png b/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png new file mode 100644 index 00000000..b994d4cb Binary files /dev/null and b/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png differ diff --git a/docs/tutorials/transparent-dhcp/step2_proxied_vm.png b/docs/tutorials/transparent-dhcp/step2_proxied_vm.png new file mode 100644 index 00000000..2046cc57 Binary files /dev/null and b/docs/tutorials/transparent-dhcp/step2_proxied_vm.png differ diff --git a/examples/README b/examples/README new file mode 100644 index 00000000..cf5c4d7d --- /dev/null +++ b/examples/README @@ -0,0 +1,30 @@ +Some inline scripts may require additional dependencies, which can be installed using +`pip install mitmproxy[examples]`. + + +# inline script examples +add_header.py Simple script that just adds a header to every request. +change_upstream_proxy.py Dynamically change the upstream proxy +dns_spoofing.py Use mitmproxy in a DNS spoofing scenario. +dup_and_replay.py Duplicates each request, changes it, and then replays the modified request. +filt.py Use mitmproxy's filter expressions in your script. +flowwriter.py Only write selected flows into a mitmproxy dumpfile. +iframe_injector.py Inject configurable iframe into pages. +modify_form.py Modify all form submissions to add a parameter. +modify_querystring.py Modify all query strings to add a parameters. +modify_response_body.py Replace arbitrary strings in all responses +nonblocking.py Demonstrate parallel processing with a blocking script. +proxapp.py How to embed a WSGI app in a mitmproxy server +redirect_requests.py Redirect requests or directly reply to them. +stub.py Script stub with a method definition for every event. +upsidedownternet.py Rewrites traffic to turn images upside down. + + +# mitmproxy examples +flowbasic Basic use of mitmproxy as a library. +stickycookies An example of writing a custom proxy with mitmproxy. + + +# misc +read_dumpfile Read a dumpfile generated by mitmproxy. +mitmproxywrapper.py Bracket mitmproxy run with proxy enable/disable on OS X diff --git a/examples/add_header.py b/examples/add_header.py new file mode 100644 index 00000000..cf1b53cc --- /dev/null +++ b/examples/add_header.py @@ -0,0 +1,2 @@ +def response(context, flow): + flow.response.headers["newheader"] = "foo" diff --git a/examples/change_upstream_proxy.py b/examples/change_upstream_proxy.py new file mode 100644 index 00000000..9c454897 --- /dev/null +++ b/examples/change_upstream_proxy.py @@ -0,0 +1,24 @@ +# This scripts demonstrates how mitmproxy can switch to a second/different upstream proxy +# in upstream proxy mode. +# +# Usage: mitmdump -U http://default-upstream-proxy.local:8080/ -s change_upstream_proxy.py +# +# If you want to change the target server, you should modify flow.request.host and flow.request.port + + +def proxy_address(flow): + # Poor man's loadbalancing: route every second domain through the alternative proxy. + if hash(flow.request.host) % 2 == 1: + return ("localhost", 8082) + else: + return ("localhost", 8081) + + +def request(context, flow): + if flow.request.method == "CONNECT": + # If the decision is done by domain, one could also modify the server address here. + # We do it after CONNECT here to have the request data available as well. + return + address = proxy_address(flow) + if flow.live: + flow.live.change_upstream_proxy_server(address) \ No newline at end of file diff --git a/examples/custom_contentviews.py b/examples/custom_contentviews.py new file mode 100644 index 00000000..776ba99d --- /dev/null +++ b/examples/custom_contentviews.py @@ -0,0 +1,68 @@ +import string +import lxml.html +import lxml.etree +from mitmproxy import utils, contentviews + + +class ViewPigLatin(contentviews.View): + name = "pig_latin_HTML" + prompt = ("pig latin HTML", "l") + content_types = ["text/html"] + + def __call__(self, data, **metadata): + if utils.isXML(data): + parser = lxml.etree.HTMLParser( + strip_cdata=True, + remove_blank_text=True + ) + d = lxml.html.fromstring(data, parser=parser) + docinfo = d.getroottree().docinfo + + def piglify(src): + words = string.split(src) + ret = '' + for word in words: + idx = -1 + while word[idx] in string.punctuation and (idx * -1) != len(word): idx -= 1 + if word[0].lower() in 'aeiou': + if idx == -1: + ret += word[0:] + "hay" + else: + ret += word[0:len(word) + idx + 1] + "hay" + word[idx + 1:] + else: + if idx == -1: + ret += word[1:] + word[0] + "ay" + else: + ret += word[1:len(word) + idx + 1] + word[0] + "ay" + word[idx + 1:] + ret += ' ' + return ret.strip() + + def recurse(root): + if hasattr(root, 'text') and root.text: + root.text = piglify(root.text) + if hasattr(root, 'tail') and root.tail: + root.tail = piglify(root.tail) + + if len(root): + for child in root: + recurse(child) + + recurse(d) + + s = lxml.etree.tostring( + d, + pretty_print=True, + doctype=docinfo.doctype + ) + return "HTML", contentviews.format_text(s) + + +pig_view = ViewPigLatin() + + +def start(context, argv): + context.add_contentview(pig_view) + + +def stop(context): + context.remove_contentview(pig_view) diff --git a/examples/dns_spoofing.py b/examples/dns_spoofing.py new file mode 100644 index 00000000..7eb79695 --- /dev/null +++ b/examples/dns_spoofing.py @@ -0,0 +1,50 @@ +""" +This inline scripts makes it possible to use mitmproxy in scenarios where IP spoofing has been used to redirect +connections to mitmproxy. The way this works is that we rely on either the TLS Server Name Indication (SNI) or the +Host header of the HTTP request. +Of course, this is not foolproof - if an HTTPS connection comes without SNI, we don't +know the actual target and cannot construct a certificate that looks valid. +Similarly, if there's no Host header or a spoofed Host header, we're out of luck as well. +Using transparent mode is the better option most of the time. + +Usage: + mitmproxy + -p 443 + -s dns_spoofing.py + # Used as the target location if neither SNI nor host header are present. + -R http://example.com/ + mitmdump + -p 80 + -R http://localhost:443/ + + (Setting up a single proxy instance and using iptables to redirect to it + works as well) +""" +import re + + +# This regex extracts splits the host header into host and port. +# Handles the edge case of IPv6 addresses containing colons. +# https://bugzilla.mozilla.org/show_bug.cgi?id=45891 +parse_host_header = re.compile(r"^(?P[^:]+|\[.+\])(?::(?P\d+))?$") + + +def request(context, flow): + if flow.client_conn.ssl_established: + flow.request.scheme = "https" + sni = flow.client_conn.connection.get_servername() + port = 443 + else: + flow.request.scheme = "http" + sni = None + port = 80 + + host_header = flow.request.pretty_host + m = parse_host_header.match(host_header) + if m: + host_header = m.group("host").strip("[]") + if m.group("port"): + port = int(m.group("port")) + + flow.request.host = sni or host_header + flow.request.port = port \ No newline at end of file diff --git a/examples/dup_and_replay.py b/examples/dup_and_replay.py new file mode 100644 index 00000000..9ba91d3b --- /dev/null +++ b/examples/dup_and_replay.py @@ -0,0 +1,4 @@ +def request(context, flow): + f = context.duplicate_flow(flow) + f.request.path = "/changed" + context.replay_request(f) diff --git a/examples/filt.py b/examples/filt.py new file mode 100644 index 00000000..f99b675c --- /dev/null +++ b/examples/filt.py @@ -0,0 +1,16 @@ +# This scripts demonstrates how to use mitmproxy's filter pattern in inline scripts. +# Usage: mitmdump -s "filt.py FILTER" + +from mitmproxy import filt + + +def start(context, argv): + if len(argv) != 2: + raise ValueError("Usage: -s 'filt.py FILTER'") + context.filter = filt.parse(argv[1]) + + +def response(context, flow): + if flow.match(context.filter): + print("Flow matches filter:") + print(flow) diff --git a/examples/flowbasic b/examples/flowbasic new file mode 100644 index 00000000..4a87b86a --- /dev/null +++ b/examples/flowbasic @@ -0,0 +1,44 @@ +#!/usr/bin/env python +""" + This example shows how to build a proxy based on mitmproxy's Flow + primitives. + + Heads Up: In the majority of cases, you want to use inline scripts. + + Note that request and response messages are not automatically replied to, + so we need to implement handlers to do this. +""" +from mitmproxy import flow +from mitmproxy.proxy import ProxyServer, ProxyConfig + + +class MyMaster(flow.FlowMaster): + def run(self): + try: + flow.FlowMaster.run(self) + except KeyboardInterrupt: + self.shutdown() + + def handle_request(self, f): + f = flow.FlowMaster.handle_request(self, f) + if f: + f.reply() + return f + + def handle_response(self, f): + f = flow.FlowMaster.handle_response(self, f) + if f: + f.reply() + print(f) + return f + + +config = ProxyConfig( + port=8080, + # use ~/.mitmproxy/mitmproxy-ca.pem as default CA file. + cadir="~/.mitmproxy/" +) +state = flow.State() +server = ProxyServer(config) +m = MyMaster(server, state) +m.run() diff --git a/examples/flowwriter.py b/examples/flowwriter.py new file mode 100644 index 00000000..8fb8cc60 --- /dev/null +++ b/examples/flowwriter.py @@ -0,0 +1,20 @@ +import random +import sys + +from mitmproxy.flow import FlowWriter + + +def start(context, argv): + if len(argv) != 2: + raise ValueError('Usage: -s "flowriter.py filename"') + + if argv[1] == "-": + f = sys.stdout + else: + f = open(argv[1], "wb") + context.flow_writer = FlowWriter(f) + + +def response(context, flow): + if random.choice([True, False]): + context.flow_writer.add(flow) diff --git a/examples/har_extractor.py b/examples/har_extractor.py new file mode 100644 index 00000000..4e905438 --- /dev/null +++ b/examples/har_extractor.py @@ -0,0 +1,253 @@ +""" + + This inline script utilizes harparser.HAR from + https://github.com/JustusW/harparser to generate a HAR log object. +""" +from harparser import HAR + +from datetime import datetime + + +class _HARLog(HAR.log): + # The attributes need to be registered here for them to actually be + # available later via self. This is due to HAREncodable linking __getattr__ + # to __getitem__. Anything that is set only in __init__ will just be added + # as key/value pair to self.__classes__. + __page_list__ = [] + __page_count__ = 0 + __page_ref__ = {} + + def __init__(self, page_list): + self.__page_list__ = page_list + self.__page_count__ = 0 + self.__page_ref__ = {} + + HAR.log.__init__(self, {"version": "1.2", + "creator": {"name": "MITMPROXY HARExtractor", + "version": "0.1", + "comment": ""}, + "pages": [], + "entries": []}) + + def reset(self): + self.__init__(self.__page_list__) + + def add(self, obj): + if isinstance(obj, HAR.pages): + self['pages'].append(obj) + if isinstance(obj, HAR.entries): + self['entries'].append(obj) + + def create_page_id(self): + self.__page_count__ += 1 + return "autopage_%s" % str(self.__page_count__) + + def set_page_ref(self, page, ref): + self.__page_ref__[page] = ref + + def get_page_ref(self, page): + return self.__page_ref__.get(page, None) + + def get_page_list(self): + return self.__page_list__ + + +def start(context, argv): + """ + On start we create a HARLog instance. You will have to adapt this to + suit your actual needs of HAR generation. As it will probably be + necessary to cluster logs by IPs or reset them from time to time. + """ + context.dump_file = None + if len(argv) > 1: + context.dump_file = argv[1] + else: + raise ValueError( + 'Usage: -s "har_extractor.py filename" ' + '(- will output to stdout, filenames ending with .zhar ' + 'will result in compressed har)' + ) + context.HARLog = _HARLog(['https://github.com']) + context.seen_server = set() + + +def response(context, flow): + """ + Called when a server response has been received. At the time of this + message both a request and a response are present and completely done. + """ + # Values are converted from float seconds to int milliseconds later. + ssl_time = -.001 + connect_time = -.001 + if flow.server_conn not in context.seen_server: + # Calculate the connect_time for this server_conn. Afterwards add it to + # seen list, in order to avoid the connect_time being present in entries + # that use an existing connection. + connect_time = flow.server_conn.timestamp_tcp_setup - \ + flow.server_conn.timestamp_start + context.seen_server.add(flow.server_conn) + + if flow.server_conn.timestamp_ssl_setup is not None: + # Get the ssl_time for this server_conn as the difference between + # the start of the successful tcp setup and the successful ssl + # setup. If no ssl setup has been made it is left as -1 since it + # doesn't apply to this connection. + ssl_time = flow.server_conn.timestamp_ssl_setup - \ + flow.server_conn.timestamp_tcp_setup + + # Calculate the raw timings from the different timestamps present in the + # request and response object. For lack of a way to measure it dns timings + # can not be calculated. The same goes for HAR blocked: MITMProxy will open + # a server connection as soon as it receives the host and port from the + # client connection. So the time spent waiting is actually spent waiting + # between request.timestamp_end and response.timestamp_start thus it + # correlates to HAR wait instead. + timings_raw = { + 'send': flow.request.timestamp_end - flow.request.timestamp_start, + 'wait': flow.response.timestamp_start - flow.request.timestamp_end, + 'receive': flow.response.timestamp_end - flow.response.timestamp_start, + 'connect': connect_time, + 'ssl': ssl_time + } + + # HAR timings are integers in ms, so we have to re-encode the raw timings to + # that format. + timings = dict([(key, int(1000 * value)) + for key, value in timings_raw.iteritems()]) + + # The full_time is the sum of all timings. Timings set to -1 will be ignored + # as per spec. + full_time = 0 + for item in timings.values(): + if item > -1: + full_time += item + + started_date_time = datetime.fromtimestamp( + flow.request.timestamp_start, + tz=utc).isoformat() + + request_query_string = [{"name": k, "value": v} + for k, v in flow.request.get_query()] + request_http_version = flow.request.http_version + # Cookies are shaped as tuples by MITMProxy. + request_cookies = [{"name": k.strip(), "value": v[0]} + for k, v in (flow.request.get_cookies() or {}).iteritems()] + request_headers = [{"name": k, "value": v} for k, v in flow.request.headers] + request_headers_size = len(str(flow.request.headers)) + request_body_size = len(flow.request.content) + + response_http_version = flow.response.http_version + # Cookies are shaped as tuples by MITMProxy. + response_cookies = [{"name": k.strip(), "value": v[0]} + for k, v in (flow.response.get_cookies() or {}).iteritems()] + response_headers = [{"name": k, "value": v} + for k, v in flow.response.headers] + response_headers_size = len(str(flow.response.headers)) + response_body_size = len(flow.response.content) + response_body_decoded_size = len(flow.response.get_decoded_content()) + response_body_compression = response_body_decoded_size - response_body_size + response_mime_type = flow.response.headers.get('Content-Type', '') + response_redirect_url = flow.response.headers.get('Location', '') + + entry = HAR.entries( + { + "startedDateTime": started_date_time, + "time": full_time, + "request": { + "method": flow.request.method, + "url": flow.request.url, + "httpVersion": request_http_version, + "cookies": request_cookies, + "headers": request_headers, + "queryString": request_query_string, + "headersSize": request_headers_size, + "bodySize": request_body_size, + }, + "response": { + "status": flow.response.status_code, + "statusText": flow.response.msg, + "httpVersion": response_http_version, + "cookies": response_cookies, + "headers": response_headers, + "content": { + "size": response_body_size, + "compression": response_body_compression, + "mimeType": response_mime_type}, + "redirectURL": response_redirect_url, + "headersSize": response_headers_size, + "bodySize": response_body_size, + }, + "cache": {}, + "timings": timings, + }) + + # If the current url is in the page list of context.HARLog or does not have + # a referrer we add it as a new pages object. + if flow.request.url in context.HARLog.get_page_list() or flow.request.headers.get( + 'Referer', + None) is None: + page_id = context.HARLog.create_page_id() + context.HARLog.add( + HAR.pages({ + "startedDateTime": entry['startedDateTime'], + "id": page_id, + "title": flow.request.url, + }) + ) + context.HARLog.set_page_ref(flow.request.url, page_id) + entry['pageref'] = page_id + + # Lookup the referer in the page_ref of context.HARLog to point this entries + # pageref attribute to the right pages object, then set it as a new + # reference to build a reference tree. + elif context.HARLog.get_page_ref(flow.request.headers.get('Referer')) is not None: + entry['pageref'] = context.HARLog.get_page_ref( + flow.request.headers['Referer'] + ) + context.HARLog.set_page_ref( + flow.request.headers['Referer'], entry['pageref'] + ) + + context.HARLog.add(entry) + + +def done(context): + """ + Called once on script shutdown, after any other events. + """ + from pprint import pprint + import json + + json_dump = context.HARLog.json() + compressed_json_dump = context.HARLog.compress() + + if context.dump_file == '-': + context.log(pprint.pformat(json.loads(json_dump))) + elif context.dump_file.endswith('.zhar'): + file(context.dump_file, "w").write(compressed_json_dump) + else: + file(context.dump_file, "w").write(json_dump) + context.log( + "HAR log finished with %s bytes (%s bytes compressed)" % ( + len(json_dump), len(compressed_json_dump) + ) + ) + context.log( + "Compression rate is %s%%" % str( + 100. * len(compressed_json_dump) / len(json_dump) + ) + ) + + +def print_attributes(obj, filter_string=None, hide_privates=False): + """ + Useful helper method to quickly get all attributes of an object and its + values. + """ + for attr in dir(obj): + if hide_privates and "__" in attr: + continue + if filter_string is not None and filter_string not in attr: + continue + value = getattr(obj, attr) + print("%s.%s" % ('obj', attr), value, type(value)) diff --git a/examples/iframe_injector.py b/examples/iframe_injector.py new file mode 100644 index 00000000..fc38b136 --- /dev/null +++ b/examples/iframe_injector.py @@ -0,0 +1,27 @@ +# Usage: mitmdump -s "iframe_injector.py url" +# (this script works best with --anticache) +from bs4 import BeautifulSoup +from mitmproxy.models import decoded + + +def start(context, argv): + if len(argv) != 2: + raise ValueError('Usage: -s "iframe_injector.py url"') + context.iframe_url = argv[1] + + +def response(context, flow): + if flow.request.host in context.iframe_url: + return + with decoded(flow.response): # Remove content encoding (gzip, ...) + html = BeautifulSoup(flow.response.content) + if html.body: + iframe = html.new_tag( + "iframe", + src=context.iframe_url, + frameborder=0, + height=0, + width=0) + html.body.insert(0, iframe) + flow.response.content = str(html) + context.log("Iframe inserted.") diff --git a/examples/mitmproxywrapper.py b/examples/mitmproxywrapper.py new file mode 100644 index 00000000..7ea10715 --- /dev/null +++ b/examples/mitmproxywrapper.py @@ -0,0 +1,166 @@ +#!/usr/bin/env python +# +# Helper tool to enable/disable OS X proxy and wrap mitmproxy +# +# Get usage information with: +# +# mitmproxywrapper.py -h +# + +import subprocess +import re +import argparse +import contextlib +import os +import sys + + +class Wrapper(object): + + def __init__(self, port, extra_arguments=None): + self.port = port + self.extra_arguments = extra_arguments + + def run_networksetup_command(self, *arguments): + return subprocess.check_output( + ['sudo', 'networksetup'] + list(arguments)) + + def proxy_state_for_service(self, service): + state = self.run_networksetup_command( + '-getwebproxy', + service).splitlines() + return dict([re.findall(r'([^:]+): (.*)', line)[0] for line in state]) + + def enable_proxy_for_service(self, service): + print('Enabling proxy on {}...'.format(service)) + for subcommand in ['-setwebproxy', '-setsecurewebproxy']: + self.run_networksetup_command( + subcommand, service, '127.0.0.1', str( + self.port)) + + def disable_proxy_for_service(self, service): + print('Disabling proxy on {}...'.format(service)) + for subcommand in ['-setwebproxystate', '-setsecurewebproxystate']: + self.run_networksetup_command(subcommand, service, 'Off') + + def interface_name_to_service_name_map(self): + order = self.run_networksetup_command('-listnetworkserviceorder') + mapping = re.findall( + r'\(\d+\)\s(.*)$\n\(.*Device: (.+)\)$', + order, + re.MULTILINE) + return dict([(b, a) for (a, b) in mapping]) + + def run_command_with_input(self, command, input): + popen = subprocess.Popen( + command, + stdin=subprocess.PIPE, + stdout=subprocess.PIPE) + (stdout, stderr) = popen.communicate(input) + return stdout + + def primary_interace_name(self): + scutil_script = 'get State:/Network/Global/IPv4\nd.show\n' + stdout = self.run_command_with_input('/usr/sbin/scutil', scutil_script) + interface, = re.findall(r'PrimaryInterface\s*:\s*(.+)', stdout) + return interface + + def primary_service_name(self): + return self.interface_name_to_service_name_map()[ + self.primary_interace_name()] + + def proxy_enabled_for_service(self, service): + return self.proxy_state_for_service(service)['Enabled'] == 'Yes' + + def toggle_proxy(self): + new_state = not self.proxy_enabled_for_service( + self.primary_service_name()) + for service_name in self.connected_service_names(): + if self.proxy_enabled_for_service(service_name) and not new_state: + self.disable_proxy_for_service(service_name) + elif not self.proxy_enabled_for_service(service_name) and new_state: + self.enable_proxy_for_service(service_name) + + def connected_service_names(self): + scutil_script = 'list\n' + stdout = self.run_command_with_input('/usr/sbin/scutil', scutil_script) + service_ids = re.findall(r'State:/Network/Service/(.+)/IPv4', stdout) + + service_names = [] + for service_id in service_ids: + scutil_script = 'show Setup:/Network/Service/{}\n'.format( + service_id) + stdout = self.run_command_with_input( + '/usr/sbin/scutil', + scutil_script) + service_name, = re.findall(r'UserDefinedName\s*:\s*(.+)', stdout) + service_names.append(service_name) + + return service_names + + def wrap_mitmproxy(self): + with self.wrap_proxy(): + cmd = ['mitmproxy', '-p', str(self.port)] + if self.extra_arguments: + cmd.extend(self.extra_arguments) + subprocess.check_call(cmd) + + def wrap_honeyproxy(self): + with self.wrap_proxy(): + popen = subprocess.Popen('honeyproxy.sh') + try: + popen.wait() + except KeyboardInterrupt: + popen.terminate() + + @contextlib.contextmanager + def wrap_proxy(self): + connected_service_names = self.connected_service_names() + for service_name in connected_service_names: + if not self.proxy_enabled_for_service(service_name): + self.enable_proxy_for_service(service_name) + + yield + + for service_name in connected_service_names: + if self.proxy_enabled_for_service(service_name): + self.disable_proxy_for_service(service_name) + + @classmethod + def ensure_superuser(cls): + if os.getuid() != 0: + print('Relaunching with sudo...') + os.execv('/usr/bin/sudo', ['/usr/bin/sudo'] + sys.argv) + + @classmethod + def main(cls): + parser = argparse.ArgumentParser( + description='Helper tool for OS X proxy configuration and mitmproxy.', + epilog='Any additional arguments will be passed on unchanged to mitmproxy.') + parser.add_argument( + '-t', + '--toggle', + action='store_true', + help='just toggle the proxy configuration') +# parser.add_argument('--honeyproxy', action='store_true', help='run honeyproxy instead of mitmproxy') + parser.add_argument( + '-p', + '--port', + type=int, + help='override the default port of 8080', + default=8080) + args, extra_arguments = parser.parse_known_args() + + wrapper = cls(port=args.port, extra_arguments=extra_arguments) + + if args.toggle: + wrapper.toggle_proxy() +# elif args.honeyproxy: +# wrapper.wrap_honeyproxy() + else: + wrapper.wrap_mitmproxy() + + +if __name__ == '__main__': + Wrapper.ensure_superuser() + Wrapper.main() diff --git a/examples/modify_form.py b/examples/modify_form.py new file mode 100644 index 00000000..3e9d15c0 --- /dev/null +++ b/examples/modify_form.py @@ -0,0 +1,5 @@ +def request(context, flow): + if "application/x-www-form-urlencoded" in flow.request.headers.get("content-type", ""): + form = flow.request.get_form_urlencoded() + form["mitmproxy"] = ["rocks"] + flow.request.set_form_urlencoded(form) diff --git a/examples/modify_querystring.py b/examples/modify_querystring.py new file mode 100644 index 00000000..7f31a48f --- /dev/null +++ b/examples/modify_querystring.py @@ -0,0 +1,6 @@ + +def request(context, flow): + q = flow.request.get_query() + if q: + q["mitmproxy"] = ["rocks"] + flow.request.set_query(q) diff --git a/examples/modify_response_body.py b/examples/modify_response_body.py new file mode 100644 index 00000000..88f69e15 --- /dev/null +++ b/examples/modify_response_body.py @@ -0,0 +1,18 @@ +# Usage: mitmdump -s "modify_response_body.py mitmproxy bananas" +# (this script works best with --anticache) +from mitmproxy.models import decoded + + +def start(context, argv): + if len(argv) != 3: + raise ValueError('Usage: -s "modify-response-body.py old new"') + # You may want to use Python's argparse for more sophisticated argument + # parsing. + context.old, context.new = argv[1], argv[2] + + +def response(context, flow): + with decoded(flow.response): # automatically decode gzipped responses. + flow.response.content = flow.response.content.replace( + context.old, + context.new) diff --git a/examples/nonblocking.py b/examples/nonblocking.py new file mode 100644 index 00000000..41674b2a --- /dev/null +++ b/examples/nonblocking.py @@ -0,0 +1,9 @@ +import time +from mitmproxy.script import concurrent + + +@concurrent # Remove this and see what happens +def request(context, flow): + print("handle request: %s%s" % (flow.request.host, flow.request.path)) + time.sleep(5) + print("start request: %s%s" % (flow.request.host, flow.request.path)) diff --git a/examples/proxapp.py b/examples/proxapp.py new file mode 100644 index 00000000..4d8e7b58 --- /dev/null +++ b/examples/proxapp.py @@ -0,0 +1,24 @@ +""" +This example shows how to graft a WSGI app onto mitmproxy. In this +instance, we're using the Flask framework (http://flask.pocoo.org/) to expose +a single simplest-possible page. +""" +from flask import Flask + +app = Flask("proxapp") + + +@app.route('/') +def hello_world(): + return 'Hello World!' + + +# Register the app using the magic domain "proxapp" on port 80. Requests to +# this domain and port combination will now be routed to the WSGI app instance. +def start(context, argv): + context.app_registry.add(app, "proxapp", 80) + + # SSL works too, but the magic domain needs to be resolvable from the mitmproxy machine due to mitmproxy's design. + # mitmproxy will connect to said domain and use serve its certificate (unless --no-upstream-cert is set) + # but won't send any data. + context.app_registry.add(app, "example.com", 443) diff --git a/examples/read_dumpfile b/examples/read_dumpfile new file mode 100644 index 00000000..56746bb8 --- /dev/null +++ b/examples/read_dumpfile @@ -0,0 +1,20 @@ +#!/usr/bin/env python +# +# Simple script showing how to read a mitmproxy dump file +# + +from mitmproxy import flow +import pprint +import sys + +with open(sys.argv[1], "rb") as logfile: + freader = flow.FlowReader(logfile) + pp = pprint.PrettyPrinter(indent=4) + try: + for f in freader.stream(): + print(f) + print(f.request.host) + pp.pprint(f.get_state()) + print("") + except flow.FlowReadError as v: + print "Flow file corrupted. Stopped loading." diff --git a/examples/redirect_requests.py b/examples/redirect_requests.py new file mode 100644 index 00000000..c0a0ccba --- /dev/null +++ b/examples/redirect_requests.py @@ -0,0 +1,22 @@ +""" +This example shows two ways to redirect flows to other destinations. +""" +from mitmproxy.models import HTTPResponse +from netlib.http import Headers + +def request(context, flow): + # pretty_host takes the "Host" header of the request into account, + # which is useful in transparent mode where we usually only have the IP + # otherwise. + + # Method 1: Answer with a locally generated response + if flow.request.pretty_host.endswith("example.com"): + resp = HTTPResponse( + "HTTP/1.1", 200, "OK", + Headers(Content_Type="text/html"), + "helloworld") + flow.reply(resp) + + # Method 2: Redirect the request to a different server + if flow.request.pretty_host.endswith("example.org"): + flow.request.host = "mitmproxy.org" diff --git a/examples/sslstrip.py b/examples/sslstrip.py new file mode 100644 index 00000000..369427a2 --- /dev/null +++ b/examples/sslstrip.py @@ -0,0 +1,40 @@ +from netlib.http import decoded +import re +from six.moves import urllib + +def start(context, argv) : + + #set of SSL/TLS capable hosts + context.secure_hosts = set() + +def request(context, flow) : + + flow.request.headers.pop('If-Modified-Since', None) + flow.request.headers.pop('Cache-Control', None) + + #proxy connections to SSL-enabled hosts + if flow.request.pretty_host in context.secure_hosts : + flow.request.scheme = 'https' + flow.request.port = 443 + +def response(context, flow) : + + with decoded(flow.response) : + flow.request.headers.pop('Strict-Transport-Security', None) + flow.request.headers.pop('Public-Key-Pins', None) + + #strip links in response body + flow.response.content = flow.response.content.replace('https://', 'http://') + + #strip links in 'Location' header + if flow.response.headers.get('Location','').startswith('https://'): + location = flow.response.headers['Location'] + hostname = urllib.parse.urlparse(location).hostname + if hostname: + context.secure_hosts.add(hostname) + flow.response.headers['Location'] = location.replace('https://', 'http://', 1) + + #strip secure flag from 'Set-Cookie' headers + cookies = flow.response.headers.get_all('Set-Cookie') + cookies = [re.sub(r';\s*secure\s*', '', s) for s in cookies] + flow.response.headers.set_all('Set-Cookie', cookies) diff --git a/examples/stickycookies b/examples/stickycookies new file mode 100644 index 00000000..8f11de8d --- /dev/null +++ b/examples/stickycookies @@ -0,0 +1,42 @@ +#!/usr/bin/env python +""" +This example builds on mitmproxy's base proxying infrastructure to +implement functionality similar to the "sticky cookies" option. + +Heads Up: In the majority of cases, you want to use inline scripts. +""" +import os +from mitmproxy import controller, proxy +from mitmproxy.proxy.server import ProxyServer + + +class StickyMaster(controller.Master): + def __init__(self, server): + controller.Master.__init__(self, server) + self.stickyhosts = {} + + def run(self): + try: + return controller.Master.run(self) + except KeyboardInterrupt: + self.shutdown() + + def handle_request(self, flow): + hid = (flow.request.host, flow.request.port) + if "cookie" in flow.request.headers: + self.stickyhosts[hid] = flow.request.headers.get_all("cookie") + elif hid in self.stickyhosts: + flow.request.headers.set_all("cookie", self.stickyhosts[hid]) + flow.reply() + + def handle_response(self, flow): + hid = (flow.request.host, flow.request.port) + if "set-cookie" in flow.response.headers: + self.stickyhosts[hid] = flow.response.headers.get_all("set-cookie") + flow.reply() + + +config = proxy.ProxyConfig(port=8080) +server = ProxyServer(config) +m = StickyMaster(server) +m.run() diff --git a/examples/stream.py b/examples/stream.py new file mode 100644 index 00000000..3adbe437 --- /dev/null +++ b/examples/stream.py @@ -0,0 +1,5 @@ +def responseheaders(context, flow): + """ + Enables streaming for all responses. + """ + flow.response.stream = True diff --git a/examples/stream_modify.py b/examples/stream_modify.py new file mode 100644 index 00000000..aa395c03 --- /dev/null +++ b/examples/stream_modify.py @@ -0,0 +1,20 @@ +""" +This inline script modifies a streamed response. +If you do not need streaming, see the modify_response_body example. +Be aware that content replacement isn't trivial: + - If the transfer encoding isn't chunked, you cannot simply change the content length. + - If you want to replace all occurences of "foobar", make sure to catch the cases + where one chunk ends with [...]foo" and the next starts with "bar[...]. +""" + + +def modify(chunks): + """ + chunks is a generator that can be used to iterate over all chunks. + """ + for chunk in chunks: + yield chunk.replace("foo", "bar") + + +def responseheaders(context, flow): + flow.response.stream = modify diff --git a/examples/stub.py b/examples/stub.py new file mode 100644 index 00000000..516b71a5 --- /dev/null +++ b/examples/stub.py @@ -0,0 +1,79 @@ +""" + This is a script stub, with definitions for all events. +""" + + +def start(context, argv): + """ + Called once on script startup, before any other events. + """ + context.log("start") + + +def clientconnect(context, root_layer): + """ + Called when a client initiates a connection to the proxy. Note that a + connection can correspond to multiple HTTP requests + """ + context.log("clientconnect") + + +def request(context, flow): + """ + Called when a client request has been received. + """ + context.log("request") + + +def serverconnect(context, server_conn): + """ + Called when the proxy initiates a connection to the target server. Note that a + connection can correspond to multiple HTTP requests + """ + context.log("serverconnect") + + +def responseheaders(context, flow): + """ + Called when the response headers for a server response have been received, + but the response body has not been processed yet. Can be used to tell mitmproxy + to stream the response. + """ + context.log("responseheaders") + + +def response(context, flow): + """ + Called when a server response has been received. + """ + context.log("response") + + +def error(context, flow): + """ + Called when a flow error has occured, e.g. invalid server responses, or + interrupted connections. This is distinct from a valid server HTTP error + response, which is simply a response with an HTTP error code. + """ + context.log("error") + + +def serverdisconnect(context, server_conn): + """ + Called when the proxy closes the connection to the target server. + """ + context.log("serverdisconnect") + + +def clientdisconnect(context, root_layer): + """ + Called when a client disconnects from the proxy. + """ + context.log("clientdisconnect") + + +def done(context): + """ + Called once on script shutdown, after any other events. + """ + context.log("done") diff --git a/examples/tcp_message.py b/examples/tcp_message.py new file mode 100644 index 00000000..c63368e4 --- /dev/null +++ b/examples/tcp_message.py @@ -0,0 +1,24 @@ +''' +tcp_message Inline Script Hook API Demonstration +------------------------------------------------ + +* modifies packets containing "foo" to "bar" +* prints various details for each packet. + +example cmdline invocation: +mitmdump -T --host --tcp ".*" -q -s examples/tcp_message.py +''' +from netlib.utils import clean_bin + +def tcp_message(ctx, tcp_msg): + modified_msg = tcp_msg.message.replace("foo", "bar") + + is_modified = False if modified_msg == tcp_msg.message else True + tcp_msg.message = modified_msg + + print("[tcp_message{}] from {} {} to {} {}:\r\n{}".format( + " (modified)" if is_modified else "", + "client" if tcp_msg.sender == tcp_msg.client_conn else "server", + tcp_msg.sender.address, + "server" if tcp_msg.receiver == tcp_msg.server_conn else "client", + tcp_msg.receiver.address, clean_bin(tcp_msg.message))) diff --git a/examples/tls_passthrough.py b/examples/tls_passthrough.py new file mode 100644 index 00000000..8c8fa4eb --- /dev/null +++ b/examples/tls_passthrough.py @@ -0,0 +1,136 @@ +""" +This inline script allows conditional TLS Interception based +on a user-defined strategy. + +Example: + + > mitmdump -s tls_passthrough.py + + 1. curl --proxy http://localhost:8080 https://example.com --insecure + // works - we'll also see the contents in mitmproxy + + 2. curl --proxy http://localhost:8080 https://example.com --insecure + // still works - we'll also see the contents in mitmproxy + + 3. curl --proxy http://localhost:8080 https://example.com + // fails with a certificate error, which we will also see in mitmproxy + + 4. curl --proxy http://localhost:8080 https://example.com + // works again, but mitmproxy does not intercept and we do *not* see the contents + +Authors: Maximilian Hils, Matthew Tuusberg +""" +from __future__ import (absolute_import, print_function, division) +import collections +import random + +from enum import Enum + +from mitmproxy.exceptions import TlsProtocolException +from mitmproxy.protocol import TlsLayer, RawTCPLayer + + +class InterceptionResult(Enum): + success = True + failure = False + skipped = None + + +class _TlsStrategy(object): + """ + Abstract base class for interception strategies. + """ + def __init__(self): + # A server_address -> interception results mapping + self.history = collections.defaultdict(lambda: collections.deque(maxlen=200)) + + def should_intercept(self, server_address): + """ + Returns: + True, if we should attempt to intercept the connection. + False, if we want to employ pass-through instead. + """ + raise NotImplementedError() + + def record_success(self, server_address): + self.history[server_address].append(InterceptionResult.success) + + def record_failure(self, server_address): + self.history[server_address].append(InterceptionResult.failure) + + def record_skipped(self, server_address): + self.history[server_address].append(InterceptionResult.skipped) + + +class ConservativeStrategy(_TlsStrategy): + """ + Conservative Interception Strategy - only intercept if there haven't been any failed attempts + in the history. + """ + + def should_intercept(self, server_address): + if InterceptionResult.failure in self.history[server_address]: + return False + return True + + +class ProbabilisticStrategy(_TlsStrategy): + """ + Fixed probability that we intercept a given connection. + """ + def __init__(self, p): + self.p = p + super(ProbabilisticStrategy, self).__init__() + + def should_intercept(self, server_address): + return random.uniform(0, 1) < self.p + + +class TlsFeedback(TlsLayer): + """ + Monkey-patch _establish_tls_with_client to get feedback if TLS could be established + successfully on the client connection (which may fail due to cert pinning). + """ + + def _establish_tls_with_client(self): + server_address = self.server_conn.address + tls_strategy = self.script_context.tls_strategy + + try: + super(TlsFeedback, self)._establish_tls_with_client() + except TlsProtocolException as e: + tls_strategy.record_failure(server_address) + raise e + else: + tls_strategy.record_success(server_address) + + +# inline script hooks below. + + +def start(context, argv): + if len(argv) == 2: + context.tls_strategy = ProbabilisticStrategy(float(argv[1])) + else: + context.tls_strategy = ConservativeStrategy() + + +def next_layer(context, next_layer): + """ + This hook does the actual magic - if the next layer is planned to be a TLS layer, + we check if we want to enter pass-through mode instead. + """ + if isinstance(next_layer, TlsLayer) and next_layer._client_tls: + server_address = next_layer.server_conn.address + + if context.tls_strategy.should_intercept(server_address): + # We try to intercept. + # Monkey-Patch the layer to get feedback from the TLSLayer if interception worked. + next_layer.__class__ = TlsFeedback + next_layer.script_context = context + else: + # We don't intercept - reply with a pass-through layer and add a "skipped" entry. + context.log("TLS passthrough for %s" % repr(next_layer.server_conn.address), "info") + next_layer_replacement = RawTCPLayer(next_layer.ctx, logging=False) + next_layer.reply(next_layer_replacement) + context.tls_strategy.record_skipped(server_address) diff --git a/examples/upsidedownternet.py b/examples/upsidedownternet.py new file mode 100644 index 00000000..b7489cb6 --- /dev/null +++ b/examples/upsidedownternet.py @@ -0,0 +1,17 @@ +import cStringIO +from PIL import Image +from mitmproxy.models import decoded + + +def response(context, flow): + if flow.response.headers.get("content-type", "").startswith("image"): + with decoded(flow.response): # automatically decode gzipped responses. + try: + s = cStringIO.StringIO(flow.response.content) + img = Image.open(s).rotate(180) + s2 = cStringIO.StringIO() + img.save(s2, "png") + flow.response.content = s2.getvalue() + flow.response.headers["content-type"] = "image/png" + except: # Unknown image types etc. + pass diff --git a/mitmproxy/docs/.gitignore b/mitmproxy/docs/.gitignore deleted file mode 100644 index 69fa449d..00000000 --- a/mitmproxy/docs/.gitignore +++ /dev/null @@ -1 +0,0 @@ -_build/ diff --git a/mitmproxy/docs/Makefile b/mitmproxy/docs/Makefile deleted file mode 100644 index 74bcda53..00000000 --- a/mitmproxy/docs/Makefile +++ /dev/null @@ -1,195 +0,0 @@ -# Makefile for Sphinx documentation -# - -# You can set these variables from the command line. -SPHINXOPTS = -SPHINXBUILD = sphinx-build -PAPER = -BUILDDIR = _build - -# User-friendly check for sphinx-build -ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1) -$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/) -endif - -# Internal variables. -PAPEROPT_a4 = -D latex_paper_size=a4 -PAPEROPT_letter = -D latex_paper_size=letter -ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . -# the i18n builder cannot share the environment and doctrees with the others -I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . - -.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext - -help: - @echo "Please use \`make ' where is one of" - @echo " html to make standalone HTML files" - @echo " dirhtml to make HTML files named index.html in directories" - @echo " singlehtml to make a single large HTML file" - @echo " pickle to make pickle files" - @echo " json to make JSON files" - @echo " htmlhelp to make HTML files and a HTML help project" - @echo " qthelp to make HTML files and a qthelp project" - @echo " applehelp to make an Apple Help Book" - @echo " devhelp to make HTML files and a Devhelp project" - @echo " epub to make an epub" - @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" - @echo " latexpdf to make LaTeX files and run them through pdflatex" - @echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx" - @echo " text to make text files" - @echo " man to make manual pages" - @echo " texinfo to make Texinfo files" - @echo " info to make Texinfo files and run them through makeinfo" - @echo " gettext to make PO message catalogs" - @echo " changes to make an overview of all changed/added/deprecated items" - @echo " xml to make Docutils-native XML files" - @echo " pseudoxml to make pseudoxml-XML files for display purposes" - @echo " linkcheck to check all external links for integrity" - @echo " doctest to run all doctests embedded in the documentation (if enabled)" - @echo " coverage to run coverage check of the documentation (if enabled)" - -clean: - rm -rf $(BUILDDIR)/* - -html: - $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html - @echo - @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." - -dirhtml: - $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml - @echo - @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." - -singlehtml: - $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml - @echo - @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml." - -pickle: - $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle - @echo - @echo "Build finished; now you can process the pickle files." - -json: - $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json - @echo - @echo "Build finished; now you can process the JSON files." - -htmlhelp: - $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp - @echo - @echo "Build finished; now you can run HTML Help Workshop with the" \ - ".hhp project file in $(BUILDDIR)/htmlhelp." - -qthelp: - $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp - @echo - @echo "Build finished; now you can run "qcollectiongenerator" with the" \ - ".qhcp project file in $(BUILDDIR)/qthelp, like this:" - @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/mitmproxy.qhcp" - @echo "To view the help file:" - @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/mitmproxy.qhc" - -applehelp: - $(SPHINXBUILD) -b applehelp $(ALLSPHINXOPTS) $(BUILDDIR)/applehelp - @echo - @echo "Build finished. The help book is in $(BUILDDIR)/applehelp." - @echo "N.B. You won't be able to view it unless you put it in" \ - "~/Library/Documentation/Help or install it in your application" \ - "bundle." - -devhelp: - $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp - @echo - @echo "Build finished." - @echo "To view the help file:" - @echo "# mkdir -p $$HOME/.local/share/devhelp/mitmproxy" - @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/mitmproxy" - @echo "# devhelp" - -epub: - $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub - @echo - @echo "Build finished. The epub file is in $(BUILDDIR)/epub." - -latex: - $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex - @echo - @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." - @echo "Run \`make' in that directory to run these through (pdf)latex" \ - "(use \`make latexpdf' here to do that automatically)." - -latexpdf: - $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex - @echo "Running LaTeX files through pdflatex..." - $(MAKE) -C $(BUILDDIR)/latex all-pdf - @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." - -latexpdfja: - $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex - @echo "Running LaTeX files through platex and dvipdfmx..." - $(MAKE) -C $(BUILDDIR)/latex all-pdf-ja - @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." - -text: - $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text - @echo - @echo "Build finished. The text files are in $(BUILDDIR)/text." - -man: - $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man - @echo - @echo "Build finished. The manual pages are in $(BUILDDIR)/man." - -texinfo: - $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo - @echo - @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo." - @echo "Run \`make' in that directory to run these through makeinfo" \ - "(use \`make info' here to do that automatically)." - -info: - $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo - @echo "Running Texinfo files through makeinfo..." - make -C $(BUILDDIR)/texinfo info - @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo." - -gettext: - $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale - @echo - @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale." - -changes: - $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes - @echo - @echo "The overview file is in $(BUILDDIR)/changes." - -linkcheck: - $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck - @echo - @echo "Link check complete; look for any errors in the above output " \ - "or in $(BUILDDIR)/linkcheck/output.txt." - -doctest: - $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest - @echo "Testing of doctests in the sources finished, look at the " \ - "results in $(BUILDDIR)/doctest/output.txt." - -coverage: - $(SPHINXBUILD) -b coverage $(ALLSPHINXOPTS) $(BUILDDIR)/coverage - @echo "Testing of coverage in the sources finished, look at the " \ - "results in $(BUILDDIR)/coverage/python.txt." - -xml: - $(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml - @echo - @echo "Build finished. The XML files are in $(BUILDDIR)/xml." - -pseudoxml: - $(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml - @echo - @echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml." - -livehtml: - sphinx-autobuild -b html -z '../mitmproxy' -z '../../netlib/netlib' -r '___jb_(old|bak)___$$' $(ALLSPHINXOPTS) $(BUILDDIR)/html \ No newline at end of file diff --git a/mitmproxy/docs/_templates/page.html b/mitmproxy/docs/_templates/page.html deleted file mode 100644 index 8002396a..00000000 --- a/mitmproxy/docs/_templates/page.html +++ /dev/null @@ -1,10 +0,0 @@ -{% extends "!page.html" %} -{% block sidebartitle %} - - - - {{ super() }} -{% endblock %} \ No newline at end of file diff --git a/mitmproxy/docs/certinstall-webapp.png b/mitmproxy/docs/certinstall-webapp.png deleted file mode 100644 index 10e795cd..00000000 Binary files a/mitmproxy/docs/certinstall-webapp.png and /dev/null differ diff --git a/mitmproxy/docs/certinstall.rst b/mitmproxy/docs/certinstall.rst deleted file mode 100644 index 5a8cce64..00000000 --- a/mitmproxy/docs/certinstall.rst +++ /dev/null @@ -1,195 +0,0 @@ -.. _certinstall: - -About Certificates -================== - -Introduction ------------- - -Mitmproxy can decrypt encrypted traffic on the fly, as long as the client -trusts its built-in certificate authority. Usually this means that the -mitmproxy CA certificates have to be installed on the client device. - -Quick Setup ------------ - -By far the easiest way to install the mitmproxy certificates is to use the -built-in certificate installation app. To do this, just start mitmproxy and -configure your target device with the correct proxy settings. Now start a -browser on the device, and visit the magic domain **mitm.it**. You should see -something like this: - -.. image:: certinstall-webapp.png - -Click on the relevant icon, follow the setup instructions for the platform -you're on and you are good to go. - - -Installing the mitmproxy CA certificate manually ------------------------------------------------- - -Sometimes using the quick install app is not an option - Java or the iOS -Simulator spring to mind - or you just need to do it manually for some other -reason. Below is a list of pointers to manual certificate installation -documentation for some common platforms. - -The mitmproxy CA cert is located in ``~/.mitmproxy`` after it has been generated at the first -start of mitmproxy. - - -iOS -^^^ - -http://kb.mit.edu/confluence/pages/viewpage.action?pageId=152600377 - -iOS Simulator -^^^^^^^^^^^^^ - -See https://github.com/ADVTOOLS/ADVTrustStore#how-to-use-advtruststore - -Java -^^^^ - -See http://docs.oracle.com/cd/E19906-01/820-4916/geygn/index.html - -Android/Android Simulator -^^^^^^^^^^^^^^^^^^^^^^^^^ - -See http://wiki.cacert.org/FAQ/ImportRootCert#Android_Phones_.26_Tablets - -Windows -^^^^^^^ - -See http://windows.microsoft.com/en-ca/windows/import-export-certificates-private-keys#1TC=windows-7 - -Windows (automated) -^^^^^^^^^^^^^^^^^^^ - ->>> certutil.exe -importpfx mitmproxy-ca-cert.p12 - -See also: https://technet.microsoft.com/en-us/library/cc732443.aspx - -Mac OS X -^^^^^^^^ - -See https://support.apple.com/kb/PH7297?locale=en_US - -Ubuntu/Debian -^^^^^^^^^^^^^ - -See http://askubuntu.com/questions/73287/how-do-i-install-a-root-certificate/94861#94861 - -Mozilla Firefox -^^^^^^^^^^^^^^^ - -See https://wiki.mozilla.org/MozillaRootCertificate#Mozilla_Firefox - -Chrome on Linux -^^^^^^^^^^^^^^^ - -See https://code.google.com/p/chromium/wiki/LinuxCertManagement - - -The mitmproxy certificate authority ------------------------------------ - -The first time **mitmproxy** or **mitmdump** is run, the mitmproxy Certificate -Authority (CA) is created in the config directory (``~/.mitmproxy`` by default). -This CA is used for on-the-fly generation of dummy certificates for each of the -SSL sites that your client visits. Since your browser won't trust the -mitmproxy CA out of the box, you will see an SSL certificate warning every -time you visit a new SSL domain through mitmproxy. When you are testing a -single site through a browser, just accepting the bogus SSL cert manually is -not too much trouble, but there are a many circumstances where you will want to -configure your testing system or browser to trust the mitmproxy CA as a -signing root authority. For security reasons, the mitmproxy CA is generated uniquely on the first start and is not shared between mitmproxy installations on different devices. - -Certificate Pinning -^^^^^^^^^^^^^^^^^^^ - -Some applications employ `Certificate Pinning`_ to prevent man-in-the-middle attacks. -This means that **mitmproxy** and **mitmdump's** certificates will not be -accepted by these applications without modifying them. It is recommended to use the -:ref:`passthrough` feature in order to prevent **mitmproxy** and **mitmdump** from intercepting -traffic to these specific domains. If you want to intercept the pinned connections, you need to patch the application manually. For Android and (jailbroken) iOS devices, various tools exist to accomplish this. - - -CA and cert files ------------------ - -The files created by mitmproxy in the .mitmproxy directory are as follows: - -===================== ========================================================================== -mitmproxy-ca.pem The certificate **and the private key** in PEM format. -mitmproxy-ca-cert.pem The certificate in PEM format. - Use this to distribute on most non-Windows platforms. -mitmproxy-ca-cert.p12 The certificate in PKCS12 format. For use on Windows. -mitmproxy-ca-cert.cer Same file as .pem, but with an extension expected by some Android devices. -===================== ========================================================================== - -Using a custom certificate --------------------------- - -You can use your own certificate by passing the ``--cert`` option to -mitmproxy. Mitmproxy then uses the provided certificate for interception of the -specified domains instead of generating a certificate signed by its own CA. - -The certificate file is expected to be in the PEM format. You can include -intermediary certificates right below your leaf certificate, so that you PEM -file roughly looks like this: - -.. code-block:: none - - -----BEGIN PRIVATE KEY----- - - -----END PRIVATE KEY----- - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - - -For example, you can generate a certificate in this format using these instructions: - - ->>> openssl genrsa -out cert.key 2048 ->>> openssl req -new -x509 -key cert.key -out cert.crt - (Specify the mitm domain as Common Name, e.g. *.google.com) ->>> cat cert.key cert.crt > cert.pem ->>> mitmproxy --cert=cert.pem - - -Using a custom certificate authority ------------------------------------- - -By default, mitmproxy will use ``~/.mitmproxy/mitmproxy-ca.pem`` as -the certificate authority to generate certificates for all domains for which no -custom certificate is provided (see above). You can use your own certificate -authority by passing the ``--cadir DIRECTORY`` option to mitmproxy. Mitmproxy -will then look for ``mitmproxy-ca.pem`` in the specified directory. If -no such file exists, it will be generated automatically. - - -Using a client side certificate -------------------------------- - -You can use a client certificate by passing the ``--client-certs DIRECTORY|FILE`` -option to mitmproxy. Using a directory allows certs to be selected based on -hostname, while using a filename allows a single specific certificate to be used for -all SSL connections. Certificate files must be in the PEM format and should -contain both the unencrypted private key and the certificate. - -Multiple certs by Hostname -^^^^^^^^^^^^^^^^^^^^^^^^^^ - -If you've specified a directory to ``--client-certs``, then the following -behavior will be taken: - -If you visit example.org, mitmproxy looks for a file named ``example.org.pem`` in the specified -directory and uses this as the client cert. - - - -.. _Certificate Pinning: http://security.stackexchange.com/questions/29988/what-is-certificate-pinning/ \ No newline at end of file diff --git a/mitmproxy/docs/conf.py b/mitmproxy/docs/conf.py deleted file mode 100644 index 01bcce1b..00000000 --- a/mitmproxy/docs/conf.py +++ /dev/null @@ -1,219 +0,0 @@ -# -*- coding: utf-8 -*- -# -# mitmproxy documentation build configuration file, created by -# sphinx-quickstart on Thu Sep 03 14:04:13 2015. -# -# This file is execfile()d with the current directory set to its -# containing dir. -# -# Note that not all possible configuration values are present in this -# autogenerated file. -# -# All configuration values have a default; values that are commented out -# serve to show the default. - -import sys -import os -import shlex - -# If extensions (or modules to document with autodoc) are in another directory, -# add these directories to sys.path here. If the directory is relative to the -# documentation root, use os.path.abspath to make it absolute, like shown here. -sys.path.insert(0, os.path.abspath('..')) - -import mitmproxy.version - -# -- General configuration ------------------------------------------------ - -# If your documentation needs a minimal Sphinx version, state it here. -#needs_sphinx = '1.0' - -# Add any Sphinx extension module names here, as strings. They can be -# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom -# ones. - -extensions = [ - 'sphinx.ext.autodoc', - 'sphinx.ext.doctest', - 'sphinx.ext.viewcode', - 'sphinx.ext.napoleon', - 'sphinxcontrib.documentedlist' -] - -# https://github.com/sphinx-doc/sphinx/pull/2053 -napoleon_include_special_with_doc = False - -autodoc_member_order = "bysource" - -# Add any paths that contain templates here, relative to this directory. -templates_path = ['_templates'] - -# The suffix(es) of source filenames. -# You can specify multiple suffix as a list of string: -# source_suffix = ['.rst', '.md'] -source_suffix = '.rst' - -# The encoding of source files. -#source_encoding = 'utf-8-sig' - -# The master toctree document. -master_doc = 'index' - -# General information about the project. -project = u'mitmproxy docs' -copyright = u'2015, the mitmproxy project' -author = u'The mitmproxy project' - -# The version info for the project you're documenting, acts as replacement for -# |version| and |release|, also used in various other places throughout the -# built documents. -# -# The short X.Y version. -version = mitmproxy.version.VERSION -# The full version, including alpha/beta/rc tags. -release = mitmproxy.version.VERSION - -# The language for content autogenerated by Sphinx. Refer to documentation -# for a list of supported languages. -# -# This is also used if you do content translation via gettext catalogs. -# Usually you set "language" from the command line for these cases. -language = None - -# There are two options for replacing |today|: either, you set today to some -# non-false value, then it is used: -#today = '' -# Else, today_fmt is used as the format for a strftime call. -#today_fmt = '%B %d, %Y' - -# List of patterns, relative to source directory, that match files and -# directories to ignore when looking for source files. -exclude_patterns = ['_build'] - -# The reST default role (used for this markup: `text`) to use for all -# documents. -#default_role = None - -# If true, '()' will be appended to :func: etc. cross-reference text. -#add_function_parentheses = True - -# If true, the current module name will be prepended to all description -# unit titles (such as .. function::). -#add_module_names = True - -# If true, sectionauthor and moduleauthor directives will be shown in the -# output. They are ignored by default. -#show_authors = False - -# The name of the Pygments (syntax highlighting) style to use. -pygments_style = 'sphinx' - -# A list of ignored prefixes for module index sorting. -modindex_common_prefix = ['mitmproxy.'] - -# If true, keep warnings as "system message" paragraphs in the built documents. -#keep_warnings = False - -# If true, `todo` and `todoList` produce output, else they produce nothing. -todo_include_todos = False - - -# -- Options for HTML output ---------------------------------------------- - -# The theme to use for HTML and HTML Help pages. See the documentation for -# a list of builtin themes. -html_theme = 'sphinx_rtd_theme' - -# Theme options are theme-specific and customize the look and feel of a theme -# further. For a list of options available for each theme, see the -# documentation. -html_theme_options = { - 'logo_only': True, -} - -# Add any paths that contain custom themes here, relative to this directory. -#html_theme_path = [] - -# The name for this set of Sphinx documents. If None, it defaults to -# " v documentation". -html_title = "mitmproxy %s documentation" % version - -# A shorter title for the navigation bar. Default is the same as html_title. -#html_short_title = None - -# The name of an image file (relative to this directory) to place at the top -# of the sidebar. -html_logo = "mitmproxy-docs.png" - -# The name of an image file (within the static path) to use as favicon of the -# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 -# pixels large. -html_favicon = "favicon.ico" - -# Add any paths that contain custom static files (such as style sheets) here, -# relative to this directory. They are copied after the builtin static files, -# so a file named "default.css" will overwrite the builtin "default.css". -# html_static_path = ['_static'] - -# Add any extra paths that contain custom files (such as robots.txt or -# .htaccess) here, relative to this directory. These files are copied -# directly to the root of the documentation. -#html_extra_path = [] - -# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, -# using the given strftime format. -#html_last_updated_fmt = '%b %d, %Y' - -# If true, SmartyPants will be used to convert quotes and dashes to -# typographically correct entities. -#html_use_smartypants = True - -# Custom sidebar templates, maps document names to template names. -#html_sidebars = {} - -# Additional templates that should be rendered to pages, maps page names to -# template names. -#html_additional_pages = {} - -# If false, no module index is generated. -#html_domain_indices = True - -# If false, no index is generated. -#html_use_index = True - -# If true, the index is split into individual pages for each letter. -#html_split_index = False - -# If true, links to the reST sources are added to the pages. -#html_show_sourcelink = True - -# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. -#html_show_sphinx = True - -# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. -#html_show_copyright = True - -# If true, an OpenSearch description file will be output, and all pages will -# contain a tag referring to it. The value of this option must be the -# base URL from which the finished HTML is served. -#html_use_opensearch = '' - -# This is the file name suffix for HTML files (e.g. ".xhtml"). -#html_file_suffix = None - -# Language to be used for generating the HTML full-text search index. -# Sphinx supports the following languages: -# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' -# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' -#html_search_language = 'en' - -# A dictionary with options for the search language support, empty by default. -# Now only 'ja' uses this config value -#html_search_options = {'type': 'default'} - -# The name of a javascript file (relative to the configuration directory) that -# implements a search results scorer. If empty, the default will be used. -#html_search_scorer = 'scorer.js' - -# Output file base name for HTML help builder. -htmlhelp_basename = 'mitmproxydoc' \ No newline at end of file diff --git a/mitmproxy/docs/config.rst b/mitmproxy/docs/config.rst deleted file mode 100644 index 634b8703..00000000 --- a/mitmproxy/docs/config.rst +++ /dev/null @@ -1,86 +0,0 @@ -.. _config: - -Configuration -============= - -Mitmproxy is configured through a set of files in the users ~/.mitmproxy -directory. - -mitmproxy.conf - Settings for the :program:`mitmproxy`. This file can contain any options supported by - mitmproxy. - -mitmdump.conf - Settings for the :program:`mitmdump`. This file can contain any options supported by mitmdump. - -common.conf - Settings shared between all command-line tools. Settings in this file are over-ridden by those - in the tool-specific files. Only options shared by mitmproxy and mitmdump should be used in - this file. - -Syntax ------- - -Comments -^^^^^^^^ - -.. code-block:: none - - # this is a comment - ; this is also a comment (.ini style) - --- and this is a comment too (yaml style) - -Key/Value pairs -^^^^^^^^^^^^^^^ - -- Keys and values are case-sensitive -- Whitespace is ignored -- Lists are comma-delimited, and enclosed in square brackets - -.. code-block:: none - - name = value # (.ini style) - name: value # (yaml style) - --name value # (command-line option style) - - fruit = [apple, orange, lemon] - indexes = [1, 12, 35 , 40] - -Flags -^^^^^ - -These are boolean options that take no value but true/false. - -.. code-block:: none - - name = true # (.ini style) - name - --name # (command-line option style) - -Options -------- - -The options available in the config files are precisely those available as -command-line flags, with the key being the option's long name. To get a -complete list of these, use the :option:`--help` option on each of the tools. Be -careful to only specify common options in the **common.conf** file - -unsupported options in this file will be detected as an error on startup. - -Examples --------- - -common.conf -^^^^^^^^^^^ - -Note that :option:`--port` is an option supported by all tools. - -.. code-block:: none - - port = 8080 - -mitmproxy.conf -^^^^^^^^^^^^^^ - -.. code-block:: none - - palette = light diff --git a/mitmproxy/docs/custom-routing.txt b/mitmproxy/docs/custom-routing.txt deleted file mode 100644 index 2ba2281f..00000000 --- a/mitmproxy/docs/custom-routing.txt +++ /dev/null @@ -1,24 +0,0 @@ -# Adapted from http://tldp.org/HOWTO/TransparentProxy-6.html (6.2 Second method) -# Note that the choice of firewall mark (3) and routing table (2) was fairly arbitrary. -# If you are already using policy routing or firewall marking for some other purpose, -# make sure you choose unique numbers here. Otherwise, don't worry about it. - - - -# On the router, run - -PROXY_IP=192.168.1.100 -TARGET_IP=192.168.1.110 - -iptables -t mangle -A PREROUTING -j ACCEPT -p tcp -m multiport --dports 80,443 -s ! $TARGET_IP -# Alternative to MITM the whole network: -# iptables -t mangle -A PREROUTING -j ACCEPT -p tcp -m multiport --dports 80,443 -s $PROXY_IP -iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp -m multiport --dports 80,443 -ip rule add fwmark 3 table 2 -ip route add default via $PROXY_IP dev br0 table 2 - - - -# On the proxy machine, run - -iptables -A PREROUTING -t nat -i eth0 -p tcp -m multiport --dports 80,443 -j REDIRECT --to-port 8080 diff --git a/mitmproxy/docs/dev/addingviews.html b/mitmproxy/docs/dev/addingviews.html deleted file mode 100644 index 12623a31..00000000 --- a/mitmproxy/docs/dev/addingviews.html +++ /dev/null @@ -1,52 +0,0 @@ -As discussed in [the Flow View section of the mitmproxy -overview](@!urlTo("mitmproxy.html")!@), mitmproxy allows you to inspect and -manipulate flows. When inspecting a single flow, mitmproxy uses a number of -heuristics to show a friendly view of various content types; if mitmproxy -cannot show a friendly view, mitmproxy defaults to a __raw__ view. - -Each content type invokes a different flow viewer to parse the data and display -the friendly view. Users can add custom content viewers by adding a view class -to contentview.py, discussed below. - -## Adding a new View class to contentview.py - -The content viewers used by mitmproxy to present a friendly view of various -content types are stored in contentview.py. Reviewing this file shows a number -of classes named ViewSomeDataType, each with the properties: __name__, -__prompt__, and __content\_types__ and a function named __\_\_call\_\___. - -Adding a new content viewer to parse a data type is as simple as writing a new -View class. Your new content viewer View class should have the same properties -as the other View classes: __name__, __prompt__, and __content\_types__ and a -__\_\_call\_\___ function to parse the content of the request/response. - -* The __name__ property should be a string describing the contents and new content viewer; -* The __prompt__ property should be a two item tuple: - - - __1__: A string that will be used to display the new content viewer's type; and - - __2__: A one character string that will be the hotkey used to select the new content viewer from the Flow View screen; - -* The __content\_types__ property should be a list of strings of HTTP Content\-Types that the new content viewer can parse. - * Note that mitmproxy will use the content\_types to try and heuristically show a friendly view of content and that you can override the built-in views by populating content\_types with values for content\_types that are already parsed -- e.g. "image/png". - -After defining the __name__, __prompt__, and __content\_types__ properties of -the class, you should write the __\_\_call\_\___ function, which will parse the -request/response data and provide a friendly view of the data. The -__\_\_call\_\___ function should take the following arguments: __self__, -__hdrs__, __content__, __limit__; __hdrs__ is a ODictCaseless object containing -the headers of the request/response; __content__ is the content of the -request/response, and __limit__ is an integer representing the amount of data -to display in the view window. - -The __\_\_call\_\___ function returns two values: (1) a string describing the -parsed data; and (2) the parsed data for friendly display. The parsed data to -be displayed should be a list of strings formatted for display. You can use -the __\_view\_text__ function in contentview.py to format text for display. -Alternatively, you can display content as a series of key-value pairs; to do -so, prepare a list of lists, where each list item is a two item list -- a key -that describes the data, and then the data itself; after preparing the list of -lists, use the __common.format\_keyvals__ function on it to prepare it as text -for display. - -If the new content viewer fails or throws an exception, mitmproxy will default -to a __raw__ view. diff --git a/mitmproxy/docs/dev/architecture.rst b/mitmproxy/docs/dev/architecture.rst deleted file mode 100644 index e7995141..00000000 --- a/mitmproxy/docs/dev/architecture.rst +++ /dev/null @@ -1,14 +0,0 @@ -.. _architecture: - -Architecture -============ - -To give you a better understanding of how mitmproxy works, mitmproxy's -high-level architecture is detailed in the following graphic: - -.. image:: ../schematics/architecture.png - -:download:`architecture.pdf <../schematics/architecture.pdf>` - -Please don't refrain from asking any further -questions on the mailing list, the Slack channel or the GitHub issue tracker. diff --git a/mitmproxy/docs/dev/exceptions.rst b/mitmproxy/docs/dev/exceptions.rst deleted file mode 100644 index e890476b..00000000 --- a/mitmproxy/docs/dev/exceptions.rst +++ /dev/null @@ -1,9 +0,0 @@ -.. _exceptions: - -Exceptions -========== - -.. automodule:: mitmproxy.exceptions - :show-inheritance: - :members: - :undoc-members: diff --git a/mitmproxy/docs/dev/models.rst b/mitmproxy/docs/dev/models.rst deleted file mode 100644 index 7a949941..00000000 --- a/mitmproxy/docs/dev/models.rst +++ /dev/null @@ -1,59 +0,0 @@ -.. _models: - -Models -====== - -.. automodule:: netlib.http - - .. autoclass:: Request - - .. rubric:: Data - .. autoattribute:: first_line_format - .. autoattribute:: method - .. autoattribute:: scheme - .. autoattribute:: host - .. autoattribute:: port - .. autoattribute:: path - .. autoattribute:: http_version - .. autoattribute:: headers - .. autoattribute:: content - .. autoattribute:: timestamp_start - .. autoattribute:: timestamp_end - .. rubric:: Computed Properties and Convenience Methods - .. autoattribute:: text - .. autoattribute:: url - .. autoattribute:: pretty_host - .. autoattribute:: pretty_url - .. autoattribute:: query - .. autoattribute:: cookies - .. autoattribute:: path_components - .. automethod:: anticache - .. automethod:: anticomp - .. automethod:: constrain_encoding - .. autoattribute:: urlencoded_form - .. autoattribute:: multipart_form - - .. autoclass:: Response - - .. rubric:: Data - .. autoattribute:: http_version - .. autoattribute:: status_code - .. autoattribute:: reason - .. autoattribute:: headers - .. autoattribute:: content - .. autoattribute:: timestamp_start - .. autoattribute:: timestamp_end - .. rubric:: Computed Properties and Convenience Methods - .. autoattribute:: text - .. autoattribute:: cookies - - .. autoclass:: Headers - :members: - :special-members: - :no-undoc-members: - - .. autoclass:: decoded - -.. automodule:: mitmproxy.models - :show-inheritance: - :members: HTTPFlow, Error, ClientConnection, ServerConnection \ No newline at end of file diff --git a/mitmproxy/docs/dev/protocols.rst b/mitmproxy/docs/dev/protocols.rst deleted file mode 100644 index ceb5c2fd..00000000 --- a/mitmproxy/docs/dev/protocols.rst +++ /dev/null @@ -1,15 +0,0 @@ -.. _protocols: - -Protocols -========= - -.. automodule:: mitmproxy.protocol - - .. autoclass:: Layer - :members: - :special-members: - - .. autoclass:: ServerConnectionMixin - :members: - - .. autoexception:: Kill diff --git a/mitmproxy/docs/dev/proxy.rst b/mitmproxy/docs/dev/proxy.rst deleted file mode 100644 index 888fb946..00000000 --- a/mitmproxy/docs/dev/proxy.rst +++ /dev/null @@ -1,12 +0,0 @@ -.. _proxy: - -Proxy Server -============ - -.. automodule:: mitmproxy.proxy - - .. autoclass:: ProxyServer - .. autoclass:: DummyServer - .. autoclass:: ProxyConfig - .. autoclass:: RootContext - :members: diff --git a/mitmproxy/docs/dev/sslkeylogfile.rst b/mitmproxy/docs/dev/sslkeylogfile.rst deleted file mode 100644 index 04b86cc4..00000000 --- a/mitmproxy/docs/dev/sslkeylogfile.rst +++ /dev/null @@ -1,14 +0,0 @@ -.. _sslkeylogfile: - -TLS Master Secrets -================== - -The SSL master keys can be logged by mitmproxy so that external programs can decrypt TLS -connections both from and to the proxy. Key logging is enabled by setting the environment variable -:envvar:`SSLKEYLOGFILE` so that it points to a writable text file. -Recent versions of WireShark can use these log files to decrypt packets. -You can specify the key file path in WireShark via -:samp:`Edit -> Preferences -> Protocols -> SSL -> (Pre)-Master-Secret log filename`. - -Note that :envvar:`SSLKEYLOGFILE` is respected by other programs as well, e.g. Firefox and Chrome. -If this creates any issues, you can set :envvar:`MITMPROXY_SSLKEYLOGFILE` alternatively. diff --git a/mitmproxy/docs/dev/testing.rst b/mitmproxy/docs/dev/testing.rst deleted file mode 100644 index e3b86bf3..00000000 --- a/mitmproxy/docs/dev/testing.rst +++ /dev/null @@ -1,47 +0,0 @@ -.. _testing: - -Testing -======= - -All the mitmproxy projects strive to maintain 100% code coverage. In general, -patches and pull requests will be declined unless they're accompanied by a -suitable extension to the test suite. - -Our tests are written for the `py.test`_ or nose_ test frameworks. -At the point where you send your pull request, a command like this: - ->>> py.test -n 4 --cov mitmproxy - -Should give output something like this: - -.. code-block:: none - - > ---------- coverage: platform darwin, python 2.7.2-final-0 -- - > Name Stmts Miss Cover Missing - > ---------------------------------------------------- - > mitmproxy/__init__ 0 0 100% - > mitmproxy/app 4 0 100% - > mitmproxy/cmdline 100 0 100% - > mitmproxy/controller 69 0 100% - > mitmproxy/dump 150 0 100% - > mitmproxy/encoding 39 0 100% - > mitmproxy/filt 201 0 100% - > mitmproxy/flow 891 0 100% - > mitmproxy/proxy 427 0 100% - > mitmproxy/script 27 0 100% - > mitmproxy/utils 133 0 100% - > mitmproxy/version 4 0 100% - > ---------------------------------------------------- - > TOTAL 2045 0 100% - > ---------------------------------------------------- - > Ran 251 tests in 11.864s - - -There are exceptions to the coverage requirement - for instance, much of the -console interface code can't sensibly be unit tested. These portions are -excluded from coverage analysis either in the **.coveragerc** file, or using -**#pragma no-cover** directives. To keep our coverage analysis relevant, we use -these measures as sparingly as possible. - -.. _nose: https://nose.readthedocs.org/en/latest/ -.. _py.test: https://pytest.org/ diff --git a/mitmproxy/docs/favicon.ico b/mitmproxy/docs/favicon.ico deleted file mode 100644 index 3c3b891c..00000000 Binary files a/mitmproxy/docs/favicon.ico and /dev/null differ diff --git a/mitmproxy/docs/features/anticache.rst b/mitmproxy/docs/features/anticache.rst deleted file mode 100644 index 65d22bab..00000000 --- a/mitmproxy/docs/features/anticache.rst +++ /dev/null @@ -1,15 +0,0 @@ -.. _anticache: - -Anticache -========= -When the :option:`--anticache` option is passed to mitmproxy, it removes headers -(``if-none-match`` and ``if-modified-since``) that might elicit a -``304 not modified`` response from the server. This is useful when you want to make -sure you capture an HTTP exchange in its totality. It's also often used during -:ref:`clientreplay`, when you want to make sure the server responds with complete data. - - -================== ====================== -command-line :option:`--anticache` -mitmproxy shortcut :kbd:`o` then :kbd:`a` -================== ====================== diff --git a/mitmproxy/docs/features/clientreplay.rst b/mitmproxy/docs/features/clientreplay.rst deleted file mode 100644 index b0eb6792..00000000 --- a/mitmproxy/docs/features/clientreplay.rst +++ /dev/null @@ -1,18 +0,0 @@ -.. _clientreplay: - -Client-side replay -================== - -Client-side replay does what it says on the tin: you provide a previously saved -HTTP conversation, and mitmproxy replays the client requests one by one. Note -that mitmproxy serializes the requests, waiting for a response from the server -before starting the next request. This might differ from the recorded -conversation, where requests may have been made concurrently. - -You may want to use client-side replay in conjunction with the -:ref:`anticache` option, to make sure the server responds with complete data. - -================== ================= -command-line :option:`-c path` -mitmproxy shortcut :kbd:`c` -================== ================= diff --git a/mitmproxy/docs/features/filters.rst b/mitmproxy/docs/features/filters.rst deleted file mode 100644 index 509b5d6b..00000000 --- a/mitmproxy/docs/features/filters.rst +++ /dev/null @@ -1,39 +0,0 @@ -.. _filters: - -Filter expressions -================== - -Many commands in :program:`mitmproxy` and :program:`mitmdump` take a filter expression. -Filter expressions consist of the following operators: - -.. documentedlist:: - :header: "Expression" "Description" - :listobject: mitmproxy.filt.help - -- Regexes are Python-style -- Regexes can be specified as quoted strings -- Header matching (~h, ~hq, ~hs) is against a string of the form "name: value". -- Strings with no operators are matched against the request URL. -- The default binary operator is &. - -Examples --------- - -URL containing "google.com": - -.. code-block:: none - - google\.com - -Requests whose body contains the string "test": - -.. code-block:: none - - ~q ~b test - -Anything but requests with a text/html content type: - -.. code-block:: none - - !(~q & ~t "text/html") - diff --git a/mitmproxy/docs/features/passthrough.rst b/mitmproxy/docs/features/passthrough.rst deleted file mode 100644 index b7b5df84..00000000 --- a/mitmproxy/docs/features/passthrough.rst +++ /dev/null @@ -1,97 +0,0 @@ -.. _passthrough: - -Ignore Domains -============== - -There are two main reasons why you may want to exempt some traffic from mitmproxy's interception -mechanism: - -- **Certificate pinning:** Some traffic is is protected using `Certificate Pinning`_ and - mitmproxy's interception leads to errors. For example, the Twitter app, Windows Update or - the Apple App Store fail to work if mitmproxy is active. -- **Convenience:** You really don't care about some parts of the traffic and just want them to go - away. - -If you want to peek into (SSL-protected) non-HTTP connections, check out the :ref:`tcpproxy` -feature. -If you want to ignore traffic from mitmproxy's processing because of large response bodies, -take a look at the :ref:`responsestreaming` feature. - -How it works ------------- - -================== ============================= -command-line :option:`--ignore regex` -mitmproxy shortcut :kbd:`o` then :kbd:`I` -================== ============================= - - -mitmproxy allows you to specify a regex which is matched against a ``host:port`` string -(e.g. "example.com:443") to determine hosts that should be excluded. - -There are two important quirks to consider: - -- **In transparent mode, the ignore pattern is matched against the IP and ClientHello SNI host.** While we usually infer the - hostname from the Host header if the :option:`--host` argument is passed to mitmproxy, we do not - have access to this information before the SSL handshake. If the client uses SNI however, then we treat the SNI host as an ignore target. -- In regular mode, explicit HTTP requests are never ignored. [#explicithttp]_ The ignore pattern is - applied on CONNECT requests, which initiate HTTPS or clear-text WebSocket connections. - -Tutorial --------- - -If you just want to ignore one specific domain, there's usually a bulletproof method to do so: - -1. Run mitmproxy or mitmdump in verbose mode (:option:`-v`) and observe the ``host:port`` - information in the serverconnect messages. mitmproxy will filter on these. -2. Take the ``host:port`` string, surround it with ^ and $, escape all dots (. becomes \\.) - and use this as your ignore pattern: - -.. code-block:: none - :emphasize-lines: 6,7,9 - - >>> mitmdump -v - 127.0.0.1:50588: clientconnect - 127.0.0.1:50588: request - -> CONNECT example.com:443 HTTP/1.1 - 127.0.0.1:50588: Set new server address: example.com:443 - 127.0.0.1:50588: serverconnect - -> example.com:443 - ^C - >>> mitmproxy --ignore ^example\.com:443$ - - -Here are some other examples for ignore patterns: - -.. code-block:: none - - # Exempt traffic from the iOS App Store (the regex is lax, but usually just works): - --ignore apple.com:443 - # "Correct" version without false-positives: - --ignore '^(.+\.)?apple\.com:443$' - - # Ignore example.com, but not its subdomains: - --ignore '^example.com:' - - # Ignore everything but example.com and mitmproxy.org: - --ignore '^(?!example\.com)(?!mitmproxy\.org)' - - # Transparent mode: - --ignore 17\.178\.96\.59:443 - # IP address range: - --ignore 17\.178\.\d+\.\d+:443 - - -.. seealso:: - - - :ref:`tcpproxy` - - :ref:`responsestreaming` - -.. rubric:: Footnotes - -.. [#explicithttp] This stems from an limitation of explicit HTTP proxying: - A single connection can be re-used for multiple target domains - a - ``GET http://example.com/`` request may be followed by a ``GET http://evil.com/`` request on the - same connection. If we start to ignore the connection after the first request, - we would miss the relevant second one. -.. _Certificate Pinning: https://security.stackexchange.com/questions/29988/what-is-certificate-pinning diff --git a/mitmproxy/docs/features/proxyauth.rst b/mitmproxy/docs/features/proxyauth.rst deleted file mode 100644 index bfd32fbd..00000000 --- a/mitmproxy/docs/features/proxyauth.rst +++ /dev/null @@ -1,17 +0,0 @@ -.. _proxyauth: - -Proxy Authentication -==================== - - -Asks the user for authentication before they are permitted to use the proxy. -Authentication headers are stripped from the flows, so they are not passed to -upstream servers. For now, only HTTP Basic authentication is supported. The -proxy auth options are not compatible with the transparent, socks or reverse proxy -mode. - -================== ============================= -command-line :option:`--nonanonymous`, - :option:`--singleuser USER`, - :option:`--htpasswd PATH` -================== ============================= diff --git a/mitmproxy/docs/features/replacements.rst b/mitmproxy/docs/features/replacements.rst deleted file mode 100644 index 8f760866..00000000 --- a/mitmproxy/docs/features/replacements.rst +++ /dev/null @@ -1,72 +0,0 @@ -.. _replacements: - -Replacements -============ - -Mitmproxy lets you specify an arbitrary number of patterns that define text -replacements within flows. Each pattern has 3 components: a filter that defines -which flows a replacement applies to, a regular expression that defines what -gets replaced, and a target value that defines what is substituted in. - -Replace hooks fire when either a client request or a server response is -received. Only the matching flow component is affected: so, for example, if a -replace hook is triggered on server response, the replacement is only run on -the Response object leaving the Request intact. You control whether the hook -triggers on the request, response or both using the filter pattern. If you need -finer-grained control than this, it's simple to create a script using the -replacement API on Flow components. - -Replacement hooks are extremely handy in interactive testing of applications. -For instance you can use a replace hook to replace the text "XSS" with a -complicated XSS exploit, and then "inject" the exploit simply by interacting -with the application through the browser. When used with tools like Firebug and -mitmproxy's own interception abilities, replacement hooks can be an amazingly -flexible and powerful feature. - - -On the command-line -------------------- - -The replacement hook command-line options use a compact syntax to make it easy -to specify all three components at once. The general form is as follows: - -.. code-block:: none - - /patt/regex/replacement - -Here, **patt** is a mitmproxy filter expression, **regex** is a valid Python -regular expression, and **replacement** is a string literal. The first -character in the expression (``/`` in this case) defines what the separation -character is. Here's an example of a valid expression that replaces "foo" with -"bar" in all requests: - -.. code-block:: none - - :~q:foo:bar - -In practice, it's pretty common for the replacement literal to be long and -complex. For instance, it might be an XSS exploit that weighs in at hundreds or -thousands of characters. To cope with this, there's a variation of the -replacement hook specifier that lets you load the replacement text from a file. -So, you might start **mitmdump** as follows: - ->>> mitmdump --replace-from-file :~q:foo:~/xss-exploit - -This will load the replacement text from the file ``~/xss-exploit``. - -Both the :option:`--replace` and :option:`--replace-from-file` flags can be passed multiple -times. - - -Interactively -------------- - -The :kbd:`R` shortcut key in the mitmproxy options menu (:kbd:`o`) lets you add and edit -replacement hooks using a built-in editor. The context-sensitive help (:kbd:`?`) has -complete usage information. - -================== ============================= -command-line :option:`--replace`, - :option:`--replace-from-file` -mitmproxy shortcut :kbd:`o` then :kbd:`R` -================== ============================= diff --git a/mitmproxy/docs/features/responsestreaming.rst b/mitmproxy/docs/features/responsestreaming.rst deleted file mode 100644 index 8975c1f8..00000000 --- a/mitmproxy/docs/features/responsestreaming.rst +++ /dev/null @@ -1,69 +0,0 @@ -.. _responsestreaming: - -Response Streaming -================== - -By using mitmproxy's streaming feature, response contents can be passed to the client incrementally -before they have been fully received by the proxy. This is especially useful for large binary files -such as videos, where buffering the whole file slows down the client's browser. - -By default, mitmproxy will read the entire response, perform any indicated -manipulations on it and then send the (possibly modified) response to -the client. In some cases this is undesirable and you may wish to "stream" -the response back to the client. When streaming is enabled, the response is -not buffered on the proxy but directly sent back to the client instead. - -On the command-line -------------------- - -Streaming can be enabled on the command line for all response bodies exceeding a certain size. -The SIZE argument understands k/m/g suffixes, e.g. 3m for 3 megabytes. - -================== ============================= -command-line :option:`--stream SIZE` -================== ============================= - -.. warning:: - - When response streaming is enabled, **streamed response contents will not be - recorded or preserved in any way.** - -.. note:: - - When response streaming is enabled, the response body cannot be modified by the usual means. - -Customizing Response Streaming ------------------------------- - -You can also use an :ref:`inlinescripts` to customize exactly -which responses are streamed. - -Responses that should be tagged for streaming by setting their ``.stream`` attribute to ``True``: - -.. literalinclude:: ../../examples/stream.py - :caption: examples/stream.py - :language: python - -Implementation Details ----------------------- - -When response streaming is enabled, portions of the code which would have otherwise performed -changes on the response body will see an empty response body instead -(:py:data:`netlib.http.CONTENT_MISSING`). Any modifications will be ignored. - -Streamed responses are usually sent in chunks of 4096 bytes. If the response is sent with a -``Transfer-Encoding: chunked`` header, the response will be streamed one chunk at a time. - -Modifying streamed data ------------------------ - -If the ``.stream`` attribute is callable, ``.stream`` will wrap the generator that yields all -chunks. - -.. literalinclude:: ../../examples/stream_modify.py - :caption: examples/stream_modify.py - :language: python - -.. seealso:: - - - :ref:`passthrough` diff --git a/mitmproxy/docs/features/reverseproxy.rst b/mitmproxy/docs/features/reverseproxy.rst deleted file mode 100644 index 87065e73..00000000 --- a/mitmproxy/docs/features/reverseproxy.rst +++ /dev/null @@ -1,57 +0,0 @@ -.. _reverseproxy: - -Reverse Proxy -============= - -In reverse proxy mode, mitmproxy accepts standard HTTP(S) requests and forwards -them to the specified upstream server. This is in contrast to :ref:`upstreamproxy`, in which -mitmproxy forwards HTTP(S) proxy requests to an upstream proxy server. - -================== ===================================== -command-line :option:`-R http[s]://hostname[:port]` -================== ===================================== - -Here, **http[s]** signifies if the proxy should use TLS to connect to the server. -mitmproxy always accepts both encrypted and unencrypted requests and transforms -them to what the server expects. - -.. code-block:: none - - >>> mitmdump -R https://httpbin.org -p 80 - >>> curl http://localhost/ - # requests will be transparently upgraded to TLS by mitmproxy - - >>> mitmdump -R https://httpbin.org -p 443 - >>> curl https://localhost/ - # mitmproxy will use TLS on both ends. - - -Host Header ------------ - -In reverse proxy mode, mitmproxy does not rewrite the host header. While often useful, this -may lead to issues with public web servers. For example, consider the following scenario: - -.. code-block:: none - :emphasize-lines: 5 - - >>> mitmdump -d -R http://example.com/ - >>> curl http://localhost:8080/ - - >> GET https://example.com/ - Host: localhost:8080 - User-Agent: curl/7.35.0 - [...] - - << 404 Not Found 345B - -Since the Host header doesn't match "example.com", an error is returned. -There are two ways to solve this: - -1. Modify the hosts file of your OS so that "example.com" resolves to your proxy's IP. - Then, access example.com directly. Make sure that your proxy can still resolve the original IP - or specify an IP in mitmproxy. -2. Use mitmproxy's :ref:`setheaders` feature to rewrite the host header: - ``--setheader :~q:Host:example.com``. - However, keep in mind that absolute URLs within the returned document or HTTP redirects will - cause the client application to bypass the proxy. diff --git a/mitmproxy/docs/features/serverreplay.rst b/mitmproxy/docs/features/serverreplay.rst deleted file mode 100644 index 261a1bd6..00000000 --- a/mitmproxy/docs/features/serverreplay.rst +++ /dev/null @@ -1,39 +0,0 @@ -.. _serverreplay: - -Server-side replay -================== - -Server-side replay lets us replay server responses from a saved HTTP -conversation. - -Matching requests with responses --------------------------------- - -By default, :program:`mitmproxy` excludes request headers when matching incoming -requests with responses from the replay file. This works in most circumstances, -and makes it possible to replay server responses in situations where request -headers would naturally vary, e.g. using a different user agent. -The :option:`--rheader headername` command-line option allows you to override -this behaviour by specifying individual headers that should be included in matching. - - -Response refreshing -------------------- - -Simply replaying server responses without modification will often result in -unexpected behaviour. For example cookie timeouts that were in the future at -the time a conversation was recorded might be in the past at the time it is -replayed. By default, :program:`mitmproxy` refreshes server responses before sending -them to the client. The **date**, **expires** and **last-modified** headers are -all updated to have the same relative time offset as they had at the time of -recording. So, if they were in the past at the time of recording, they will be -in the past at the time of replay, and vice versa. Cookie expiry times are -updated in a similar way. - -You can turn off response refreshing using the :option:`--norefresh` argument, or using -the :kbd:`o` options shortcut within :program:`mitmproxy`. - -================== ================= -command-line :option:`-S path` -mitmproxy shortcut :kbd:`S` -================== ================= diff --git a/mitmproxy/docs/features/setheaders.rst b/mitmproxy/docs/features/setheaders.rst deleted file mode 100644 index cbc8b6a5..00000000 --- a/mitmproxy/docs/features/setheaders.rst +++ /dev/null @@ -1,19 +0,0 @@ -.. _setheaders: - -Set Headers -=========== - -This feature lets you specify a set of headers to be added to requests or -responses, based on a filter pattern. You can specify these either on the -command-line, or through an interactive editor in mitmproxy. - -Example: Set the **Host** header to "example.com" for all requests. - -.. code-block:: none - - mitmdump -R http://example.com --setheader :~q:Host:example.com - -================== ============================= -command-line :option:`--setheader PATTERN` -mitmproxy shortcut :kbd:`o` then :kbd:`H` -================== ============================= diff --git a/mitmproxy/docs/features/socksproxy.rst b/mitmproxy/docs/features/socksproxy.rst deleted file mode 100644 index 76d4cda9..00000000 --- a/mitmproxy/docs/features/socksproxy.rst +++ /dev/null @@ -1,10 +0,0 @@ -.. _socksproxy: - -SOCKS Mode -========== - -In this mode, mitmproxy acts as a SOCKS5 proxy server. - -================== ================= -command-line :option:`--socks` -================== ================= diff --git a/mitmproxy/docs/features/sticky.rst b/mitmproxy/docs/features/sticky.rst deleted file mode 100644 index a79cbe8d..00000000 --- a/mitmproxy/docs/features/sticky.rst +++ /dev/null @@ -1,41 +0,0 @@ -.. _sticky: - -Sticky cookies and auth -======================= - -Sticky cookies --------------- - -When the sticky cookie option is set, __mitmproxy__ will add the cookie most -recently set by the server to any cookie-less request. Consider a service that -sets a cookie to track the session after authentication. Using sticky cookies, -you can fire up mitmproxy, and authenticate to a service as you usually would -using a browser. After authentication, you can request authenticated resources -through mitmproxy as if they were unauthenticated, because mitmproxy will -automatically add the session tracking cookie to requests. Among other things, -this lets you script interactions with authenticated resources (using tools -like wget or curl) without having to worry about authentication. - -Sticky cookies are especially powerful when used in conjunction with :ref:`clientreplay` - you can -record the authentication process once, and simply replay it on startup every time you need -to interact with the secured resources. - -================== ====================== -command-line :option:`-t FILTER` -mitmproxy shortcut :kbd:`o` then :kbd:`t` -================== ====================== - - -Sticky auth ------------ - -The sticky auth option is analogous to the sticky cookie option, in that HTTP -**Authorization** headers are simply replayed to the server once they have been -seen. This is enough to allow you to access a server resource using HTTP Basic -authentication through the proxy. Note that :program:`mitmproxy` doesn't (yet) support -replay of HTTP Digest authentication. - -================== ====================== -command-line :option:`-u FILTER` -mitmproxy shortcut :kbd:`o` then :kbd:`A` -================== ====================== diff --git a/mitmproxy/docs/features/tcpproxy.rst b/mitmproxy/docs/features/tcpproxy.rst deleted file mode 100644 index fd0746a2..00000000 --- a/mitmproxy/docs/features/tcpproxy.rst +++ /dev/null @@ -1,31 +0,0 @@ -.. _tcpproxy: - -TCP Proxy -========= - -WebSockets or other non-HTTP protocols are not supported by mitmproxy yet. However, you can exempt -hostnames from processing, so that mitmproxy acts as a generic TCP forwarder. -This feature is closely related to the :ref:`passthrough` functionality, -but differs in two important aspects: - -- The raw TCP messages are printed to the event log. -- SSL connections will be intercepted. - -Please note that message interception or modification are not possible yet. -If you are not interested in the raw TCP messages, you should use the ignore domains feature. - -How it works ------------- - -================== ====================== -command-line :option:`--tcp HOST` -mitmproxy shortcut :kbd:`o` then :kbd:`T` -================== ====================== - -For a detailed description how the hostname pattern works, please look at the :ref:`passthrough` -feature. - -.. seealso:: - - - :ref:`passthrough` - - :ref:`responsestreaming` diff --git a/mitmproxy/docs/features/upstreamcerts.rst b/mitmproxy/docs/features/upstreamcerts.rst deleted file mode 100644 index af2e2226..00000000 --- a/mitmproxy/docs/features/upstreamcerts.rst +++ /dev/null @@ -1,23 +0,0 @@ -.. _upstreamcerts: - -Upstream Certificates -===================== - -When mitmproxy receives a connection destined for an SSL-protected service, it -freezes the connection before reading its request data, and makes a connection -to the upstream server to "sniff" the contents of its SSL certificate. The -information gained - the **Common Name** and **Subject Alternative Names** - is -then used to generate the interception certificate, which is sent to the client -so the connection can continue. - -This rather intricate little dance lets us seamlessly generate correct -certificates even if the client has specified only an IP address rather than the -hostname. It also means that we don't need to sniff additional data to generate -certs in transparent mode. - -Upstream cert sniffing is on by default, and can optionally be turned off. - -================== ============================= -command-line :option:`--no-upstream-cert` -mitmproxy shortcut :kbd:`o` then :kbd:`U` -================== ============================= diff --git a/mitmproxy/docs/features/upstreamproxy.rst b/mitmproxy/docs/features/upstreamproxy.rst deleted file mode 100644 index e06833c2..00000000 --- a/mitmproxy/docs/features/upstreamproxy.rst +++ /dev/null @@ -1,12 +0,0 @@ -.. _upstreamproxy: - -Upstream proxy mode -=================== - -In this mode, mitmproxy accepts proxy requests and unconditionally forwards all -requests to a specified upstream proxy server. This is in contrast to :ref:`reverseproxy`, -in which mitmproxy forwards ordinary HTTP requests to an upstream server. - -================== =================================== -command-line :option:`-U http://hostname[:port]` -================== =================================== diff --git a/mitmproxy/docs/howmitmproxy.rst b/mitmproxy/docs/howmitmproxy.rst deleted file mode 100644 index b0b187d3..00000000 --- a/mitmproxy/docs/howmitmproxy.rst +++ /dev/null @@ -1,239 +0,0 @@ -How mitmproxy works -=================== - -Mitmproxy is an enormously flexible tool. Knowing exactly how the proxying -process works will help you deploy it creatively, and take into account its -fundamental assumptions and how to work around them. This document explains -mitmproxy's proxy mechanism in detail, starting with the simplest unencrypted -explicit proxying, and working up to the most complicated interaction - -transparent proxying of SSL-protected traffic [#ssl]_ in the presence of `Server Name Indication`_. - -Explicit HTTP -------------- - -Configuring the client to use mitmproxy as an explicit proxy is the simplest -and most reliable way to intercept traffic. The proxy protocol is codified in the -`HTTP RFC`_, so the behaviour of both -the client and the server is well defined, and usually reliable. In the -simplest possible interaction with mitmproxy, a client connects directly to the -proxy, and makes a request that looks like this: - -.. code-block:: http - - GET http://example.com/index.html HTTP/1.1 - -This is a proxy GET request - an extended form of the vanilla HTTP GET request -that includes a schema and host specification, and it includes all the -information mitmproxy needs to proceed. - -.. image:: schematics/how-mitmproxy-works-explicit.png - :align: center - -1. The client connects to the proxy and makes a request. -2. Mitmproxy connects to the upstream server and simply forwards the request on. - - -Explicit HTTPS --------------- - -The process for an explicitly proxied HTTPS connection is quite different. The -client connects to the proxy and makes a request that looks like this: - -.. code-block:: http - - CONNECT example.com:443 HTTP/1.1 - -A conventional proxy can neither view nor manipulate an SSL-encrypted data -stream, so a CONNECT request simply asks the proxy to open a pipe between the -client and server. The proxy here is just a facilitator - it blindly forwards -data in both directions without knowing anything about the contents. The -negotiation of the SSL connection happens over this pipe, and the subsequent -flow of requests and responses are completely opaque to the proxy. - -The MITM in mitmproxy -^^^^^^^^^^^^^^^^^^^^^ - -This is where mitmproxy's fundamental trick comes into play. The MITM in its -name stands for Man-In-The-Middle - a reference to the process we use to -intercept and interfere with these theoretically opaque data streams. The basic -idea is to pretend to be the server to the client, and pretend to be the client -to the server, while we sit in the middle decoding traffic from both sides. The -tricky part is that the `Certificate Authority`_ system is -designed to prevent exactly this attack, by allowing a trusted third-party to -cryptographically sign a server's SSL certificates to verify that they are -legit. If this signature doesn't match or is from a non-trusted party, a secure -client will simply drop the connection and refuse to proceed. Despite the many -shortcomings of the CA system as it exists today, this is usually fatal to -attempts to MITM an SSL connection for analysis. Our answer to this conundrum -is to become a trusted Certificate Authority ourselves. Mitmproxy includes a -full CA implementation that generates interception certificates on the fly. To -get the client to trust these certificates, we :ref:`register mitmproxy as a trusted -CA with the device manually `. - -Complication 1: What's the remote hostname? -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -To proceed with this plan, we need to know the domain name to use in the -interception certificate - the client will verify that the certificate is for -the domain it's connecting to, and abort if this is not the case. At first -blush, it seems that the CONNECT request above gives us all we need - in this -example, both of these values are "example.com". But what if the client had -initiated the connection as follows: - -.. code-block:: http - - CONNECT 10.1.1.1:443 HTTP/1.1 - -Using the IP address is perfectly legitimate because it gives us enough -information to initiate the pipe, even though it doesn't reveal the remote -hostname. - -Mitmproxy has a cunning mechanism that smooths this over - :ref:`upstream -certificate sniffing `. As soon as we -see the CONNECT request, we pause the client part of the conversation, and -initiate a simultaneous connection to the server. We complete the SSL handshake -with the server, and inspect the certificates it used. Now, we use the Common -Name in the upstream SSL certificates to generate the dummy certificate for the -client. Voila, we have the correct hostname to present to the client, even if -it was never specified. - - -Complication 2: Subject Alternative Name -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Enter the next complication. Sometimes, the certificate Common Name is not, in -fact, the hostname that the client is connecting to. This is because of the -optional `Subject Alternative Name`_ field in the SSL certificate -that allows an arbitrary number of alternative domains to be specified. If the -expected domain matches any of these, the client will proceed, even though the -domain doesn't match the certificate Common Name. The answer here is simple: -when we extract the CN from the upstream cert, we also extract the SANs, and -add them to the generated dummy certificate. - - -Complication 3: Server Name Indication -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -One of the big limitations of vanilla SSL is that each certificate requires its -own IP address. This means that you couldn't do virtual hosting where multiple -domains with independent certificates share the same IP address. In a world -with a rapidly shrinking IPv4 address pool this is a problem, and we have a -solution in the form of the `Server Name Indication`_ extension to -the SSL and TLS protocols. This lets the client specify the remote server name -at the start of the SSL handshake, which then lets the server select the right -certificate to complete the process. - -SNI breaks our upstream certificate sniffing process, because when we connect -without using SNI, we get served a default certificate that may have nothing to -do with the certificate expected by the client. The solution is another tricky -complication to the client connection process. After the client connects, we -allow the SSL handshake to continue until just _after_ the SNI value has been -passed to us. Now we can pause the conversation, and initiate an upstream -connection using the correct SNI value, which then serves us the correct -upstream certificate, from which we can extract the expected CN and SANs. - -Putting it all together -^^^^^^^^^^^^^^^^^^^^^^^ - -Lets put all of this together into the complete explicitly proxied HTTPS flow. - -.. image:: schematics/how-mitmproxy-works-explicit-https.png - :align: center - -1. The client makes a connection to mitmproxy, and issues an HTTP CONNECT request. -2. Mitmproxy responds with a ``200 Connection Established``, as if it has set up the CONNECT pipe. -3. The client believes it's talking to the remote server, and initiates the SSL connection. - It uses SNI to indicate the hostname it is connecting to. -4. Mitmproxy connects to the server, and establishes an SSL connection using the SNI hostname - indicated by the client. -5. The server responds with the matching SSL certificate, which contains the CN and SAN values - needed to generate the interception certificate. -6. Mitmproxy generates the interception cert, and continues the - client SSL handshake paused in step 3. -7. The client sends the request over the established SSL connection. -8. Mitmproxy passes the request on to the server over the SSL connection initiated in step 4. - -Transparent HTTP ----------------- - -When a transparent proxy is used, the HTTP/S connection is redirected into a -proxy at the network layer, without any client configuration being required. -This makes transparent proxying ideal for those situations where you can't -change client behaviour - proxy-oblivious Android applications being a common -example. - -To achieve this, we need to introduce two extra components. The first is a -redirection mechanism that transparently reroutes a TCP connection destined for -a server on the Internet to a listening proxy server. This usually takes the -form of a firewall on the same host as the proxy server - `iptables`_ on Linux or -pf_ on OSX. Once the client has initiated the connection, it makes a vanilla HTTP request, -which might look something like this: - -.. code-block:: http - - GET /index.html HTTP/1.1 - -Note that this request differs from the explicit proxy variation, in that it -omits the scheme and hostname. How, then, do we know which upstream host to -forward the request to? The routing mechanism that has performed the -redirection keeps track of the original destination for us. Each routing -mechanism has a different way of exposing this data, so this introduces the -second component required for working transparent proxying: a host module that -knows how to retrieve the original destination address from the router. In -mitmproxy, this takes the form of a built-in set of -modules_ that know how to talk to each platform's redirection mechanism. -Once we have this information, the process is fairly straight-forward. - -.. image:: schematics/how-mitmproxy-works-transparent.png - :align: center - -1. The client makes a connection to the server. -2. The router redirects the connection to mitmproxy, which is typically listening on a local port - of the same host. Mitmproxy then consults the routing mechanism to establish what the original - destination was. -3. Now, we simply read the client's request... -4. ... and forward it upstream. - -Transparent HTTPS ------------------ - -The first step is to determine whether we should treat an incoming connection -as HTTPS. The mechanism for doing this is simple - we use the routing mechanism -to find out what the original destination port is. By default, we treat all -traffic destined for ports 443 and 8443 as SSL. - -From here, the process is a merger of the methods we've described for -transparently proxying HTTP, and explicitly proxying HTTPS. We use the routing -mechanism to establish the upstream server address, and then proceed as for -explicit HTTPS connections to establish the CN and SANs, and cope with SNI. - -.. image:: schematics/how-mitmproxy-works-transparent-https.png - :align: center - -1. The client makes a connection to the server. -2. The router redirects the connection to mitmproxy, which is typically listening on a local port - of the same host. Mitmproxy then consults the routing mechanism to establish what the original - destination was. -3. The client believes it's talking to the remote server, and initiates the SSL connection. - It uses SNI to indicate the hostname it is connecting to. -4. Mitmproxy connects to the server, and establishes an SSL connection using the SNI hostname - indicated by the client. -5. The server responds with the matching SSL certificate, which contains the CN and SAN values - needed to generate the interception certificate. -6. Mitmproxy generates the interception cert, and continues the client SSL handshake paused in - step 3. -7. The client sends the request over the established SSL connection. -8. Mitmproxy passes the request on to the server over the SSL connection initiated in step 4. - -.. rubric:: Footnotes - -.. [#ssl] I use "SSL" to refer to both SSL and TLS in the generic sense, unless otherwise - specified. - -.. _Server Name Indication: https://en.wikipedia.org/wiki/Server_Name_Indication -.. _HTTP RFC: https://tools.ietf.org/html/rfc7230 -.. _Certificate Authority: https://en.wikipedia.org/wiki/Certificate_authority -.. _Subject Alternative Name: https://en.wikipedia.org/wiki/SubjectAltName -.. _iptables: http://www.netfilter.org/ -.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) -.. _modules: https://github.com/mitmproxy/mitmproxy/tree/master/mitmproxy/platform diff --git a/mitmproxy/docs/index.rst b/mitmproxy/docs/index.rst deleted file mode 100644 index 4bca07d1..00000000 --- a/mitmproxy/docs/index.rst +++ /dev/null @@ -1,83 +0,0 @@ -.. include:: introduction.rst - - -.. toctree:: - :hidden: - :maxdepth: 1 - - introduction - install - certinstall - howmitmproxy - modes - -.. toctree:: - :hidden: - :caption: Tools - - mitmproxy - mitmdump - config - -.. toctree:: - :hidden: - :caption: Features - - features/anticache - features/filters - features/replacements - features/clientreplay - features/serverreplay - features/setheaders - features/passthrough - features/proxyauth - features/reverseproxy - features/responsestreaming - features/socksproxy - features/sticky - features/tcpproxy - features/upstreamproxy - features/upstreamcerts - -.. toctree:: - :hidden: - :caption: Transparent Proxying - - transparent - transparent/linux - transparent/osx - -.. toctree:: - :hidden: - :caption: Scripting - - scripting/inlinescripts - scripting/mitmproxy - - -.. toctree:: - :hidden: - :caption: Tutorials - - tutorials/30second - tutorials/gamecenter - tutorials/transparent-dhcp - -.. toctree:: - :hidden: - :caption: Hacking - - dev/architecture - dev/testing - dev/sslkeylogfile - dev/protocols - dev/proxy - dev/exceptions - dev/models - -.. Indices and tables - ================== - - * :ref:`genindex` - * :ref:`modindex` - diff --git a/mitmproxy/docs/install.rst b/mitmproxy/docs/install.rst deleted file mode 100644 index 3300807b..00000000 --- a/mitmproxy/docs/install.rst +++ /dev/null @@ -1,103 +0,0 @@ -.. _install: - -Installation -============ - -.. _install-ubuntu: - -Installation On Ubuntu ----------------------- - -Ubuntu comes with Python but we need to install pip, python-dev and several libraries. -This was tested on a fully patched installation of Ubuntu 14.04. - ->>> sudo apt-get install python-pip python-dev libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev ->>> sudo pip install mitmproxy - -Once installation is complete you can run :ref:`mitmproxy` or :ref:`mitmdump` from a terminal. - -On **Ubuntu 12.04** (and other systems with an outdated version of pip), -you may need to update pip using ``pip install -U pip`` before installing mitmproxy. - -Installation From Source (Ubuntu) -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -If you would like to install mitmproxy directly from the master branch on GitHub or would like to -get set up to contribute to the project, install the dependencies as you would for a regular -mitmproxy installation (see :ref:`install-ubuntu`). -Then see the Hacking_ section of the README on GitHub. - - - -Installation On Mac OS X ------------------------- - -The easiest way to get up and running on OSX is to download the pre-built binary packages from -`mitmproxy.org`_. - -There are a few bits of customization you might want to do to make mitmproxy comfortable to use on -OSX. The default color scheme is optimized for a dark background terminal, but you can select a -palette for a light terminal background with the ``--palette`` option. -You can use the OSX **open** program to create a simple and effective ``~/.mailcap`` file to view -request and response bodies: - -.. code-block:: none - - application/*; /usr/bin/open -Wn %s - audio/*; /usr/bin/open -Wn %s - image/*; /usr/bin/open -Wn %s - video/*; /usr/bin/open -Wn %s - -Once installation is complete you can run :ref:`mitmproxy` or :ref:`mitmdump` from a terminal. - - -Installation From Source (Mac OS X) -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -If you would like to install mitmproxy directly from the master branch on GitHub or would like to -get set up to contribute to the project, there are a few OS X specific things to keep in mind. - -- Make sure that XCode is installed from the App Store, and that the command-line tools have been - downloaded (XCode/Preferences/Downloads). -- If you're running a Python interpreter installed with homebrew (or similar), you may have to - install some dependencies by hand. - -Then see the Hacking_ section of the README on GitHub. - -Installation On Windows ------------------------ - -.. note:: - Please note that mitmdump is the only component of mitmproxy that is supported on Windows at - the moment. - - **There is no interactive user interface on Windows.** - - -First, install the latest version of Python 2.7 from the `Python website`_. -If you already have an older version of Python 2.7 installed, make sure to install pip_ -(pip is included in Python 2.7.9+ by default). - -Next, add Python and the Python Scripts directory to your **PATH** variable. -You can do this easily by running the following in powershell: - ->>> [Environment]::SetEnvironmentVariable("Path", "$env:Path;C:\Python27;C:\Python27\Scripts", "User") - -Now, you can install mitmproxy by running - ->>> pip install mitmproxy - -Once the installation is complete, you can run :ref:`mitmdump` from a command prompt. - -Installation From Source (Windows) -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -If you would like to install mitmproxy directly from the master branch on GitHub or would like to -get set up to contribute to the project, install Python as outlined above, then see the -Hacking_ section of the README on GitHub. - - -.. _Hacking: https://github.com/mitmproxy/mitmproxy/blob/master/README.rst#hacking -.. _mitmproxy.org: https://mitmproxy.org/ -.. _`Python website`: https://www.python.org/downloads/windows/ -.. _pip: https://pip.pypa.io/en/latest/installing.html diff --git a/mitmproxy/docs/introduction.rst b/mitmproxy/docs/introduction.rst deleted file mode 100644 index 058f39f9..00000000 --- a/mitmproxy/docs/introduction.rst +++ /dev/null @@ -1,24 +0,0 @@ -Introduction -============ - -**mitmproxy** is an interactive, SSL-capable man-in-the-middle proxy for HTTP -with a console interface. - -**mitmdump** is the command-line version of mitmproxy. Think tcpdump for HTTP. - -Documentation, tutorials and distribution packages can be found on the -mitmproxy website: `mitmproxy.org `_ - - -.. rubric:: Features - - -- Intercept HTTP requests and responses and modify them on the fly. -- Save complete HTTP conversations for later replay and analysis. -- Replay the client-side of an HTTP conversations. -- Replay HTTP responses of a previously recorded server. -- Reverse proxy mode to forward traffic to a specified server. -- Transparent proxy mode on OSX and Linux. -- Make scripted changes to HTTP traffic using Python. -- SSL certificates for interception are generated on the fly. -- And much, much more. diff --git a/mitmproxy/docs/mitmdump.rst b/mitmproxy/docs/mitmdump.rst deleted file mode 100644 index d9b4a26b..00000000 --- a/mitmproxy/docs/mitmdump.rst +++ /dev/null @@ -1,66 +0,0 @@ -.. _mitmdump: -.. program:: mitmdump - -mitmdump -======== - - -**mitmdump** is the command-line companion to mitmproxy. It provides -tcpdump-like functionality to let you view, record, and programmatically -transform HTTP traffic. See the :option:`--help` flag output for complete -documentation. - - - -Examples --------- - -Saving traffic -^^^^^^^^^^^^^^ - ->>> mitmdump -w outfile - -Start up mitmdump in proxy mode, and write all traffic to **outfile**. - - -Filtering saved traffic -^^^^^^^^^^^^^^^^^^^^^^^ - ->>> mitmdump -nr infile -w outfile "~m post" - -Start mitmdump without binding to the proxy port (:option:`-n`), read all flows from -infile, apply the specified filter expression (only match POSTs), and write to -outfile. - - -Client replay -^^^^^^^^^^^^^ - ->>> mitmdump -nc outfile - -Start mitmdump without binding to the proxy port (:option:`-n`), then replay all -requests from outfile (:option:`-c filename`). Flags combine in the obvious way, so -you can replay requests from one file, and write the resulting flows to -another: - ->>> mitmdump -nc srcfile -w dstfile - -See the :ref:`clientreplay` section for more information. - - -Running a script -^^^^^^^^^^^^^^^^ - ->>> mitmdump -s examples/add_header.py - -This runs the **add_header.py** example script, which simply adds a new header -to all responses. - -Scripted data transformation -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - ->>> mitmdump -ns examples/add_header.py -r srcfile -w dstfile - -This command loads flows from **srcfile**, transforms it according to the -specified script, then writes it back to **dstfile**. - diff --git a/mitmproxy/docs/mitmproxy-docs.png b/mitmproxy/docs/mitmproxy-docs.png deleted file mode 100644 index 273fb8db..00000000 Binary files a/mitmproxy/docs/mitmproxy-docs.png and /dev/null differ diff --git a/mitmproxy/docs/mitmproxy-long.png b/mitmproxy/docs/mitmproxy-long.png deleted file mode 100644 index f9397d1e..00000000 Binary files a/mitmproxy/docs/mitmproxy-long.png and /dev/null differ diff --git a/mitmproxy/docs/mitmproxy.rst b/mitmproxy/docs/mitmproxy.rst deleted file mode 100644 index fa3b57c7..00000000 --- a/mitmproxy/docs/mitmproxy.rst +++ /dev/null @@ -1,126 +0,0 @@ -.. _mitmproxy: -.. program:: mitmproxy - -mitmproxy -========= - - -**mitmproxy** is a console tool that allows interactive examination and -modification of HTTP traffic. It differs from mitmdump in that all flows are -kept in memory, which means that it's intended for taking and manipulating -small-ish samples. Use the :kbd:`?` shortcut key to view, context-sensitive -documentation from any **mitmproxy** screen. - -Flow list ---------- - -The flow list shows an index of captured flows in chronological order. - -.. image:: screenshots/mitmproxy.png - -- **1**: A GET request, returning a 302 Redirect response. -- **2**: A GET request, returning 16.75kb of text/html data. -- **3**: A replayed request. -- **4**: Intercepted flows are indicated with orange text. The user may edit - these flows, and then accept them (using the :kbd:`a` key) to continue. In this - case, the request has been intercepted on the way to the server. -- **5**: A response intercepted from the server on the way to the client. -- **6**: The event log can be toggled on and off using the :kbd:`e` shortcut key. This - pane shows events and errors that may not result in a flow that shows up in the - flow pane. -- **7**: Flow count. -- **8**: Various information on mitmproxy's state. In this case, we have an - interception pattern set to ``.*``. -- **9**: Bind address indicator - mitmproxy is listening on port 8080 of all - interfaces. - - -Flow view ---------- - -The **Flow View** lets you inspect and manipulate a single flow: - -.. image:: screenshots/mitmproxy-flowview.png - -- **1**: Flow summary. -- **2**: The Request/Response tabs, showing you which part of the flow you are - currently viewing. In the example above, we're viewing the Response. Hit :kbd:`tab` - to switch between the Response and the Request. -- **3**: Headers. -- **4**: Body. -- **5**: View Mode indicator. In this case, we're viewing the body in **hex** mode. The other - available modes are **pretty**, which uses a number of heuristics to show you a friendly - view of various content types, and **raw**, which shows you exactly what's there without any - changes. You can change modes using the :kbd:`m` key. - - -Grid Editor ------------ - -Much of the data that we'd like to interact with in mitmproxy is structured. -For instance, headers, queries and form data can all be thought of as a list of -key/value pairs. Mitmproxy has a built-in editor that lays this type of data -out in a grid for easy manipulation. - -At the moment, the Grid Editor is used in four parts of mitmproxy: - - - Editing request or response headers (:kbd:`e` for edit, then :kbd:`h` for headers in flow view) - - Editing a query string (:kbd:`e` for edit, then :kbd:`q` for query in flow view) - - Editing a URL-encoded form (:kbd:`e` for edit, then :kbd:`f` for form in flow view) - - Editing replacement patterns (:kbd:`o` for options, then :kbd:`R` for Replacement Patterns) - -If there is is no data, an empty editor will be started to let you add some. -Here is the editor showing the headers from a request: - -.. image:: screenshots/mitmproxy-kveditor.png - -To edit, navigate to the key or value you want to modify using the arrow or vi -navigation keys, and press enter. The background color will change to show that -you are in edit mode for the specified field: - -.. image:: screenshots/mitmproxy-kveditor-editmode.png - -Modify the field as desired, then press escape to exit edit mode when you're -done. You can also add a row (:kbd:`a` key), delete a row (:kbd:`d` key), spawn an -external editor on a field (:kbd:`e` key). Be sure to consult the context-sensitive -help (:kbd:`?` key) for more. - -Example: Interception ---------------------- - -**mitmproxy**'s interception functionality lets you pause an HTTP request or -response, inspect and modify it, and then accept it to send it on to the server -or client. - - -1: Set an interception pattern -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: screenshots/mitmproxy-intercept-filt.png - -We press :kbd:`i` to set an interception pattern. In this case, the ``~q`` filter -pattern tells **mitmproxy** to intercept all requests. For complete filter -syntax, see the :ref:`filters` section of the documentation, -or the built-in help function in **mitmproxy**. - -2: Intercepted connections are indicated with orange text: -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: screenshots/mitmproxy-intercept-mid.png - -3: You can now view and modify the request: -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: screenshots/mitmproxy-intercept-options.png - -In this case, we viewed the request by selecting it, pressed :kbd:`e` for "edit" -and :kbd:`m` for "method" to change the HTTP request method. - -4: Accept the intercept to continue: -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: screenshots/mitmproxy-intercept-result.png - -Finally, we press :kbd:`a` to accept the modified request, which is then sent on to -the server. In this case, we changed the request from an HTTP GET to -OPTIONS, and Google's server has responded with a 405 "Method not allowed". diff --git a/mitmproxy/docs/modes.rst b/mitmproxy/docs/modes.rst deleted file mode 100644 index 2c87b2a3..00000000 --- a/mitmproxy/docs/modes.rst +++ /dev/null @@ -1,193 +0,0 @@ -.. _modes: - -Modes of Operation -================== - -Mitmproxy has four modes of operation that allow you to use mitmproxy in a -variety of scenarios: - -- **Regular** (the default) -- **Transparent** -- **Reverse Proxy** -- **Upstream Proxy** - - -Now, which one should you pick? Use this flow chart: - -.. image:: schematics/proxy-modes-flowchart.png - :align: center - -Regular Proxy -------------- - -Mitmproxy's regular mode is the simplest and the easiest to set up. - -1. Start mitmproxy. -2. Configure your client to use mitmproxy by explicitly setting an HTTP proxy. -3. Quick Check: You should already be able to visit an unencrypted HTTP site through the proxy. -4. Open the magic domain **mitm.it** and install the certificate for your device. - -.. note:: - Unfortunately, some applications bypass the system HTTP proxy settings - Android applications - are a common example. In these cases, you need to use mitmproxy's transparent mode. - -If you are proxying an external device, your network will probably look like this: - -.. image:: schematics/proxy-modes-regular.png - :align: center - -The square brackets signify the source and destination IP addresses. Your -client explicitly connects to mitmproxy and mitmproxy explicitly connects -to the target server. - -Transparent Proxy ------------------ - -In transparent mode, traffic is directed into a proxy at the network layer, -without any client configuration required. This makes transparent proxying -ideal for situations where you can't change client behaviour. In the graphic -below, a machine running mitmproxy has been inserted between the router and -the internet: - -.. image:: schematics/proxy-modes-transparent-1.png - :align: center - -The square brackets signify the source and destination IP addresses. Round -brackets mark the next hop on the *Ethernet/data link* layer. This distinction -is important: when the packet arrives at the mitmproxy machine, it must still -be addressed to the target server. This means that Network Address Translation -should not be applied before the traffic reaches mitmproxy, since this would -remove the target information, leaving mitmproxy unable to determine the real -destination. - -.. image:: schematics/proxy-modes-transparent-wrong.png - :align: center - -Common Configurations -^^^^^^^^^^^^^^^^^^^^^ - -There are many ways to configure your network for transparent proxying. We'll -look at two common scenarios: - -1. Configuring the client to use a custom gateway/router/"next hop" -2. Implementing custom routing on the router - -In most cases, the first option is recommended due to its ease of use. - -(a) Custom Gateway -~~~~~~~~~~~~~~~~~~ - -One simple way to get traffic to the mitmproxy machine with the destination IP -intact, is to simply configure the client with the mitmproxy box as the -default gateway. - -.. image:: schematics/proxy-modes-transparent-2.png - :align: center - -In this scenario, we would: - -1. Configure the proxy machine for transparent mode. You can find instructions - in the :ref:`transparent` section. -2. Configure the client to use the proxy machine's IP as the default gateway. -3. Quick Check: At this point, you should already be able to visit an - unencrypted HTTP site over the proxy. -4. Open the magic domain **mitm.it** and install the certificate - for your device. - -Setting the custom gateway on clients can be automated by serving the settings -out to clients over DHCP. This lets set up an interception network where all -clients are proxied automatically, which can save time and effort. - -.. admonition:: Troubleshooting Transparent Mode - :class: note - - Incorrect transparent mode configurations are a frequent source of - error. If it doesn't work for you, try the following things: - - - Open mitmproxy's event log (press :kbd:`e`) - do you see clientconnect messages? - If not, the packets are not arriving at the proxy. One common cause is the occurrence of ICMP - redirects, which means that your machine is telling the client that there's a faster way to - the internet by contacting your router directly (see the :ref:`transparent` section on how to - disable them). If in doubt, Wireshark_ may help you to see whether something arrives at your - machine or not. - - Make sure you have not explicitly configured an HTTP proxy on the client. - This is not needed in transparent mode. - - Re-check the instructions in the :ref:`transparent` section. Anything you missed? - - If you encounter any other pitfalls that should be listed here, please let us know! - -(b) Custom Routing -~~~~~~~~~~~~~~~~~~ - -In some cases, you may need more fine-grained control of which traffic reaches -the mitmproxy instance, and which doesn't. You may, for instance, choose only -to divert traffic to some hosts into the transparent proxy. There are a huge -number of ways to accomplish this, and much will depend on the router or -packet filter you're using. In most cases, the configuration will look like -this: - -.. image:: schematics/proxy-modes-transparent-3.png - :align: center - - -Reverse Proxy -------------- - -mitmproxy is usually used with a client that uses the proxy to access the -Internet. Using reverse proxy mode, you can use mitmproxy to act like a normal -HTTP server: - -.. image:: schematics/proxy-modes-reverse.png - :align: center - -There are various use-cases: - -- Say you have an internal API running at http://example.local/. You could now - set up mitmproxy in reverse proxy mode at http://debug.example.local/ and - dynamically point clients to this new API endpoint, which provides them - with the same data and you with debug information. Similarly, you could move - your real server to a different IP/port and set up mitmproxy in the original - place to debug and or redirect all sessions. - -- Say you're a web developer working on http://example.com/ (with a development - version running on http://localhost:8000/). You can modify your hosts file so that - example.com points to 127.0.0.1 and then run mitmproxy in reverse proxy mode - on port 80. You can test your app on the example.com domain and get all - requests recorded in mitmproxy. - -- Say you have some toy project that should get SSL support. Simply set up - mitmproxy as a reverse proxy on port 443 and you're done (``mitmdump -p 443 -R - http://localhost:80/``). Mitmproxy auto-detects TLS traffic and intercepts it dynamically. - There are better tools for this specific task, but mitmproxy is very quick and simple way to - set up an SSL-speaking server. - -- Want to add a non-SSL-capable compression proxy in front of your server? You - could even spawn a mitmproxy instance that terminates SSL (``-R http://...``), - point it to the compression proxy and let the compression proxy point to a - SSL-initiating mitmproxy (``-R https://...``), which then points to the real - server. As you see, it's a fairly flexible thing. - -.. admonition:: Caveat: Interactive Use - :class: warning - - Reverse Proxy mode is usually not sufficient to create a copy of an interactive website at - different URL. The HTML served to the client remains unchanged - as soon as the user clicks on - an non-relative URL (or downloads a non-relative image resource), traffic no longer passes - through mitmproxy. - -Upstream Proxy --------------- - -If you want to chain proxies by adding mitmproxy in front of a different proxy -appliance, you can use mitmproxy's upstream mode. In upstream mode, all -requests are unconditionally transferred to an upstream proxy of your choice. - -.. image:: schematics/proxy-modes-upstream.png - :align: center - -mitmproxy supports both explicit HTTP and explicit HTTPS in upstream proxy -mode. You could in theory chain multiple mitmproxy instances in a row, but -that doesn't make any sense in practice (i.e. outside of our tests). - - -.. _Wireshark: https://wireshark.org/ diff --git a/mitmproxy/docs/schematics/_explicit.graffle/data.plist b/mitmproxy/docs/schematics/_explicit.graffle/data.plist deleted file mode 100644 index bc5ef104..00000000 --- a/mitmproxy/docs/schematics/_explicit.graffle/data.plist +++ /dev/null @@ -1,572 +0,0 @@ - - - - - ActiveLayerIndex - 0 - ApplicationVersion - - com.omnigroup.OmniGraffle.MacAppStore - 139.16 - - AutoAdjust - - BackgroundGraphic - - Bounds - {{0, 0}, {559.19998741149902, 782.79998779296875}} - Class - SolidGraphic - ID - 2 - Style - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - BaseZoom - 0 - CanvasOrigin - {0, 0} - ColumnAlign - 1 - ColumnSpacing - 36 - CreationDate - 2013-01-02 19:31:53 +0000 - Creator - Aldo Cortesi - DisplayScale - 1.000 cm = 1.000 cm - GraphDocumentVersion - 8 - GraphicsList - - - Class - LineGraphic - ID - 4074 - Points - - {300.4483540852865, 420.70833897590637} - {344.88497416178387, 420.70833897590654} - {362.21830749511713, 420.04167230923986} - {413.55166625976557, 419.70833905537921} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4070 - Points - - {84.896692911783873, 420.66667453447985} - {129.33331298828122, 420.66667453448002} - {146.66664632161454, 420.00000786781334} - {198.00000508626297, 419.66667461395269} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{326.00000000000023, 391.39999198913591}, {62, 24}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4063 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 2: Forwarded \ -Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{110, 403.39997863769622}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4061 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 1: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{430.83098347981803, 515.99999999999989}, {36, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4026 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Server} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{40.499999999999993, 486.66666666666663}, {31, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4025 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Client} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} - Class - ShapedGraphic - ID - 4004 - ImageID - 6 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - Bounds - {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} - Class - ShapedGraphic - ID - 4023 - Shape - Rectangle - Style - - fill - - Color - - b - 0 - g - 0.463735 - r - 1 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 mitmproxy} - - - - Bounds - {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} - Class - ShapedGraphic - ID - 134 - ImageID - 3 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - GridInfo - - GuidesLocked - NO - GuidesVisible - YES - HPages - 1 - ImageCounter - 7 - ImageLinkBack - - - - - ImageList - - image6.tiff - image3.icns - - KeepToScale - - Layers - - - Lock - NO - Name - Layer 1 - Print - YES - View - YES - - - LayoutInfo - - Animate - NO - circoMinDist - 18 - circoSeparation - 0.0 - layoutEngine - dot - neatoSeparation - 0.0 - twopiSeparation - 0.0 - - LinksVisible - NO - MagnetsVisible - NO - MasterSheets - - ModificationDate - 2013-01-03 02:27:49 +0000 - Modifier - Aldo Cortesi - NotesVisible - NO - Orientation - 2 - OriginVisible - NO - PageBreaks - YES - PrintInfo - - NSBottomMargin - - float - 41 - - NSHorizonalPagination - - coded - BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG - - NSLeftMargin - - float - 18 - - NSPaperSize - - size - {595.19998741149902, 841.79998779296875} - - NSPrintReverseOrientation - - int - 0 - - NSRightMargin - - float - 18 - - NSTopMargin - - float - 18 - - - PrintOnePage - - ReadOnly - NO - RowAlign - 1 - RowSpacing - 36 - SheetTitle - Canvas 1 - SmartAlignmentGuidesActive - YES - SmartDistanceGuidesActive - YES - UniqueID - 1 - UseEntirePage - - VPages - 1 - WindowInfo - - CurrentSheet - 0 - ExpandedCanvases - - - name - Canvas 1 - - - Frame - {{300, 236}, {974, 874}} - ListView - - OutlineWidth - 142 - RightSidebar - - ShowRuler - - Sidebar - - SidebarWidth - 120 - VisibleRegion - {{0, 202}, {550, 469.33333333333337}} - Zoom - 1.5 - ZoomValues - - - Canvas 1 - 1.5 - 1 - - - - - diff --git a/mitmproxy/docs/schematics/_explicit.graffle/image3.icns b/mitmproxy/docs/schematics/_explicit.graffle/image3.icns deleted file mode 100644 index 964df4b8..00000000 Binary files a/mitmproxy/docs/schematics/_explicit.graffle/image3.icns and /dev/null differ diff --git a/mitmproxy/docs/schematics/_explicit.graffle/image6.tiff b/mitmproxy/docs/schematics/_explicit.graffle/image6.tiff deleted file mode 100644 index bd6ed534..00000000 Binary files a/mitmproxy/docs/schematics/_explicit.graffle/image6.tiff and /dev/null differ diff --git a/mitmproxy/docs/schematics/_explicit_https.graffle/data.plist b/mitmproxy/docs/schematics/_explicit_https.graffle/data.plist deleted file mode 100644 index 306630a0..00000000 --- a/mitmproxy/docs/schematics/_explicit_https.graffle/data.plist +++ /dev/null @@ -1,1054 +0,0 @@ - - - - - ActiveLayerIndex - 0 - ApplicationVersion - - com.omnigroup.OmniGraffle.MacAppStore - 139.16 - - AutoAdjust - - BackgroundGraphic - - Bounds - {{0, 0}, {559.19998741149902, 782.79998779296875}} - Class - SolidGraphic - ID - 2 - Style - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - BaseZoom - 0 - CanvasOrigin - {0, 0} - ColumnAlign - 1 - ColumnSpacing - 36 - CreationDate - 2013-01-02 19:31:53 +0000 - Creator - Aldo Cortesi - DisplayScale - 1.000 cm = 1.000 cm - GraphDocumentVersion - 8 - GraphicsList - - - Class - LineGraphic - ID - 4075 - Points - - {299.94835408528644, 473.66668184598285} - {344.38497416178376, 473.66668184598302} - {361.71830749511713, 473.00001517931634} - {413.05166625976557, 472.66668192545569} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4074 - Points - - {300.4483540852865, 420.70833897590637} - {344.88497416178387, 420.70833897590654} - {362.21830749511713, 420.04167230923986} - {413.55166625976557, 419.70833905537921} - - Style - - stroke - - HeadArrow - 0 - Legacy - - TailArrow - FilledArrow - - - - - Class - LineGraphic - ID - 4073 - Points - - {300.44835408528655, 367.66666611035561} - {344.88497416178393, 367.66666611035578} - {362.21830749511719, 366.99999944368909} - {413.55166625976568, 366.66666618982845} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4072 - Points - - {84.896697998046875, 526.66670727729809} - {129.33331807454422, 526.6667072772982} - {146.66665140787754, 526.00004061063157} - {198.00001017252598, 525.66670735677087} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4071 - Points - - {84.896687825520942, 472.91668446858688} - {197.99999491373694, 472.66668319702148} - - Style - - stroke - - HeadArrow - 0 - Legacy - - TailArrow - FilledArrow - - - - - Class - LineGraphic - ID - 4070 - Points - - {84.896692911783873, 420.66667453447985} - {129.33331298828122, 420.66667453448002} - {146.66664632161454, 420.00000786781334} - {198.00000508626297, 419.66667461395269} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{316.49998792012531, 326.66665395100904}, {65, 36}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4069 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 4: Initiate SSL \ -handshake \ -with SNI} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{317.00000000000006, 456.66707356770831}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4067 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 8: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.187746683756515, 509.33333333333331}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4066 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 7: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.1877466837567, 441.50006103515642}, {76, 24}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4065 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 6: Complete SSL\ -handshake} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{316.99998982747411, 403.66686820983904}, {64, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4063 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 5: CN & SANs} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.187741597493542, 380.00018183390387}, {65, 36}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4061 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 3: Initiate SSL \ -handshake \ -with SNI} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.187745571136503, 338.66666666666669}, {84, 24}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4060 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 2: 200 Connection \ -Established} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.187741915384976, 283.66659164428717}, {64, 24}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4058 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 1: CONNECT \ -request} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ID - 4041 - Points - - {84.896692911783944, 366.91666793823208} - {198, 366.66666666666669} - - Style - - stroke - - HeadArrow - 0 - Legacy - - TailArrow - FilledArrow - - - - - Class - LineGraphic - ID - 31 - Points - - {84.896687825520857, 314.66666126251221} - {129.33330790201822, 314.66666126251238} - {146.66664123535153, 313.99999459584569} - {198, 313.66666134198505} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{430.83098347981803, 515.99999999999989}, {36, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4026 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Server} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{40.499999999999993, 486.66666666666663}, {31, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4025 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Client} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} - Class - ShapedGraphic - ID - 4004 - ImageID - 6 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - Bounds - {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} - Class - ShapedGraphic - ID - 4023 - Shape - Rectangle - Style - - fill - - Color - - b - 0 - g - 0.463735 - r - 1 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 mitmproxy} - - - - Bounds - {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} - Class - ShapedGraphic - ID - 134 - ImageID - 3 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - GridInfo - - GuidesLocked - NO - GuidesVisible - YES - HPages - 1 - ImageCounter - 7 - ImageLinkBack - - - - - ImageList - - image6.tiff - image3.icns - - KeepToScale - - Layers - - - Lock - NO - Name - Layer 1 - Print - YES - View - YES - - - LayoutInfo - - Animate - NO - circoMinDist - 18 - circoSeparation - 0.0 - layoutEngine - dot - neatoSeparation - 0.0 - twopiSeparation - 0.0 - - LinksVisible - NO - MagnetsVisible - NO - MasterSheets - - ModificationDate - 2013-01-03 02:14:45 +0000 - Modifier - Aldo Cortesi - NotesVisible - NO - Orientation - 2 - OriginVisible - NO - PageBreaks - YES - PrintInfo - - NSBottomMargin - - float - 41 - - NSHorizonalPagination - - coded - BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG - - NSLeftMargin - - float - 18 - - NSPaperSize - - size - {595.19998741149902, 841.79998779296875} - - NSPrintReverseOrientation - - int - 0 - - NSRightMargin - - float - 18 - - NSTopMargin - - float - 18 - - - PrintOnePage - - ReadOnly - NO - RowAlign - 1 - RowSpacing - 36 - SheetTitle - Canvas 1 - SmartAlignmentGuidesActive - YES - SmartDistanceGuidesActive - YES - UniqueID - 1 - UseEntirePage - - VPages - 1 - WindowInfo - - CurrentSheet - 0 - ExpandedCanvases - - - name - Canvas 1 - - - Frame - {{271, 336}, {974, 874}} - ListView - - OutlineWidth - 142 - RightSidebar - - ShowRuler - - Sidebar - - SidebarWidth - 120 - VisibleRegion - {{0, 202}, {550, 469.33333333333337}} - Zoom - 1.5 - ZoomValues - - - Canvas 1 - 1.5 - 1 - - - - - diff --git a/mitmproxy/docs/schematics/_explicit_https.graffle/image3.icns b/mitmproxy/docs/schematics/_explicit_https.graffle/image3.icns deleted file mode 100644 index 964df4b8..00000000 Binary files a/mitmproxy/docs/schematics/_explicit_https.graffle/image3.icns and /dev/null differ diff --git a/mitmproxy/docs/schematics/_explicit_https.graffle/image6.tiff b/mitmproxy/docs/schematics/_explicit_https.graffle/image6.tiff deleted file mode 100644 index bd6ed534..00000000 Binary files a/mitmproxy/docs/schematics/_explicit_https.graffle/image6.tiff and /dev/null differ diff --git a/mitmproxy/docs/schematics/_transparent.graffle/data.plist b/mitmproxy/docs/schematics/_transparent.graffle/data.plist deleted file mode 100644 index 722b4a44..00000000 --- a/mitmproxy/docs/schematics/_transparent.graffle/data.plist +++ /dev/null @@ -1,771 +0,0 @@ - - - - - ActiveLayerIndex - 0 - ApplicationVersion - - com.omnigroup.OmniGraffle.MacAppStore - 139.16 - - AutoAdjust - - BackgroundGraphic - - Bounds - {{0, 0}, {559.19998741149902, 782.79998779296875}} - Class - SolidGraphic - ID - 2 - Style - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - BaseZoom - 0 - CanvasOrigin - {0, 0} - ColumnAlign - 1 - ColumnSpacing - 36 - CreationDate - 2013-01-02 19:31:53 +0000 - Creator - Aldo Cortesi - DisplayScale - 1.000 cm = 1.000 cm - GraphDocumentVersion - 8 - GraphicsList - - - Bounds - {{101.18773396809897, 358.41662979125977}, {62, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4079 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 2: Redirection} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{102.18775939941409, 405.16666666666663}, {78, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4078 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 3: HTTP Request} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ControlPoints - - {-29.333333333333343, 15.666671991348267} - {-14, -7.3333333333333712} - - ID - 37 - Points - - {196.99999491373691, 331.83332316080725} - {198.00000508626303, 402.49998982747394} - - Style - - stroke - - Bezier - - HeadArrow - FilledArrow - Legacy - - LineType - 1 - TailArrow - 0 - - - - - Bounds - {{205.34387397766082, 289.3333333333328}, {84, 52.666667938232422}} - Class - ShapedGraphic - ID - 4076 - Shape - Rectangle - Style - - fill - - Color - - b - 0.547829 - g - 1 - r - 0.790866 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 router} - - - - Class - LineGraphic - ID - 4075 - Points - - {304.061024983724, 422.16667167345679} - {348.49764506022132, 422.16667167345696} - {365.83097839355469, 421.50000500679027} - {417.16433715820312, 421.16667175292963} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{321.11267089843761, 405.16706339518225}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4067 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 4: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{101.18773682912195, 295.66660690307623}, {62, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4058 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 1: Connection} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ID - 4041 - Points - - {85.896713256836037, 421.41666793823208} - {199.00002034505209, 421.16666666666669} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 31 - Points - - {84.896687825520857, 314.66666126251221} - {129.33330790201822, 314.66666126251238} - {146.66664123535153, 313.99999459584569} - {198, 313.66666134198505} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{430.83098347981803, 515.99999999999989}, {36, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4026 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Server} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{40.499999999999993, 486.66666666666663}, {31, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4025 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Client} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} - Class - ShapedGraphic - ID - 4004 - ImageID - 6 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - Bounds - {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} - Class - ShapedGraphic - ID - 4023 - Shape - Rectangle - Style - - fill - - Color - - b - 0 - g - 0.463735 - r - 1 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 mitmproxy} - - - - Bounds - {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} - Class - ShapedGraphic - ID - 134 - ImageID - 3 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - GridInfo - - GuidesLocked - NO - GuidesVisible - YES - HPages - 1 - ImageCounter - 7 - ImageLinkBack - - - - - ImageList - - image6.tiff - image3.icns - - KeepToScale - - Layers - - - Lock - NO - Name - Layer 1 - Print - YES - View - YES - - - LayoutInfo - - Animate - NO - circoMinDist - 18 - circoSeparation - 0.0 - layoutEngine - dot - neatoSeparation - 0.0 - twopiSeparation - 0.0 - - LinksVisible - NO - MagnetsVisible - NO - MasterSheets - - ModificationDate - 2013-01-03 04:13:10 +0000 - Modifier - Aldo Cortesi - NotesVisible - NO - Orientation - 2 - OriginVisible - NO - PageBreaks - YES - PrintInfo - - NSBottomMargin - - float - 41 - - NSHorizonalPagination - - coded - BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG - - NSLeftMargin - - float - 18 - - NSPaperSize - - size - {595.19998741149902, 841.79998779296875} - - NSPrintReverseOrientation - - int - 0 - - NSRightMargin - - float - 18 - - NSTopMargin - - float - 18 - - - PrintOnePage - - ReadOnly - NO - RowAlign - 1 - RowSpacing - 36 - SheetTitle - Canvas 1 - SmartAlignmentGuidesActive - YES - SmartDistanceGuidesActive - YES - UniqueID - 1 - UseEntirePage - - VPages - 1 - WindowInfo - - CurrentSheet - 0 - ExpandedCanvases - - - name - Canvas 1 - - - Frame - {{295, 141}, {974, 874}} - ListView - - OutlineWidth - 142 - RightSidebar - - ShowRuler - - Sidebar - - SidebarWidth - 120 - VisibleRegion - {{0, 208}, {550, 469.33333333333337}} - Zoom - 1.5 - ZoomValues - - - Canvas 1 - 1.5 - 1 - - - - - diff --git a/mitmproxy/docs/schematics/_transparent.graffle/image3.icns b/mitmproxy/docs/schematics/_transparent.graffle/image3.icns deleted file mode 100644 index 964df4b8..00000000 Binary files a/mitmproxy/docs/schematics/_transparent.graffle/image3.icns and /dev/null differ diff --git a/mitmproxy/docs/schematics/_transparent.graffle/image6.tiff b/mitmproxy/docs/schematics/_transparent.graffle/image6.tiff deleted file mode 100644 index bd6ed534..00000000 Binary files a/mitmproxy/docs/schematics/_transparent.graffle/image6.tiff and /dev/null differ diff --git a/mitmproxy/docs/schematics/_transparent_https.graffle/data.plist b/mitmproxy/docs/schematics/_transparent_https.graffle/data.plist deleted file mode 100644 index 9c1395d7..00000000 --- a/mitmproxy/docs/schematics/_transparent_https.graffle/data.plist +++ /dev/null @@ -1,1096 +0,0 @@ - - - - - ActiveLayerIndex - 0 - ApplicationVersion - - com.omnigroup.OmniGraffle.MacAppStore - 139.16 - - AutoAdjust - - BackgroundGraphic - - Bounds - {{0, 0}, {559.19998741149902, 782.79998779296875}} - Class - SolidGraphic - ID - 2 - Style - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - BaseZoom - 0 - CanvasOrigin - {0, 0} - ColumnAlign - 1 - ColumnSpacing - 36 - CreationDate - 2013-01-02 19:31:53 +0000 - Creator - Aldo Cortesi - DisplayScale - 1.000 cm = 1.000 cm - GraphDocumentVersion - 8 - GraphicsList - - - Class - LineGraphic - ID - 4075 - Points - - {299.99999999999994, 470.90565482775372} - {344.43662007649726, 470.90565482775389} - {361.76995340983063, 470.23898816108721} - {413.10331217447907, 469.90565490722656} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4074 - Points - - {300.5, 417.94731195767724} - {344.93662007649738, 417.94731195767741} - {362.26995340983063, 417.28064529101073} - {413.60331217447907, 416.94731203715008} - - Style - - stroke - - HeadArrow - 0 - Legacy - - TailArrow - FilledArrow - - - - - Class - LineGraphic - ID - 4073 - Points - - {300.50000000000006, 364.90563909212648} - {344.93662007649743, 364.90563909212665} - {362.26995340983069, 364.23897242545996} - {413.60331217447919, 363.90563917159932} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{316.55163383483881, 323.90562693277991}, {65, 36}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4069 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 4: Initiate SSL \ -handshake \ -with SNI} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{317.05164591471356, 453.90604654947919}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4067 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 8: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{317.05163574218761, 400.90584119160991}, {64, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4063 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 5: CN & SANs} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ID - 4072 - Points - - {85.333343505859332, 525.3331921100596} - {129.7699635823565, 525.3331921100596} - {147.10329691568987, 524.66652544339308} - {198.4366556803383, 524.33319218953238} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Class - LineGraphic - ID - 4071 - Points - - {85.3333333333334, 471.58316930134964} - {198.43664042154924, 471.33316802978419} - - Style - - stroke - - HeadArrow - 0 - Legacy - - TailArrow - FilledArrow - - - - - Class - LineGraphic - ID - 4070 - Points - - {85.33333841959633, 419.33315936724267} - {129.76995849609349, 419.33315936724279} - {147.10329182942687, 418.66649270057616} - {198.4366505940753, 418.33315944671557} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{97.957725524902315, 508.66666666666663}, {49, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4066 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 7: Request} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.624392191569157, 440.16654586791918}, {76, 24}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4065 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 6: Complete SSL\ -handshake} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.624387105305999, 377.33333333333331}, {65, 36}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4061 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 3: Initiate SSL \ -handshake \ -with SNI} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{94.624387105305971, 344.58320871988946}, {62, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4079 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 2: Redirection} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ControlPoints - - {-29.333333333333343, 15.666671991348267} - {-14, -7.3333333333333712} - - ID - 37 - Points - - {197.43664042154938, 317.99990208943694} - {198.4366505940755, 388.66656875610363} - - Style - - stroke - - Bezier - - HeadArrow - FilledArrow - Legacy - - LineType - 1 - TailArrow - 0 - - - - - Bounds - {{205.34387397766082, 289.3333333333328}, {84, 52.666667938232422}} - Class - ShapedGraphic - ID - 4076 - Shape - Rectangle - Style - - fill - - Color - - b - 0.547829 - g - 1 - r - 0.790866 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 router} - - - - Bounds - {{97.957725842793792, 284.99970499674527}, {62, 12}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - FontInfo - - Font - Helvetica - Size - 12 - - ID - 4058 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs20 \cf0 1: Connection} - VerticalPad - 0 - - Wrap - NO - - - Class - LineGraphic - ID - 31 - Points - - {85.333333333333329, 300.8332401911419} - {129.76995340983069, 300.83324019114207} - {147.10328674316401, 300.16657352447538} - {198.43664550781247, 299.83324027061474} - - Style - - stroke - - HeadArrow - FilledArrow - Legacy - - TailArrow - 0 - - - - - Bounds - {{430.83098347981803, 515.99999999999989}, {36, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4026 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Server} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{40.499999999999993, 486.66666666666663}, {31, 14}} - Class - ShapedGraphic - FitText - YES - Flow - Resize - ID - 4025 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - Text - - Pad - 0 - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf0 Client} - VerticalPad - 0 - - Wrap - NO - - - Bounds - {{417.16432189941418, 323.90565299479198}, {63.333332061767578, 185.52200317382812}} - Class - ShapedGraphic - ID - 4004 - ImageID - 6 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - Bounds - {{205.34386889139773, 289.33333333333331}, {84, 248.66667175292969}} - Class - ShapedGraphic - ID - 4023 - Shape - Rectangle - Style - - fill - - Color - - b - 0 - g - 0.463735 - r - 1 - - - - Text - - Text - {\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf340 -\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;} -{\colortbl;\red255\green255\blue255;\red37\green17\blue0;} -\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\qc - -\f0\fs24 \cf2 mitmproxy} - - - - Bounds - {{4.6666666467984399, 351.33332316080771}, {102.66666412353516, 130.66667175292969}} - Class - ShapedGraphic - ID - 134 - ImageID - 3 - Shape - Rectangle - Style - - fill - - Draws - NO - - shadow - - Draws - NO - - stroke - - Draws - NO - - - - - GridInfo - - GuidesLocked - NO - GuidesVisible - YES - HPages - 1 - ImageCounter - 7 - ImageLinkBack - - - - - ImageList - - image6.tiff - image3.icns - - KeepToScale - - Layers - - - Lock - NO - Name - Layer 1 - Print - YES - View - YES - - - LayoutInfo - - Animate - NO - circoMinDist - 18 - circoSeparation - 0.0 - layoutEngine - dot - neatoSeparation - 0.0 - twopiSeparation - 0.0 - - LinksVisible - NO - MagnetsVisible - NO - MasterSheets - - ModificationDate - 2013-01-03 04:16:32 +0000 - Modifier - Aldo Cortesi - NotesVisible - NO - Orientation - 2 - OriginVisible - NO - PageBreaks - YES - PrintInfo - - NSBottomMargin - - float - 41 - - NSHorizonalPagination - - coded - BAtzdHJlYW10eXBlZIHoA4QBQISEhAhOU051bWJlcgCEhAdOU1ZhbHVlAISECE5TT2JqZWN0AIWEASqEhAFxlwCG - - NSLeftMargin - - float - 18 - - NSPaperSize - - size - {595.19998741149902, 841.79998779296875} - - NSPrintReverseOrientation - - int - 0 - - NSRightMargin - - float - 18 - - NSTopMargin - - float - 18 - - - PrintOnePage - - ReadOnly - NO - RowAlign - 1 - RowSpacing - 36 - SheetTitle - Canvas 1 - SmartAlignmentGuidesActive - YES - SmartDistanceGuidesActive - YES - UniqueID - 1 - UseEntirePage - - VPages - 1 - WindowInfo - - CurrentSheet - 0 - ExpandedCanvases - - - name - Canvas 1 - - - Frame - {{869, 248}, {974, 874}} - ListView - - OutlineWidth - 142 - RightSidebar - - ShowRuler - - Sidebar - - SidebarWidth - 120 - VisibleRegion - {{0, 208}, {550, 469.33333333333337}} - Zoom - 1.5 - ZoomValues - - - Canvas 1 - 1.5 - 1 - - - - - diff --git a/mitmproxy/docs/schematics/_transparent_https.graffle/image3.icns b/mitmproxy/docs/schematics/_transparent_https.graffle/image3.icns deleted file mode 100644 index 964df4b8..00000000 Binary files a/mitmproxy/docs/schematics/_transparent_https.graffle/image3.icns and /dev/null differ diff --git a/mitmproxy/docs/schematics/_transparent_https.graffle/image6.tiff b/mitmproxy/docs/schematics/_transparent_https.graffle/image6.tiff deleted file mode 100644 index bd6ed534..00000000 Binary files a/mitmproxy/docs/schematics/_transparent_https.graffle/image6.tiff and /dev/null differ diff --git a/mitmproxy/docs/schematics/architecture.pdf b/mitmproxy/docs/schematics/architecture.pdf deleted file mode 100644 index 77f5ad58..00000000 Binary files a/mitmproxy/docs/schematics/architecture.pdf and /dev/null differ diff --git a/mitmproxy/docs/schematics/architecture.png b/mitmproxy/docs/schematics/architecture.png deleted file mode 100644 index 67d6c718..00000000 Binary files a/mitmproxy/docs/schematics/architecture.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/architecture.vsdx b/mitmproxy/docs/schematics/architecture.vsdx deleted file mode 100644 index c4ff13d2..00000000 Binary files a/mitmproxy/docs/schematics/architecture.vsdx and /dev/null differ diff --git a/mitmproxy/docs/schematics/how-mitmproxy-works-explicit-https.png b/mitmproxy/docs/schematics/how-mitmproxy-works-explicit-https.png deleted file mode 100644 index 1f1ca023..00000000 Binary files a/mitmproxy/docs/schematics/how-mitmproxy-works-explicit-https.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/how-mitmproxy-works-explicit.png b/mitmproxy/docs/schematics/how-mitmproxy-works-explicit.png deleted file mode 100644 index c9ba26a7..00000000 Binary files a/mitmproxy/docs/schematics/how-mitmproxy-works-explicit.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/how-mitmproxy-works-transparent-https.png b/mitmproxy/docs/schematics/how-mitmproxy-works-transparent-https.png deleted file mode 100644 index 559cddd2..00000000 Binary files a/mitmproxy/docs/schematics/how-mitmproxy-works-transparent-https.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/how-mitmproxy-works-transparent.png b/mitmproxy/docs/schematics/how-mitmproxy-works-transparent.png deleted file mode 100644 index 3994d681..00000000 Binary files a/mitmproxy/docs/schematics/how-mitmproxy-works-transparent.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-flowchart.png b/mitmproxy/docs/schematics/proxy-modes-flowchart.png deleted file mode 100644 index e9568dac..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-flowchart.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-regular.png b/mitmproxy/docs/schematics/proxy-modes-regular.png deleted file mode 100644 index 95bada08..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-regular.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-reverse.png b/mitmproxy/docs/schematics/proxy-modes-reverse.png deleted file mode 100644 index 071d3fc8..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-reverse.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-transparent-1.png b/mitmproxy/docs/schematics/proxy-modes-transparent-1.png deleted file mode 100644 index 002e0e76..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-transparent-1.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-transparent-2.png b/mitmproxy/docs/schematics/proxy-modes-transparent-2.png deleted file mode 100644 index 41997b05..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-transparent-2.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-transparent-3.png b/mitmproxy/docs/schematics/proxy-modes-transparent-3.png deleted file mode 100644 index ee26cb4f..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-transparent-3.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-transparent-wrong.png b/mitmproxy/docs/schematics/proxy-modes-transparent-wrong.png deleted file mode 100644 index ca501e93..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-transparent-wrong.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes-upstream.png b/mitmproxy/docs/schematics/proxy-modes-upstream.png deleted file mode 100644 index d40a6494..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes-upstream.png and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes.pdf b/mitmproxy/docs/schematics/proxy-modes.pdf deleted file mode 100644 index f07ea05e..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes.pdf and /dev/null differ diff --git a/mitmproxy/docs/schematics/proxy-modes.vsdx b/mitmproxy/docs/schematics/proxy-modes.vsdx deleted file mode 100644 index 0128a142..00000000 Binary files a/mitmproxy/docs/schematics/proxy-modes.vsdx and /dev/null differ diff --git a/mitmproxy/docs/screenshots/firefox3-import.jpg b/mitmproxy/docs/screenshots/firefox3-import.jpg deleted file mode 100644 index 47fcd672..00000000 Binary files a/mitmproxy/docs/screenshots/firefox3-import.jpg and /dev/null differ diff --git a/mitmproxy/docs/screenshots/firefox3-trust.jpg b/mitmproxy/docs/screenshots/firefox3-trust.jpg deleted file mode 100644 index 50a2f341..00000000 Binary files a/mitmproxy/docs/screenshots/firefox3-trust.jpg and /dev/null differ diff --git a/mitmproxy/docs/screenshots/firefox3.jpg b/mitmproxy/docs/screenshots/firefox3.jpg deleted file mode 100644 index 6c4613b6..00000000 Binary files a/mitmproxy/docs/screenshots/firefox3.jpg and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-gateway.png b/mitmproxy/docs/screenshots/ios-gateway.png deleted file mode 100644 index 2489cba3..00000000 Binary files a/mitmproxy/docs/screenshots/ios-gateway.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-installed.png b/mitmproxy/docs/screenshots/ios-installed.png deleted file mode 100644 index 2071e441..00000000 Binary files a/mitmproxy/docs/screenshots/ios-installed.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-manual.png b/mitmproxy/docs/screenshots/ios-manual.png deleted file mode 100644 index 3977acfe..00000000 Binary files a/mitmproxy/docs/screenshots/ios-manual.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-profile.png b/mitmproxy/docs/screenshots/ios-profile.png deleted file mode 100644 index 5bcd5a0d..00000000 Binary files a/mitmproxy/docs/screenshots/ios-profile.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-reverse.png b/mitmproxy/docs/screenshots/ios-reverse.png deleted file mode 100644 index 6ab5b7c0..00000000 Binary files a/mitmproxy/docs/screenshots/ios-reverse.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/ios-warning.png b/mitmproxy/docs/screenshots/ios-warning.png deleted file mode 100644 index d882c514..00000000 Binary files a/mitmproxy/docs/screenshots/ios-warning.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-flowview.png b/mitmproxy/docs/screenshots/mitmproxy-flowview.png deleted file mode 100644 index 154963fe..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-flowview.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-intercept-filt.png b/mitmproxy/docs/screenshots/mitmproxy-intercept-filt.png deleted file mode 100644 index 60556ee7..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-intercept-filt.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-intercept-mid.png b/mitmproxy/docs/screenshots/mitmproxy-intercept-mid.png deleted file mode 100644 index d5b03922..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-intercept-mid.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-intercept-options.png b/mitmproxy/docs/screenshots/mitmproxy-intercept-options.png deleted file mode 100644 index 8dc4ad2c..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-intercept-options.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-intercept-result.png b/mitmproxy/docs/screenshots/mitmproxy-intercept-result.png deleted file mode 100644 index 7d9f5c94..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-intercept-result.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-kveditor-editmode.png b/mitmproxy/docs/screenshots/mitmproxy-kveditor-editmode.png deleted file mode 100644 index a8315ee5..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-kveditor-editmode.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy-kveditor.png b/mitmproxy/docs/screenshots/mitmproxy-kveditor.png deleted file mode 100644 index 144b9701..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy-kveditor.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/mitmproxy.png b/mitmproxy/docs/screenshots/mitmproxy.png deleted file mode 100644 index 42a10e32..00000000 Binary files a/mitmproxy/docs/screenshots/mitmproxy.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/osx-addcert-alwaystrust.png b/mitmproxy/docs/screenshots/osx-addcert-alwaystrust.png deleted file mode 100644 index 4c5cc704..00000000 Binary files a/mitmproxy/docs/screenshots/osx-addcert-alwaystrust.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/win7-certstore-trustedroot.png b/mitmproxy/docs/screenshots/win7-certstore-trustedroot.png deleted file mode 100644 index e15a87f5..00000000 Binary files a/mitmproxy/docs/screenshots/win7-certstore-trustedroot.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/win7-certstore.png b/mitmproxy/docs/screenshots/win7-certstore.png deleted file mode 100644 index f8ce54bd..00000000 Binary files a/mitmproxy/docs/screenshots/win7-certstore.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/win7-wizard.png b/mitmproxy/docs/screenshots/win7-wizard.png deleted file mode 100644 index eff6ad09..00000000 Binary files a/mitmproxy/docs/screenshots/win7-wizard.png and /dev/null differ diff --git a/mitmproxy/docs/screenshots/winpythoninstaller.jpg b/mitmproxy/docs/screenshots/winpythoninstaller.jpg deleted file mode 100644 index 0473c66a..00000000 Binary files a/mitmproxy/docs/screenshots/winpythoninstaller.jpg and /dev/null differ diff --git a/mitmproxy/docs/scripting/inlinescripts.rst b/mitmproxy/docs/scripting/inlinescripts.rst deleted file mode 100644 index 89bff2c1..00000000 --- a/mitmproxy/docs/scripting/inlinescripts.rst +++ /dev/null @@ -1,231 +0,0 @@ -.. _inlinescripts: - -Inline Scripts -============== - -**mitmproxy** has a powerful scripting API that allows you to modify flows -on-the-fly or rewrite previously saved flows locally. - -The mitmproxy scripting API is event driven - a script is simply a Python -module that exposes a set of event methods. Here's a complete mitmproxy script -that adds a new header to every HTTP response before it is returned to the -client: - -.. literalinclude:: ../../examples/add_header.py - :caption: examples/add_header.py - :language: python - -The first argument to each event method is an instance of -:py:class:`~mitmproxy.script.ScriptContext` that lets the script interact with the global mitmproxy -state. The **response** event also gets an instance of :py:class:`~mitmproxy.script.ScriptContext`, -which we can use to manipulate the response itself. - -We can now run this script using mitmdump or mitmproxy as follows: - ->>> mitmdump -s add_header.py - -The new header will be added to all responses passing through the proxy. - -Examples --------- - -mitmproxy comes with a variety of example inline scripts, which demonstrate many basic tasks. -We encourage you to either browse them locally or on `GitHub`_. - - -Events ------- - -The ``context`` argument passed to each event method is always a -:py:class:`~mitmproxy.script.ScriptContext` instance. It is guaranteed to be the same object -for the scripts lifetime and is not shared between multiple inline scripts. You can safely use it -to store any form of state you require. - -Script Lifecycle Events -^^^^^^^^^^^^^^^^^^^^^^^ - -.. py:function:: start(context, argv) - - Called once on startup, before any other events. - - :param List[str] argv: The inline scripts' arguments. - For example, ``mitmproxy -s 'example.py --foo 42'`` sets argv to ``["--foo", "42"]``. - -.. py:function:: done(context) - - Called once on script shutdown, after any other events. - -Connection Events -^^^^^^^^^^^^^^^^^ - -.. py:function:: clientconnect(context, root_layer) - - Called when a client initiates a connection to the proxy. Note that - a connection can correspond to multiple HTTP requests. - - .. versionchanged:: 0.14 - - :param Layer root_layer: The root layer (see :ref:`protocols` for an explanation what the root - layer is), which provides transparent access to all attributes of the - :py:class:`~mitmproxy.proxy.RootContext`. For example, ``root_layer.client_conn.address`` - gives the remote address of the connecting client. - -.. py:function:: clientdisconnect(context, root_layer) - - Called when a client disconnects from the proxy. - - .. versionchanged:: 0.14 - - :param Layer root_layer: see :py:func:`clientconnect` - -.. py:function:: serverconnect(context, server_conn) - - Called before the proxy initiates a connection to the target server. Note that - a connection can correspond to multiple HTTP requests. - - :param ServerConnection server_conn: The server connection object. It is guaranteed to have a - non-None ``address`` attribute. - -.. py:function:: serverdisconnect(context, server_conn) - - Called when the proxy has closed the server connection. - - .. versionadded:: 0.14 - - :param ServerConnection server_conn: see :py:func:`serverconnect` - -HTTP Events -^^^^^^^^^^^ - -.. py:function:: request(context, flow) - - Called when a client request has been received. The ``flow`` object is - guaranteed to have a non-None ``request`` attribute. - - :param HTTPFlow flow: The flow containing the request which has been received. - The object is guaranteed to have a non-None ``request`` attribute. - -.. py:function:: responseheaders(context, flow) - - Called when the headers of a server response have been received. - This will always be called before the response hook. - - :param HTTPFlow flow: The flow containing the request and response. - The object is guaranteed to have non-None ``request`` and - ``response`` attributes. ``response.content`` will be ``None``, - as the response body has not been read yet. - -.. py:function:: response(context, flow) - - Called when a server response has been received. - - :param HTTPFlow flow: The flow containing the request and response. - The object is guaranteed to have non-None ``request`` and - ``response`` attributes. ``response.body`` will contain the raw response body, - unless response streaming has been enabled. - -.. py:function:: error(context, flow) - - Called when a flow error has occurred, e.g. invalid server responses, or - interrupted connections. This is distinct from a valid server HTTP error - response, which is simply a response with an HTTP error code. - - :param HTTPFlow flow: The flow containing the error. - It is guaranteed to have non-None ``error`` attribute. - -TCP Events -^^^^^^^^^^ - -.. py:function:: tcp_message(context, tcp_msg) - - .. warning:: API is subject to change - - If the proxy is in :ref:`TCP mode `, this event is called when it - receives a TCP payload from the client or server. - - The sender and receiver are identifiable. The message is user-modifiable. - - :param TcpMessage tcp_msg: see *examples/tcp_message.py* - -API ---- - -The canonical API documentation is the code, which you can browse here, locally or on `GitHub`_. -*Use the Source, Luke!* - -The main classes you will deal with in writing mitmproxy scripts are: - -:py:class:`~mitmproxy.script.ScriptContext` - - A handle for interacting with mitmproxy's Flow Master from within scripts. -:py:class:`~mitmproxy.models.ClientConnection` - - Describes a client connection. -:py:class:`~mitmproxy.models.ServerConnection` - - Describes a server connection. -:py:class:`~mitmproxy.models.HTTPFlow` - - A collection of objects representing a single HTTP transaction. -:py:class:`~mitmproxy.models.HTTPRequest` - - An HTTP request. -:py:class:`~mitmproxy.models.HTTPResponse` - - An HTTP response. -:py:class:`~mitmproxy.models.Error` - - A communications error. -:py:class:`netlib.http.Headers` - - A dictionary-like object for managing HTTP headers. -:py:class:`netlib.certutils.SSLCert` - - Exposes information SSL certificates. -:py:class:`mitmproxy.flow.FlowMaster` - - The "heart" of mitmproxy, usually subclassed as :py:class:`mitmproxy.dump.DumpMaster` or - :py:class:`mitmproxy.console.ConsoleMaster`. - -Script Context --------------- - -.. autoclass:: mitmproxy.script.ScriptContext - :members: - :undoc-members: - -Running scripts in parallel ---------------------------- - -We have a single flow primitive, so when a script is blocking, other requests are not processed. -While that's usually a very desirable behaviour, blocking scripts can be run threaded by using the -:py:obj:`mitmproxy.script.concurrent` decorator. -**If your script does not block, you should avoid the overhead of the decorator.** - -.. literalinclude:: ../../examples/nonblocking.py - :caption: examples/nonblocking.py - :language: python - -Make scripts configurable with arguments ----------------------------------------- - -Sometimes, you want to pass runtime arguments to the inline script. This can be simply done by -surrounding the script call with quotes, e.g. ```mitmdump -s 'script.py --foo 42'``. -The arguments are then exposed in the start event: - -.. literalinclude:: ../../examples/modify_response_body.py - :caption: examples/modify_response_body.py - :language: python - -Running scripts on saved flows ------------------------------- - -Sometimes, we want to run a script on :py:class:`~mitmproxy.models.Flow` objects that are already -complete. This happens when you start a script, and then load a saved set of flows from a file -(see the "scripted data transformation" example `here `_). -It also happens when you run a one-shot script on a single flow through the ``|`` (pipe) shortcut -in mitmproxy. - -In this case, there are no client connections, and the events are run in the following order: -**start**, **request**, **responseheaders**, **response**, **error**, **done**. -If the flow doesn't have a **response** or **error** associated with it, the matching events will -be skipped. - -Spaces in the script path -------------------------- - -By default, spaces are interpreted as a separator between the inline script and its arguments -(e.g. ``-s 'foo.py 42'``). Consequently, the script path needs to be wrapped in a separate pair of -quotes if it contains spaces: ``-s '\'./foo bar/baz.py\' 42'``. - -.. _GitHub: https://github.com/mitmproxy/mitmproxy diff --git a/mitmproxy/docs/scripting/mitmproxy.rst b/mitmproxy/docs/scripting/mitmproxy.rst deleted file mode 100644 index 1626eb5a..00000000 --- a/mitmproxy/docs/scripting/mitmproxy.rst +++ /dev/null @@ -1,27 +0,0 @@ -.. _mitmproxy: - -mitmproxy -========= - -.. note:: - - We strongly encourage you to use :ref:`inlinescripts` rather than mitmproxy. - - Inline Scripts are equally powerful and provide an easier syntax. - - Most examples are written as inline scripts. - - Multiple inline scripts can be used together. - - Inline Scripts can either be executed headless with mitmdump or within the mitmproxy UI. - - -All of mitmproxy's basic functionality is exposed through the **mitmproxy** -library. The example below shows a simple implementation of the "sticky cookie" -functionality included in the interactive mitmproxy program. Traffic is -monitored for ``Cookie`` and ``Set-Cookie`` headers, and requests are rewritten -to include a previously seen cookie if they don't already have one. In effect, -this lets you log in to a site using your browser, and then make subsequent -requests using a tool like curl, which will then seem to be part of the -authenticated session. - - -.. literalinclude:: ../../examples/stickycookies - :caption: examples/stickycookies - :language: python diff --git a/mitmproxy/docs/transparent.rst b/mitmproxy/docs/transparent.rst deleted file mode 100644 index eb77c76c..00000000 --- a/mitmproxy/docs/transparent.rst +++ /dev/null @@ -1,24 +0,0 @@ -.. _transparent: - -Transparent Proxying -==================== - -When a transparent proxy is used, traffic is redirected into a proxy at the -network layer, without any client configuration being required. This makes -transparent proxying ideal for those situations where you can't change client -behaviour - proxy-oblivious Android applications being a common example. - -To set up transparent proxying, we need two new components. The first is a -redirection mechanism that transparently reroutes a TCP connection destined for -a server on the Internet to a listening proxy server. This usually takes the -form of a firewall on the same host as the proxy server - iptables_ on Linux -or pf_ on OSX. When the proxy receives a redirected connection, it sees a vanilla -HTTP request, without a host specification. This is where the second new component -comes in - a host module that allows us to query the redirector for the original -destination of the TCP connection. - -At the moment, mitmproxy supports transparent proxying on OSX Lion and above, -and all current flavors of Linux. - -.. _iptables: http://www.netfilter.org/ -.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) diff --git a/mitmproxy/docs/transparent/linux.rst b/mitmproxy/docs/transparent/linux.rst deleted file mode 100644 index ce79128c..00000000 --- a/mitmproxy/docs/transparent/linux.rst +++ /dev/null @@ -1,45 +0,0 @@ -.. _linux: - -Linux -===== - -On Linux, mitmproxy integrates with the iptables redirection mechanism to -achieve transparent mode. - - 1. :ref:`Install the mitmproxy certificate on the test device ` - - 2. Enable IP forwarding: - - >>> sysctl -w net.ipv4.ip_forward=1 - - You may also want to consider enabling this permanently in ``/etc/sysctl.conf``. - - 3. If your target machine is on the same physical network and you configured it to use a custom - gateway, disable ICMP redirects: - - >>> echo 0 | sudo tee /proc/sys/net/ipv4/conf/*/send_redirects - - You may also want to consider enabling this permanently in ``/etc/sysctl.conf`` - as demonstrated `here `_. - - 4. Create an iptables ruleset that redirects the desired traffic to the - mitmproxy port. Details will differ according to your setup, but the - ruleset should look something like this: - - .. code-block:: none - - iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 - iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080 - - 5. Fire up mitmproxy. You probably want a command like this: - - >>> mitmproxy -T --host - - The :option:`-T` flag turns on transparent mode, and the :option:`--host` - argument tells mitmproxy to use the value of the Host header for URL display. - - 6. Finally, configure your test device to use the host on which mitmproxy is - running as the default gateway. - - -For a detailed walkthrough, have a look at the :ref:`transparent-dhcp` tutorial. diff --git a/mitmproxy/docs/transparent/osx.rst b/mitmproxy/docs/transparent/osx.rst deleted file mode 100644 index 1791105f..00000000 --- a/mitmproxy/docs/transparent/osx.rst +++ /dev/null @@ -1,70 +0,0 @@ -.. _osx: - -OSX -=== - -OSX Lion integrated the pf_ packet filter from the OpenBSD project, -which mitmproxy uses to implement transparent mode on OSX. -Note that this means we don't support transparent mode for earlier versions of OSX. - - 1. :ref:`Install the mitmproxy certificate on the test device ` - - 2. Enable IP forwarding: - - >>> sudo sysctl -w net.inet.ip.forwarding=1 - - 3. Place the following two lines in a file called, say, **pf.conf**: - - .. code-block:: none - - rdr on en2 inet proto tcp to any port 80 -> 127.0.0.1 port 8080 - rdr on en2 inet proto tcp to any port 443 -> 127.0.0.1 port 8080 - - These rules tell pf to redirect all traffic destined for port 80 or 443 - to the local mitmproxy instance running on port 8080. You should - replace ``en2`` with the interface on which your test device will appear. - - 4. Configure pf with the rules: - - >>> sudo pfctl -f pf.conf - - 5. And now enable it: - - >>> sudo pfctl -e - - 6. Configure sudoers to allow mitmproxy to access pfctl. Edit the file - **/etc/sudoers** on your system as root. Add the following line to the end - of the file: - - .. code-block:: none - - ALL ALL=NOPASSWD: /sbin/pfctl -s state - - Note that this allows any user on the system to run the command - ``/sbin/pfctl -s state`` as root without a password. This only allows - inspection of the state table, so should not be an undue security risk. If - you're special feel free to tighten the restriction up to the user running - mitmproxy. - - 7. Fire up mitmproxy. You probably want a command like this: - - >>> mitmproxy -T --host - - The :option:`-T` flag turns on transparent mode, and the :option:`--host` - argument tells mitmproxy to use the value of the Host header for URL display. - - 8. Finally, configure your test device to use the host on which mitmproxy is - running as the default gateway. - -.. note:: - - Note that the **rdr** rules in the pf.conf given above only apply to inbound - traffic. **This means that they will NOT redirect traffic coming from the box - running pf itself.** We can't distinguish between an outbound connection from a - non-mitmproxy app, and an outbound connection from mitmproxy itself - if you - want to intercept your OSX traffic, you should use an external host to run - mitmproxy. None the less, pf is flexible to cater for a range of creative - possibilities, like intercepting traffic emanating from VMs. See the - **pf.conf** man page for more. - -.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\) diff --git a/mitmproxy/docs/tutorials/30second.rst b/mitmproxy/docs/tutorials/30second.rst deleted file mode 100644 index 4c8bf326..00000000 --- a/mitmproxy/docs/tutorials/30second.rst +++ /dev/null @@ -1,66 +0,0 @@ -.. _30second: - -Client playback: a 30 second example -==================================== - -My local cafe is serviced by a rickety and unreliable wireless network, -generously sponsored with ratepayers' money by our city council. After -connecting, you are redirected to an SSL-protected page that prompts you for a -username and password. Once you've entered your details, you are free to enjoy -the intermittent dropouts, treacle-like speeds and incorrectly configured -transparent proxy. - -I tend to automate this kind of thing at the first opportunity, on the theory -that time spent now will be more than made up in the long run. In this case, I -might use Firebug_ to ferret out the form post -parameters and target URL, then fire up an editor to write a little script -using Python's urllib_ to simulate a submission. -That's a lot of futzing about. With mitmproxy we can do the job -in literally 30 seconds, without having to worry about any of the details. -Here's how. - -1. Run mitmdump to record our HTTP conversation to a file. ----------------------------------------------------------- - ->>> mitmdump -w wireless-login - -2. Point your browser at the mitmdump instance. ------------------------------------------------ - -I use a tiny Firefox addon called `Toggle Proxy`_ to switch quickly to and from mitmproxy. -I'm assuming you've already :ref:`configured -your browser with mitmproxy's SSL certificate -authority `. - -3. Log in as usual. -------------------- - -And that's it! You now have a serialized version of the login process in the -file wireless-login, and you can replay it at any time like this: - ->>> mitmdump -c wireless-login - -Embellishments --------------- - -We're really done at this point, but there are a couple of embellishments we -could make if we wanted. I use wicd_ to -automatically join wireless networks I frequent, and it lets me specify a -command to run after connecting. I used the client replay command above and -voila! - totally hands-free wireless network startup. - -We might also want to prune requests that download CSS, JS, images and so -forth. These add only a few moments to the time it takes to replay, but they're -not really needed and I somehow feel compelled to trim them anyway. So, we fire up -the mitmproxy console tool on our serialized conversation, like so: - ->>> mitmproxy -r wireless-login - -We can now go through and manually delete (using the :kbd:`d` keyboard shortcut) -everything we want to trim. When we're done, we use :kbd:`w` to save the -conversation back to the file. - -.. _Firebug: https://getfirebug.com/ -.. _urllib: https://docs.python.org/library/urllib.html -.. _Toggle Proxy: https://addons.mozilla.org/en-us/firefox/addon/toggle-proxy-51740/ -.. _wicd: https://launchpad.net/wicd diff --git a/mitmproxy/docs/tutorials/gamecenter.rst b/mitmproxy/docs/tutorials/gamecenter.rst deleted file mode 100644 index 9dce5df8..00000000 --- a/mitmproxy/docs/tutorials/gamecenter.rst +++ /dev/null @@ -1,128 +0,0 @@ -.. _gamecenter: - -Setting highscores on Apple's GameCenter -======================================== - -The setup ---------- - -In this tutorial, I'm going to show you how simple it is to creatively -interfere with Apple Game Center traffic using mitmproxy. To set things up, -:ref:`install the mitmproxy root certificate `. Then -start mitmproxy on your desktop, and configure the iPhone to use it as a proxy. - - -Taking a look at the Game Center traffic ----------------------------------------- - -Lets take a first look at the Game Center traffic. The game I'll use in this -tutorial is `Super Mega Worm`_ - a great little retro-apocalyptic sidescroller for the iPhone: - -.. image:: supermega.png - :align: center - - -After finishing a game (take your time), watch the traffic flowing through -mitmproxy: - -.. image:: one.png - :align: center - -We see a bunch of things we might expect - initialisation, the retrieval of -leaderboards and so forth. Then, right at the end, there's a POST to this -tantalising URL: - -.. code-block:: none - - https://service.gc.apple.com/WebObjects/GKGameStatsService.woa/wa/submitScore - -The contents of the submission are particularly interesting: - -.. code-block:: xml - - - - - scores - - - category - SMW_Adv_USA1 - context - 0 - score-value - 0 - timestamp - 1363515361321 - - - - - - -This is a `property list`_, containing an identifier for the game, -a score (55, in this case), and a timestamp. Looks pretty simple to mess with. - -Modifying and replaying the score submission --------------------------------------------- - -Lets edit the score submission. First, select it in mitmproxy, then press -:kbd:`enter` to view it. Make sure you're viewing the request, not the response - -you can use :kbd:`tab` to flick between the two. Now press :kbd:`e` for edit. You'll -be prompted for the part of the request you want to change - press :kbd:`r` for -raw body. Your preferred editor (taken from the EDITOR environment variable) will -now fire up. Lets bump the score up to something a bit more ambitious: - -.. code-block:: xml - - - - - scores - - - category - SMW_Adv_USA1 - context - 0 - score-value - 2200272667 - timestamp - 1363515361321 - - - - - - -Save the file and exit your editor. - -The final step is to replay this modified request. Simply press :kbd:`r` for replay. - - -The glorious result and some intrigue -------------------------------------- - -.. image:: leaderboard.png - :align: center - -And that's it - according to the records, I am the greatest Super Mega Worm -player of all time. - -There's a curious addendum to this tale. When I first wrote this tutorial, all -the top competitors' scores were the same: 2,147,483,647 (this is no longer the -case, because there are now so many fellow cheaters using this tutorial). If -you think that number seems familiar, you're right: it's 2^31-1, the maximum -value you can fit into a signed 32-bit int. Now let me tell you another -peculiar thing about Super Mega Worm - at the end of every game, it submits -your highest previous score to the Game Center, not your current score. This -means that it stores your highscore somewhere, and I'm guessing that it reads -that stored score back into a signed integer. So, if you _were_ to cheat by the -relatively pedestrian means of modifying the saved score on your jailbroken -phone, then 2^31-1 might well be the maximum score you could get. Then again, -if the game itself stores its score in a signed 32-bit int, you could get the -same score through perfect play, effectively beating the game. So, which is it -in this case? I'll leave that for you to decide. - -.. _Super Mega Worm: https://itunes.apple.com/us/app/super-mega-worm/id388541990?mt=8 -.. _property list: https://en.wikipedia.org/wiki/Property_list diff --git a/mitmproxy/docs/tutorials/leaderboard.png b/mitmproxy/docs/tutorials/leaderboard.png deleted file mode 100644 index c1be8df5..00000000 Binary files a/mitmproxy/docs/tutorials/leaderboard.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/one.png b/mitmproxy/docs/tutorials/one.png deleted file mode 100644 index 78a636cf..00000000 Binary files a/mitmproxy/docs/tutorials/one.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/supermega.png b/mitmproxy/docs/tutorials/supermega.png deleted file mode 100644 index d416f71f..00000000 Binary files a/mitmproxy/docs/tutorials/supermega.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/transparent-dhcp.rst b/mitmproxy/docs/tutorials/transparent-dhcp.rst deleted file mode 100644 index ce285b63..00000000 --- a/mitmproxy/docs/tutorials/transparent-dhcp.rst +++ /dev/null @@ -1,89 +0,0 @@ -.. _transparent-dhcp: - -Transparently proxify virtual machines -====================================== - -This walkthrough illustrates how to set up transparent proxying with mitmproxy. -We use VirtualBox VMs with an Ubuntu proxy machine in this example, -but the general *Internet <--> Proxy VM <--> (Virtual) Internal Network* setup can be applied to -other setups. - -1. Configure Proxy VM ---------------------- - -On the proxy machine, **eth0** is connected to the internet. **eth1** is connected to the internal -network that will be proxified and configured to use a static ip (192.168.3.1). - -VirtualBox configuration -^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: transparent-dhcp/step1_vbox_eth0.png - -.. image:: transparent-dhcp/step1_vbox_eth1.png - -VM Network Configuration -^^^^^^^^^^^^^^^^^^^^^^^^ - -.. image:: transparent-dhcp/step1_proxy.png - :align: center - -2. Configure DHCP and DNS -------------------------- - -We use dnsmasq to provide DHCP and DNS in our internal network. -Dnsmasq is a lightweight server designed to provide DNS (and optionally -DHCP and TFTP) services to a small-scale network. - -- Before we get to that, we need to fix some Ubuntu quirks: - **Ubuntu >12.04** runs an internal dnsmasq instance (listening on loopback only) by default - `[1] `_. For our use case, this needs - to be disabled by changing ``dns=dnsmasq`` to ``#dns=dnsmasq`` in - **/etc/NetworkManager/NetworkManager.conf** and running - - >>> sudo restart network-manager - - afterwards. -- Now, dnsmasq can be be installed and configured: - - >>> sudo apt-get install dnsmasq - - Replace **/etc/dnsmasq.conf** with the following configuration: - - .. code-block:: none - - # Listen for DNS requests on the internal network - interface=eth1 - # Act as a DHCP server, assign IP addresses to clients - dhcp-range=192.168.3.10,192.168.3.100,96h - # Broadcast gateway and dns server information - dhcp-option=option:router,192.168.3.1 - dhcp-option=option:dns-server,192.168.3.1 - - Apply changes: - - >>> sudo service dnsmasq restart - - Your **proxied machine** in the internal virtual network should now receive an IP address via DHCP: - - .. image:: transparent-dhcp/step2_proxied_vm.png - -3. Redirect traffic to mitmproxy ------------------------------------------- - -To redirect traffic to mitmproxy, we need to add two iptables rules: - -.. code-block:: none - - iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080 - iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8080 - -4. Run mitmproxy ----------------- - -Finally, we can run mitmproxy in transparent mode with - ->>> mitmproxy -T - -The proxied machine cannot to leak any data outside of HTTP or DNS requests. -If required, you can now :ref:`install the mitmproxy certificates on the proxied machine -`. diff --git a/mitmproxy/docs/tutorials/transparent-dhcp/step1_proxy.png b/mitmproxy/docs/tutorials/transparent-dhcp/step1_proxy.png deleted file mode 100644 index a0c94484..00000000 Binary files a/mitmproxy/docs/tutorials/transparent-dhcp/step1_proxy.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png b/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png deleted file mode 100644 index 4b7b4e9b..00000000 Binary files a/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth0.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png b/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png deleted file mode 100644 index b994d4cb..00000000 Binary files a/mitmproxy/docs/tutorials/transparent-dhcp/step1_vbox_eth1.png and /dev/null differ diff --git a/mitmproxy/docs/tutorials/transparent-dhcp/step2_proxied_vm.png b/mitmproxy/docs/tutorials/transparent-dhcp/step2_proxied_vm.png deleted file mode 100644 index 2046cc57..00000000 Binary files a/mitmproxy/docs/tutorials/transparent-dhcp/step2_proxied_vm.png and /dev/null differ diff --git a/mitmproxy/examples/README b/mitmproxy/examples/README deleted file mode 100644 index cf5c4d7d..00000000 --- a/mitmproxy/examples/README +++ /dev/null @@ -1,30 +0,0 @@ -Some inline scripts may require additional dependencies, which can be installed using -`pip install mitmproxy[examples]`. - - -# inline script examples -add_header.py Simple script that just adds a header to every request. -change_upstream_proxy.py Dynamically change the upstream proxy -dns_spoofing.py Use mitmproxy in a DNS spoofing scenario. -dup_and_replay.py Duplicates each request, changes it, and then replays the modified request. -filt.py Use mitmproxy's filter expressions in your script. -flowwriter.py Only write selected flows into a mitmproxy dumpfile. -iframe_injector.py Inject configurable iframe into pages. -modify_form.py Modify all form submissions to add a parameter. -modify_querystring.py Modify all query strings to add a parameters. -modify_response_body.py Replace arbitrary strings in all responses -nonblocking.py Demonstrate parallel processing with a blocking script. -proxapp.py How to embed a WSGI app in a mitmproxy server -redirect_requests.py Redirect requests or directly reply to them. -stub.py Script stub with a method definition for every event. -upsidedownternet.py Rewrites traffic to turn images upside down. - - -# mitmproxy examples -flowbasic Basic use of mitmproxy as a library. -stickycookies An example of writing a custom proxy with mitmproxy. - - -# misc -read_dumpfile Read a dumpfile generated by mitmproxy. -mitmproxywrapper.py Bracket mitmproxy run with proxy enable/disable on OS X diff --git a/mitmproxy/examples/add_header.py b/mitmproxy/examples/add_header.py deleted file mode 100644 index cf1b53cc..00000000 --- a/mitmproxy/examples/add_header.py +++ /dev/null @@ -1,2 +0,0 @@ -def response(context, flow): - flow.response.headers["newheader"] = "foo" diff --git a/mitmproxy/examples/change_upstream_proxy.py b/mitmproxy/examples/change_upstream_proxy.py deleted file mode 100644 index 9c454897..00000000 --- a/mitmproxy/examples/change_upstream_proxy.py +++ /dev/null @@ -1,24 +0,0 @@ -# This scripts demonstrates how mitmproxy can switch to a second/different upstream proxy -# in upstream proxy mode. -# -# Usage: mitmdump -U http://default-upstream-proxy.local:8080/ -s change_upstream_proxy.py -# -# If you want to change the target server, you should modify flow.request.host and flow.request.port - - -def proxy_address(flow): - # Poor man's loadbalancing: route every second domain through the alternative proxy. - if hash(flow.request.host) % 2 == 1: - return ("localhost", 8082) - else: - return ("localhost", 8081) - - -def request(context, flow): - if flow.request.method == "CONNECT": - # If the decision is done by domain, one could also modify the server address here. - # We do it after CONNECT here to have the request data available as well. - return - address = proxy_address(flow) - if flow.live: - flow.live.change_upstream_proxy_server(address) \ No newline at end of file diff --git a/mitmproxy/examples/custom_contentviews.py b/mitmproxy/examples/custom_contentviews.py deleted file mode 100644 index 776ba99d..00000000 --- a/mitmproxy/examples/custom_contentviews.py +++ /dev/null @@ -1,68 +0,0 @@ -import string -import lxml.html -import lxml.etree -from mitmproxy import utils, contentviews - - -class ViewPigLatin(contentviews.View): - name = "pig_latin_HTML" - prompt = ("pig latin HTML", "l") - content_types = ["text/html"] - - def __call__(self, data, **metadata): - if utils.isXML(data): - parser = lxml.etree.HTMLParser( - strip_cdata=True, - remove_blank_text=True - ) - d = lxml.html.fromstring(data, parser=parser) - docinfo = d.getroottree().docinfo - - def piglify(src): - words = string.split(src) - ret = '' - for word in words: - idx = -1 - while word[idx] in string.punctuation and (idx * -1) != len(word): idx -= 1 - if word[0].lower() in 'aeiou': - if idx == -1: - ret += word[0:] + "hay" - else: - ret += word[0:len(word) + idx + 1] + "hay" + word[idx + 1:] - else: - if idx == -1: - ret += word[1:] + word[0] + "ay" - else: - ret += word[1:len(word) + idx + 1] + word[0] + "ay" + word[idx + 1:] - ret += ' ' - return ret.strip() - - def recurse(root): - if hasattr(root, 'text') and root.text: - root.text = piglify(root.text) - if hasattr(root, 'tail') and root.tail: - root.tail = piglify(root.tail) - - if len(root): - for child in root: - recurse(child) - - recurse(d) - - s = lxml.etree.tostring( - d, - pretty_print=True, - doctype=docinfo.doctype - ) - return "HTML", contentviews.format_text(s) - - -pig_view = ViewPigLatin() - - -def start(context, argv): - context.add_contentview(pig_view) - - -def stop(context): - context.remove_contentview(pig_view) diff --git a/mitmproxy/examples/dns_spoofing.py b/mitmproxy/examples/dns_spoofing.py deleted file mode 100644 index 7eb79695..00000000 --- a/mitmproxy/examples/dns_spoofing.py +++ /dev/null @@ -1,50 +0,0 @@ -""" -This inline scripts makes it possible to use mitmproxy in scenarios where IP spoofing has been used to redirect -connections to mitmproxy. The way this works is that we rely on either the TLS Server Name Indication (SNI) or the -Host header of the HTTP request. -Of course, this is not foolproof - if an HTTPS connection comes without SNI, we don't -know the actual target and cannot construct a certificate that looks valid. -Similarly, if there's no Host header or a spoofed Host header, we're out of luck as well. -Using transparent mode is the better option most of the time. - -Usage: - mitmproxy - -p 443 - -s dns_spoofing.py - # Used as the target location if neither SNI nor host header are present. - -R http://example.com/ - mitmdump - -p 80 - -R http://localhost:443/ - - (Setting up a single proxy instance and using iptables to redirect to it - works as well) -""" -import re - - -# This regex extracts splits the host header into host and port. -# Handles the edge case of IPv6 addresses containing colons. -# https://bugzilla.mozilla.org/show_bug.cgi?id=45891 -parse_host_header = re.compile(r"^(?P[^:]+|\[.+\])(?::(?P\d+))?$") - - -def request(context, flow): - if flow.client_conn.ssl_established: - flow.request.scheme = "https" - sni = flow.client_conn.connection.get_servername() - port = 443 - else: - flow.request.scheme = "http" - sni = None - port = 80 - - host_header = flow.request.pretty_host - m = parse_host_header.match(host_header) - if m: - host_header = m.group("host").strip("[]") - if m.group("port"): - port = int(m.group("port")) - - flow.request.host = sni or host_header - flow.request.port = port \ No newline at end of file diff --git a/mitmproxy/examples/dup_and_replay.py b/mitmproxy/examples/dup_and_replay.py deleted file mode 100644 index 9ba91d3b..00000000 --- a/mitmproxy/examples/dup_and_replay.py +++ /dev/null @@ -1,4 +0,0 @@ -def request(context, flow): - f = context.duplicate_flow(flow) - f.request.path = "/changed" - context.replay_request(f) diff --git a/mitmproxy/examples/filt.py b/mitmproxy/examples/filt.py deleted file mode 100644 index f99b675c..00000000 --- a/mitmproxy/examples/filt.py +++ /dev/null @@ -1,16 +0,0 @@ -# This scripts demonstrates how to use mitmproxy's filter pattern in inline scripts. -# Usage: mitmdump -s "filt.py FILTER" - -from mitmproxy import filt - - -def start(context, argv): - if len(argv) != 2: - raise ValueError("Usage: -s 'filt.py FILTER'") - context.filter = filt.parse(argv[1]) - - -def response(context, flow): - if flow.match(context.filter): - print("Flow matches filter:") - print(flow) diff --git a/mitmproxy/examples/flowbasic b/mitmproxy/examples/flowbasic deleted file mode 100644 index 4a87b86a..00000000 --- a/mitmproxy/examples/flowbasic +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env python -""" - This example shows how to build a proxy based on mitmproxy's Flow - primitives. - - Heads Up: In the majority of cases, you want to use inline scripts. - - Note that request and response messages are not automatically replied to, - so we need to implement handlers to do this. -""" -from mitmproxy import flow -from mitmproxy.proxy import ProxyServer, ProxyConfig - - -class MyMaster(flow.FlowMaster): - def run(self): - try: - flow.FlowMaster.run(self) - except KeyboardInterrupt: - self.shutdown() - - def handle_request(self, f): - f = flow.FlowMaster.handle_request(self, f) - if f: - f.reply() - return f - - def handle_response(self, f): - f = flow.FlowMaster.handle_response(self, f) - if f: - f.reply() - print(f) - return f - - -config = ProxyConfig( - port=8080, - # use ~/.mitmproxy/mitmproxy-ca.pem as default CA file. - cadir="~/.mitmproxy/" -) -state = flow.State() -server = ProxyServer(config) -m = MyMaster(server, state) -m.run() diff --git a/mitmproxy/examples/flowwriter.py b/mitmproxy/examples/flowwriter.py deleted file mode 100644 index 8fb8cc60..00000000 --- a/mitmproxy/examples/flowwriter.py +++ /dev/null @@ -1,20 +0,0 @@ -import random -import sys - -from mitmproxy.flow import FlowWriter - - -def start(context, argv): - if len(argv) != 2: - raise ValueError('Usage: -s "flowriter.py filename"') - - if argv[1] == "-": - f = sys.stdout - else: - f = open(argv[1], "wb") - context.flow_writer = FlowWriter(f) - - -def response(context, flow): - if random.choice([True, False]): - context.flow_writer.add(flow) diff --git a/mitmproxy/examples/har_extractor.py b/mitmproxy/examples/har_extractor.py deleted file mode 100644 index 4e905438..00000000 --- a/mitmproxy/examples/har_extractor.py +++ /dev/null @@ -1,253 +0,0 @@ -""" - - This inline script utilizes harparser.HAR from - https://github.com/JustusW/harparser to generate a HAR log object. -""" -from harparser import HAR - -from datetime import datetime - - -class _HARLog(HAR.log): - # The attributes need to be registered here for them to actually be - # available later via self. This is due to HAREncodable linking __getattr__ - # to __getitem__. Anything that is set only in __init__ will just be added - # as key/value pair to self.__classes__. - __page_list__ = [] - __page_count__ = 0 - __page_ref__ = {} - - def __init__(self, page_list): - self.__page_list__ = page_list - self.__page_count__ = 0 - self.__page_ref__ = {} - - HAR.log.__init__(self, {"version": "1.2", - "creator": {"name": "MITMPROXY HARExtractor", - "version": "0.1", - "comment": ""}, - "pages": [], - "entries": []}) - - def reset(self): - self.__init__(self.__page_list__) - - def add(self, obj): - if isinstance(obj, HAR.pages): - self['pages'].append(obj) - if isinstance(obj, HAR.entries): - self['entries'].append(obj) - - def create_page_id(self): - self.__page_count__ += 1 - return "autopage_%s" % str(self.__page_count__) - - def set_page_ref(self, page, ref): - self.__page_ref__[page] = ref - - def get_page_ref(self, page): - return self.__page_ref__.get(page, None) - - def get_page_list(self): - return self.__page_list__ - - -def start(context, argv): - """ - On start we create a HARLog instance. You will have to adapt this to - suit your actual needs of HAR generation. As it will probably be - necessary to cluster logs by IPs or reset them from time to time. - """ - context.dump_file = None - if len(argv) > 1: - context.dump_file = argv[1] - else: - raise ValueError( - 'Usage: -s "har_extractor.py filename" ' - '(- will output to stdout, filenames ending with .zhar ' - 'will result in compressed har)' - ) - context.HARLog = _HARLog(['https://github.com']) - context.seen_server = set() - - -def response(context, flow): - """ - Called when a server response has been received. At the time of this - message both a request and a response are present and completely done. - """ - # Values are converted from float seconds to int milliseconds later. - ssl_time = -.001 - connect_time = -.001 - if flow.server_conn not in context.seen_server: - # Calculate the connect_time for this server_conn. Afterwards add it to - # seen list, in order to avoid the connect_time being present in entries - # that use an existing connection. - connect_time = flow.server_conn.timestamp_tcp_setup - \ - flow.server_conn.timestamp_start - context.seen_server.add(flow.server_conn) - - if flow.server_conn.timestamp_ssl_setup is not None: - # Get the ssl_time for this server_conn as the difference between - # the start of the successful tcp setup and the successful ssl - # setup. If no ssl setup has been made it is left as -1 since it - # doesn't apply to this connection. - ssl_time = flow.server_conn.timestamp_ssl_setup - \ - flow.server_conn.timestamp_tcp_setup - - # Calculate the raw timings from the different timestamps present in the - # request and response object. For lack of a way to measure it dns timings - # can not be calculated. The same goes for HAR blocked: MITMProxy will open - # a server connection as soon as it receives the host and port from the - # client connection. So the time spent waiting is actually spent waiting - # between request.timestamp_end and response.timestamp_start thus it - # correlates to HAR wait instead. - timings_raw = { - 'send': flow.request.timestamp_end - flow.request.timestamp_start, - 'wait': flow.response.timestamp_start - flow.request.timestamp_end, - 'receive': flow.response.timestamp_end - flow.response.timestamp_start, - 'connect': connect_time, - 'ssl': ssl_time - } - - # HAR timings are integers in ms, so we have to re-encode the raw timings to - # that format. - timings = dict([(key, int(1000 * value)) - for key, value in timings_raw.iteritems()]) - - # The full_time is the sum of all timings. Timings set to -1 will be ignored - # as per spec. - full_time = 0 - for item in timings.values(): - if item > -1: - full_time += item - - started_date_time = datetime.fromtimestamp( - flow.request.timestamp_start, - tz=utc).isoformat() - - request_query_string = [{"name": k, "value": v} - for k, v in flow.request.get_query()] - request_http_version = flow.request.http_version - # Cookies are shaped as tuples by MITMProxy. - request_cookies = [{"name": k.strip(), "value": v[0]} - for k, v in (flow.request.get_cookies() or {}).iteritems()] - request_headers = [{"name": k, "value": v} for k, v in flow.request.headers] - request_headers_size = len(str(flow.request.headers)) - request_body_size = len(flow.request.content) - - response_http_version = flow.response.http_version - # Cookies are shaped as tuples by MITMProxy. - response_cookies = [{"name": k.strip(), "value": v[0]} - for k, v in (flow.response.get_cookies() or {}).iteritems()] - response_headers = [{"name": k, "value": v} - for k, v in flow.response.headers] - response_headers_size = len(str(flow.response.headers)) - response_body_size = len(flow.response.content) - response_body_decoded_size = len(flow.response.get_decoded_content()) - response_body_compression = response_body_decoded_size - response_body_size - response_mime_type = flow.response.headers.get('Content-Type', '') - response_redirect_url = flow.response.headers.get('Location', '') - - entry = HAR.entries( - { - "startedDateTime": started_date_time, - "time": full_time, - "request": { - "method": flow.request.method, - "url": flow.request.url, - "httpVersion": request_http_version, - "cookies": request_cookies, - "headers": request_headers, - "queryString": request_query_string, - "headersSize": request_headers_size, - "bodySize": request_body_size, - }, - "response": { - "status": flow.response.status_code, - "statusText": flow.response.msg, - "httpVersion": response_http_version, - "cookies": response_cookies, - "headers": response_headers, - "content": { - "size": response_body_size, - "compression": response_body_compression, - "mimeType": response_mime_type}, - "redirectURL": response_redirect_url, - "headersSize": response_headers_size, - "bodySize": response_body_size, - }, - "cache": {}, - "timings": timings, - }) - - # If the current url is in the page list of context.HARLog or does not have - # a referrer we add it as a new pages object. - if flow.request.url in context.HARLog.get_page_list() or flow.request.headers.get( - 'Referer', - None) is None: - page_id = context.HARLog.create_page_id() - context.HARLog.add( - HAR.pages({ - "startedDateTime": entry['startedDateTime'], - "id": page_id, - "title": flow.request.url, - }) - ) - context.HARLog.set_page_ref(flow.request.url, page_id) - entry['pageref'] = page_id - - # Lookup the referer in the page_ref of context.HARLog to point this entries - # pageref attribute to the right pages object, then set it as a new - # reference to build a reference tree. - elif context.HARLog.get_page_ref(flow.request.headers.get('Referer')) is not None: - entry['pageref'] = context.HARLog.get_page_ref( - flow.request.headers['Referer'] - ) - context.HARLog.set_page_ref( - flow.request.headers['Referer'], entry['pageref'] - ) - - context.HARLog.add(entry) - - -def done(context): - """ - Called once on script shutdown, after any other events. - """ - from pprint import pprint - import json - - json_dump = context.HARLog.json() - compressed_json_dump = context.HARLog.compress() - - if context.dump_file == '-': - context.log(pprint.pformat(json.loads(json_dump))) - elif context.dump_file.endswith('.zhar'): - file(context.dump_file, "w").write(compressed_json_dump) - else: - file(context.dump_file, "w").write(json_dump) - context.log( - "HAR log finished with %s bytes (%s bytes compressed)" % ( - len(json_dump), len(compressed_json_dump) - ) - ) - context.log( - "Compression rate is %s%%" % str( - 100. * len(compressed_json_dump) / len(json_dump) - ) - ) - - -def print_attributes(obj, filter_string=None, hide_privates=False): - """ - Useful helper method to quickly get all attributes of an object and its - values. - """ - for attr in dir(obj): - if hide_privates and "__" in attr: - continue - if filter_string is not None and filter_string not in attr: - continue - value = getattr(obj, attr) - print("%s.%s" % ('obj', attr), value, type(value)) diff --git a/mitmproxy/examples/iframe_injector.py b/mitmproxy/examples/iframe_injector.py deleted file mode 100644 index fc38b136..00000000 --- a/mitmproxy/examples/iframe_injector.py +++ /dev/null @@ -1,27 +0,0 @@ -# Usage: mitmdump -s "iframe_injector.py url" -# (this script works best with --anticache) -from bs4 import BeautifulSoup -from mitmproxy.models import decoded - - -def start(context, argv): - if len(argv) != 2: - raise ValueError('Usage: -s "iframe_injector.py url"') - context.iframe_url = argv[1] - - -def response(context, flow): - if flow.request.host in context.iframe_url: - return - with decoded(flow.response): # Remove content encoding (gzip, ...) - html = BeautifulSoup(flow.response.content) - if html.body: - iframe = html.new_tag( - "iframe", - src=context.iframe_url, - frameborder=0, - height=0, - width=0) - html.body.insert(0, iframe) - flow.response.content = str(html) - context.log("Iframe inserted.") diff --git a/mitmproxy/examples/mitmproxywrapper.py b/mitmproxy/examples/mitmproxywrapper.py deleted file mode 100644 index 7ea10715..00000000 --- a/mitmproxy/examples/mitmproxywrapper.py +++ /dev/null @@ -1,166 +0,0 @@ -#!/usr/bin/env python -# -# Helper tool to enable/disable OS X proxy and wrap mitmproxy -# -# Get usage information with: -# -# mitmproxywrapper.py -h -# - -import subprocess -import re -import argparse -import contextlib -import os -import sys - - -class Wrapper(object): - - def __init__(self, port, extra_arguments=None): - self.port = port - self.extra_arguments = extra_arguments - - def run_networksetup_command(self, *arguments): - return subprocess.check_output( - ['sudo', 'networksetup'] + list(arguments)) - - def proxy_state_for_service(self, service): - state = self.run_networksetup_command( - '-getwebproxy', - service).splitlines() - return dict([re.findall(r'([^:]+): (.*)', line)[0] for line in state]) - - def enable_proxy_for_service(self, service): - print('Enabling proxy on {}...'.format(service)) - for subcommand in ['-setwebproxy', '-setsecurewebproxy']: - self.run_networksetup_command( - subcommand, service, '127.0.0.1', str( - self.port)) - - def disable_proxy_for_service(self, service): - print('Disabling proxy on {}...'.format(service)) - for subcommand in ['-setwebproxystate', '-setsecurewebproxystate']: - self.run_networksetup_command(subcommand, service, 'Off') - - def interface_name_to_service_name_map(self): - order = self.run_networksetup_command('-listnetworkserviceorder') - mapping = re.findall( - r'\(\d+\)\s(.*)$\n\(.*Device: (.+)\)$', - order, - re.MULTILINE) - return dict([(b, a) for (a, b) in mapping]) - - def run_command_with_input(self, command, input): - popen = subprocess.Popen( - command, - stdin=subprocess.PIPE, - stdout=subprocess.PIPE) - (stdout, stderr) = popen.communicate(input) - return stdout - - def primary_interace_name(self): - scutil_script = 'get State:/Network/Global/IPv4\nd.show\n' - stdout = self.run_command_with_input('/usr/sbin/scutil', scutil_script) - interface, = re.findall(r'PrimaryInterface\s*:\s*(.+)', stdout) - return interface - - def primary_service_name(self): - return self.interface_name_to_service_name_map()[ - self.primary_interace_name()] - - def proxy_enabled_for_service(self, service): - return self.proxy_state_for_service(service)['Enabled'] == 'Yes' - - def toggle_proxy(self): - new_state = not self.proxy_enabled_for_service( - self.primary_service_name()) - for service_name in self.connected_service_names(): - if self.proxy_enabled_for_service(service_name) and not new_state: - self.disable_proxy_for_service(service_name) - elif not self.proxy_enabled_for_service(service_name) and new_state: - self.enable_proxy_for_service(service_name) - - def connected_service_names(self): - scutil_script = 'list\n' - stdout = self.run_command_with_input('/usr/sbin/scutil', scutil_script) - service_ids = re.findall(r'State:/Network/Service/(.+)/IPv4', stdout) - - service_names = [] - for service_id in service_ids: - scutil_script = 'show Setup:/Network/Service/{}\n'.format( - service_id) - stdout = self.run_command_with_input( - '/usr/sbin/scutil', - scutil_script) - service_name, = re.findall(r'UserDefinedName\s*:\s*(.+)', stdout) - service_names.append(service_name) - - return service_names - - def wrap_mitmproxy(self): - with self.wrap_proxy(): - cmd = ['mitmproxy', '-p', str(self.port)] - if self.extra_arguments: - cmd.extend(self.extra_arguments) - subprocess.check_call(cmd) - - def wrap_honeyproxy(self): - with self.wrap_proxy(): - popen = subprocess.Popen('honeyproxy.sh') - try: - popen.wait() - except KeyboardInterrupt: - popen.terminate() - - @contextlib.contextmanager - def wrap_proxy(self): - connected_service_names = self.connected_service_names() - for service_name in connected_service_names: - if not self.proxy_enabled_for_service(service_name): - self.enable_proxy_for_service(service_name) - - yield - - for service_name in connected_service_names: - if self.proxy_enabled_for_service(service_name): - self.disable_proxy_for_service(service_name) - - @classmethod - def ensure_superuser(cls): - if os.getuid() != 0: - print('Relaunching with sudo...') - os.execv('/usr/bin/sudo', ['/usr/bin/sudo'] + sys.argv) - - @classmethod - def main(cls): - parser = argparse.ArgumentParser( - description='Helper tool for OS X proxy configuration and mitmproxy.', - epilog='Any additional arguments will be passed on unchanged to mitmproxy.') - parser.add_argument( - '-t', - '--toggle', - action='store_true', - help='just toggle the proxy configuration') -# parser.add_argument('--honeyproxy', action='store_true', help='run honeyproxy instead of mitmproxy') - parser.add_argument( - '-p', - '--port', - type=int, - help='override the default port of 8080', - default=8080) - args, extra_arguments = parser.parse_known_args() - - wrapper = cls(port=args.port, extra_arguments=extra_arguments) - - if args.toggle: - wrapper.toggle_proxy() -# elif args.honeyproxy: -# wrapper.wrap_honeyproxy() - else: - wrapper.wrap_mitmproxy() - - -if __name__ == '__main__': - Wrapper.ensure_superuser() - Wrapper.main() diff --git a/mitmproxy/examples/modify_form.py b/mitmproxy/examples/modify_form.py deleted file mode 100644 index 3e9d15c0..00000000 --- a/mitmproxy/examples/modify_form.py +++ /dev/null @@ -1,5 +0,0 @@ -def request(context, flow): - if "application/x-www-form-urlencoded" in flow.request.headers.get("content-type", ""): - form = flow.request.get_form_urlencoded() - form["mitmproxy"] = ["rocks"] - flow.request.set_form_urlencoded(form) diff --git a/mitmproxy/examples/modify_querystring.py b/mitmproxy/examples/modify_querystring.py deleted file mode 100644 index 7f31a48f..00000000 --- a/mitmproxy/examples/modify_querystring.py +++ /dev/null @@ -1,6 +0,0 @@ - -def request(context, flow): - q = flow.request.get_query() - if q: - q["mitmproxy"] = ["rocks"] - flow.request.set_query(q) diff --git a/mitmproxy/examples/modify_response_body.py b/mitmproxy/examples/modify_response_body.py deleted file mode 100644 index 88f69e15..00000000 --- a/mitmproxy/examples/modify_response_body.py +++ /dev/null @@ -1,18 +0,0 @@ -# Usage: mitmdump -s "modify_response_body.py mitmproxy bananas" -# (this script works best with --anticache) -from mitmproxy.models import decoded - - -def start(context, argv): - if len(argv) != 3: - raise ValueError('Usage: -s "modify-response-body.py old new"') - # You may want to use Python's argparse for more sophisticated argument - # parsing. - context.old, context.new = argv[1], argv[2] - - -def response(context, flow): - with decoded(flow.response): # automatically decode gzipped responses. - flow.response.content = flow.response.content.replace( - context.old, - context.new) diff --git a/mitmproxy/examples/nonblocking.py b/mitmproxy/examples/nonblocking.py deleted file mode 100644 index 41674b2a..00000000 --- a/mitmproxy/examples/nonblocking.py +++ /dev/null @@ -1,9 +0,0 @@ -import time -from mitmproxy.script import concurrent - - -@concurrent # Remove this and see what happens -def request(context, flow): - print("handle request: %s%s" % (flow.request.host, flow.request.path)) - time.sleep(5) - print("start request: %s%s" % (flow.request.host, flow.request.path)) diff --git a/mitmproxy/examples/proxapp.py b/mitmproxy/examples/proxapp.py deleted file mode 100644 index 4d8e7b58..00000000 --- a/mitmproxy/examples/proxapp.py +++ /dev/null @@ -1,24 +0,0 @@ -""" -This example shows how to graft a WSGI app onto mitmproxy. In this -instance, we're using the Flask framework (http://flask.pocoo.org/) to expose -a single simplest-possible page. -""" -from flask import Flask - -app = Flask("proxapp") - - -@app.route('/') -def hello_world(): - return 'Hello World!' - - -# Register the app using the magic domain "proxapp" on port 80. Requests to -# this domain and port combination will now be routed to the WSGI app instance. -def start(context, argv): - context.app_registry.add(app, "proxapp", 80) - - # SSL works too, but the magic domain needs to be resolvable from the mitmproxy machine due to mitmproxy's design. - # mitmproxy will connect to said domain and use serve its certificate (unless --no-upstream-cert is set) - # but won't send any data. - context.app_registry.add(app, "example.com", 443) diff --git a/mitmproxy/examples/read_dumpfile b/mitmproxy/examples/read_dumpfile deleted file mode 100644 index 56746bb8..00000000 --- a/mitmproxy/examples/read_dumpfile +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/env python -# -# Simple script showing how to read a mitmproxy dump file -# - -from mitmproxy import flow -import pprint -import sys - -with open(sys.argv[1], "rb") as logfile: - freader = flow.FlowReader(logfile) - pp = pprint.PrettyPrinter(indent=4) - try: - for f in freader.stream(): - print(f) - print(f.request.host) - pp.pprint(f.get_state()) - print("") - except flow.FlowReadError as v: - print "Flow file corrupted. Stopped loading." diff --git a/mitmproxy/examples/redirect_requests.py b/mitmproxy/examples/redirect_requests.py deleted file mode 100644 index c0a0ccba..00000000 --- a/mitmproxy/examples/redirect_requests.py +++ /dev/null @@ -1,22 +0,0 @@ -""" -This example shows two ways to redirect flows to other destinations. -""" -from mitmproxy.models import HTTPResponse -from netlib.http import Headers - -def request(context, flow): - # pretty_host takes the "Host" header of the request into account, - # which is useful in transparent mode where we usually only have the IP - # otherwise. - - # Method 1: Answer with a locally generated response - if flow.request.pretty_host.endswith("example.com"): - resp = HTTPResponse( - "HTTP/1.1", 200, "OK", - Headers(Content_Type="text/html"), - "helloworld") - flow.reply(resp) - - # Method 2: Redirect the request to a different server - if flow.request.pretty_host.endswith("example.org"): - flow.request.host = "mitmproxy.org" diff --git a/mitmproxy/examples/sslstrip.py b/mitmproxy/examples/sslstrip.py deleted file mode 100644 index 369427a2..00000000 --- a/mitmproxy/examples/sslstrip.py +++ /dev/null @@ -1,40 +0,0 @@ -from netlib.http import decoded -import re -from six.moves import urllib - -def start(context, argv) : - - #set of SSL/TLS capable hosts - context.secure_hosts = set() - -def request(context, flow) : - - flow.request.headers.pop('If-Modified-Since', None) - flow.request.headers.pop('Cache-Control', None) - - #proxy connections to SSL-enabled hosts - if flow.request.pretty_host in context.secure_hosts : - flow.request.scheme = 'https' - flow.request.port = 443 - -def response(context, flow) : - - with decoded(flow.response) : - flow.request.headers.pop('Strict-Transport-Security', None) - flow.request.headers.pop('Public-Key-Pins', None) - - #strip links in response body - flow.response.content = flow.response.content.replace('https://', 'http://') - - #strip links in 'Location' header - if flow.response.headers.get('Location','').startswith('https://'): - location = flow.response.headers['Location'] - hostname = urllib.parse.urlparse(location).hostname - if hostname: - context.secure_hosts.add(hostname) - flow.response.headers['Location'] = location.replace('https://', 'http://', 1) - - #strip secure flag from 'Set-Cookie' headers - cookies = flow.response.headers.get_all('Set-Cookie') - cookies = [re.sub(r';\s*secure\s*', '', s) for s in cookies] - flow.response.headers.set_all('Set-Cookie', cookies) diff --git a/mitmproxy/examples/stickycookies b/mitmproxy/examples/stickycookies deleted file mode 100644 index 8f11de8d..00000000 --- a/mitmproxy/examples/stickycookies +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/env python -""" -This example builds on mitmproxy's base proxying infrastructure to -implement functionality similar to the "sticky cookies" option. - -Heads Up: In the majority of cases, you want to use inline scripts. -""" -import os -from mitmproxy import controller, proxy -from mitmproxy.proxy.server import ProxyServer - - -class StickyMaster(controller.Master): - def __init__(self, server): - controller.Master.__init__(self, server) - self.stickyhosts = {} - - def run(self): - try: - return controller.Master.run(self) - except KeyboardInterrupt: - self.shutdown() - - def handle_request(self, flow): - hid = (flow.request.host, flow.request.port) - if "cookie" in flow.request.headers: - self.stickyhosts[hid] = flow.request.headers.get_all("cookie") - elif hid in self.stickyhosts: - flow.request.headers.set_all("cookie", self.stickyhosts[hid]) - flow.reply() - - def handle_response(self, flow): - hid = (flow.request.host, flow.request.port) - if "set-cookie" in flow.response.headers: - self.stickyhosts[hid] = flow.response.headers.get_all("set-cookie") - flow.reply() - - -config = proxy.ProxyConfig(port=8080) -server = ProxyServer(config) -m = StickyMaster(server) -m.run() diff --git a/mitmproxy/examples/stream.py b/mitmproxy/examples/stream.py deleted file mode 100644 index 3adbe437..00000000 --- a/mitmproxy/examples/stream.py +++ /dev/null @@ -1,5 +0,0 @@ -def responseheaders(context, flow): - """ - Enables streaming for all responses. - """ - flow.response.stream = True diff --git a/mitmproxy/examples/stream_modify.py b/mitmproxy/examples/stream_modify.py deleted file mode 100644 index aa395c03..00000000 --- a/mitmproxy/examples/stream_modify.py +++ /dev/null @@ -1,20 +0,0 @@ -""" -This inline script modifies a streamed response. -If you do not need streaming, see the modify_response_body example. -Be aware that content replacement isn't trivial: - - If the transfer encoding isn't chunked, you cannot simply change the content length. - - If you want to replace all occurences of "foobar", make sure to catch the cases - where one chunk ends with [...]foo" and the next starts with "bar[...]. -""" - - -def modify(chunks): - """ - chunks is a generator that can be used to iterate over all chunks. - """ - for chunk in chunks: - yield chunk.replace("foo", "bar") - - -def responseheaders(context, flow): - flow.response.stream = modify diff --git a/mitmproxy/examples/stub.py b/mitmproxy/examples/stub.py deleted file mode 100644 index 516b71a5..00000000 --- a/mitmproxy/examples/stub.py +++ /dev/null @@ -1,79 +0,0 @@ -""" - This is a script stub, with definitions for all events. -""" - - -def start(context, argv): - """ - Called once on script startup, before any other events. - """ - context.log("start") - - -def clientconnect(context, root_layer): - """ - Called when a client initiates a connection to the proxy. Note that a - connection can correspond to multiple HTTP requests - """ - context.log("clientconnect") - - -def request(context, flow): - """ - Called when a client request has been received. - """ - context.log("request") - - -def serverconnect(context, server_conn): - """ - Called when the proxy initiates a connection to the target server. Note that a - connection can correspond to multiple HTTP requests - """ - context.log("serverconnect") - - -def responseheaders(context, flow): - """ - Called when the response headers for a server response have been received, - but the response body has not been processed yet. Can be used to tell mitmproxy - to stream the response. - """ - context.log("responseheaders") - - -def response(context, flow): - """ - Called when a server response has been received. - """ - context.log("response") - - -def error(context, flow): - """ - Called when a flow error has occured, e.g. invalid server responses, or - interrupted connections. This is distinct from a valid server HTTP error - response, which is simply a response with an HTTP error code. - """ - context.log("error") - - -def serverdisconnect(context, server_conn): - """ - Called when the proxy closes the connection to the target server. - """ - context.log("serverdisconnect") - - -def clientdisconnect(context, root_layer): - """ - Called when a client disconnects from the proxy. - """ - context.log("clientdisconnect") - - -def done(context): - """ - Called once on script shutdown, after any other events. - """ - context.log("done") diff --git a/mitmproxy/examples/tcp_message.py b/mitmproxy/examples/tcp_message.py deleted file mode 100644 index c63368e4..00000000 --- a/mitmproxy/examples/tcp_message.py +++ /dev/null @@ -1,24 +0,0 @@ -''' -tcp_message Inline Script Hook API Demonstration ------------------------------------------------- - -* modifies packets containing "foo" to "bar" -* prints various details for each packet. - -example cmdline invocation: -mitmdump -T --host --tcp ".*" -q -s examples/tcp_message.py -''' -from netlib.utils import clean_bin - -def tcp_message(ctx, tcp_msg): - modified_msg = tcp_msg.message.replace("foo", "bar") - - is_modified = False if modified_msg == tcp_msg.message else True - tcp_msg.message = modified_msg - - print("[tcp_message{}] from {} {} to {} {}:\r\n{}".format( - " (modified)" if is_modified else "", - "client" if tcp_msg.sender == tcp_msg.client_conn else "server", - tcp_msg.sender.address, - "server" if tcp_msg.receiver == tcp_msg.server_conn else "client", - tcp_msg.receiver.address, clean_bin(tcp_msg.message))) diff --git a/mitmproxy/examples/tls_passthrough.py b/mitmproxy/examples/tls_passthrough.py deleted file mode 100644 index 8c8fa4eb..00000000 --- a/mitmproxy/examples/tls_passthrough.py +++ /dev/null @@ -1,136 +0,0 @@ -""" -This inline script allows conditional TLS Interception based -on a user-defined strategy. - -Example: - - > mitmdump -s tls_passthrough.py - - 1. curl --proxy http://localhost:8080 https://example.com --insecure - // works - we'll also see the contents in mitmproxy - - 2. curl --proxy http://localhost:8080 https://example.com --insecure - // still works - we'll also see the contents in mitmproxy - - 3. curl --proxy http://localhost:8080 https://example.com - // fails with a certificate error, which we will also see in mitmproxy - - 4. curl --proxy http://localhost:8080 https://example.com - // works again, but mitmproxy does not intercept and we do *not* see the contents - -Authors: Maximilian Hils, Matthew Tuusberg -""" -from __future__ import (absolute_import, print_function, division) -import collections -import random - -from enum import Enum - -from mitmproxy.exceptions import TlsProtocolException -from mitmproxy.protocol import TlsLayer, RawTCPLayer - - -class InterceptionResult(Enum): - success = True - failure = False - skipped = None - - -class _TlsStrategy(object): - """ - Abstract base class for interception strategies. - """ - def __init__(self): - # A server_address -> interception results mapping - self.history = collections.defaultdict(lambda: collections.deque(maxlen=200)) - - def should_intercept(self, server_address): - """ - Returns: - True, if we should attempt to intercept the connection. - False, if we want to employ pass-through instead. - """ - raise NotImplementedError() - - def record_success(self, server_address): - self.history[server_address].append(InterceptionResult.success) - - def record_failure(self, server_address): - self.history[server_address].append(InterceptionResult.failure) - - def record_skipped(self, server_address): - self.history[server_address].append(InterceptionResult.skipped) - - -class ConservativeStrategy(_TlsStrategy): - """ - Conservative Interception Strategy - only intercept if there haven't been any failed attempts - in the history. - """ - - def should_intercept(self, server_address): - if InterceptionResult.failure in self.history[server_address]: - return False - return True - - -class ProbabilisticStrategy(_TlsStrategy): - """ - Fixed probability that we intercept a given connection. - """ - def __init__(self, p): - self.p = p - super(ProbabilisticStrategy, self).__init__() - - def should_intercept(self, server_address): - return random.uniform(0, 1) < self.p - - -class TlsFeedback(TlsLayer): - """ - Monkey-patch _establish_tls_with_client to get feedback if TLS could be established - successfully on the client connection (which may fail due to cert pinning). - """ - - def _establish_tls_with_client(self): - server_address = self.server_conn.address - tls_strategy = self.script_context.tls_strategy - - try: - super(TlsFeedback, self)._establish_tls_with_client() - except TlsProtocolException as e: - tls_strategy.record_failure(server_address) - raise e - else: - tls_strategy.record_success(server_address) - - -# inline script hooks below. - - -def start(context, argv): - if len(argv) == 2: - context.tls_strategy = ProbabilisticStrategy(float(argv[1])) - else: - context.tls_strategy = ConservativeStrategy() - - -def next_layer(context, next_layer): - """ - This hook does the actual magic - if the next layer is planned to be a TLS layer, - we check if we want to enter pass-through mode instead. - """ - if isinstance(next_layer, TlsLayer) and next_layer._client_tls: - server_address = next_layer.server_conn.address - - if context.tls_strategy.should_intercept(server_address): - # We try to intercept. - # Monkey-Patch the layer to get feedback from the TLSLayer if interception worked. - next_layer.__class__ = TlsFeedback - next_layer.script_context = context - else: - # We don't intercept - reply with a pass-through layer and add a "skipped" entry. - context.log("TLS passthrough for %s" % repr(next_layer.server_conn.address), "info") - next_layer_replacement = RawTCPLayer(next_layer.ctx, logging=False) - next_layer.reply(next_layer_replacement) - context.tls_strategy.record_skipped(server_address) diff --git a/mitmproxy/examples/upsidedownternet.py b/mitmproxy/examples/upsidedownternet.py deleted file mode 100644 index b7489cb6..00000000 --- a/mitmproxy/examples/upsidedownternet.py +++ /dev/null @@ -1,17 +0,0 @@ -import cStringIO -from PIL import Image -from mitmproxy.models import decoded - - -def response(context, flow): - if flow.response.headers.get("content-type", "").startswith("image"): - with decoded(flow.response): # automatically decode gzipped responses. - try: - s = cStringIO.StringIO(flow.response.content) - img = Image.open(s).rotate(180) - s2 = cStringIO.StringIO() - img.save(s2, "png") - flow.response.content = s2.getvalue() - flow.response.headers["content-type"] = "image/png" - except: # Unknown image types etc. - pass diff --git a/test/mitmproxy/test_examples.py b/test/mitmproxy/test_examples.py index 6920c8e9..54e6e753 100644 --- a/test/mitmproxy/test_examples.py +++ b/test/mitmproxy/test_examples.py @@ -5,7 +5,7 @@ from . import tservers def test_load_scripts(): - example_dir = utils.Data("mitmproxy").path("../examples") + example_dir = utils.Data("mitmproxy").path("../../examples") scripts = glob.glob("%s/*.py" % example_dir) tmaster = tservers.TestMaster(config.ProxyConfig()) -- cgit v1.2.3 From 14f6bcd86e78365a72bd18dcf619d9eefcb914f0 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Thu, 18 Feb 2016 09:48:37 +1300 Subject: Adjust release for new repo structure --- release/.env | 6 ------ release/.gitignore | 7 ------- release/mitmdump.spec | 2 +- release/mitmproxy.spec | 2 +- release/mitmweb.spec | 2 +- release/pathoc.spec | 2 +- release/pathod.spec | 4 ++-- release/rtool.py | 2 +- 8 files changed, 7 insertions(+), 20 deletions(-) delete mode 100644 release/.env mode change 100644 => 100755 release/rtool.py diff --git a/release/.env b/release/.env deleted file mode 100644 index 69ac3f05..00000000 --- a/release/.env +++ /dev/null @@ -1,6 +0,0 @@ -DIR="$( dirname "${BASH_SOURCE[0]}" )" -ACTIVATE_DIR="$(if [ -f "$DIR/../venv.mitmproxy/bin/activate" ]; then echo 'bin'; else echo 'Scripts'; fi;)" -if [ -z "$VIRTUAL_ENV" ] && [ -f "$DIR/../venv.mitmproxy/$ACTIVATE_DIR/activate" ]; then - echo "Activating mitmproxy virtualenv..." - source "$DIR/../venv.mitmproxy/$ACTIVATE_DIR/activate" -fi diff --git a/release/.gitignore b/release/.gitignore index c062fb3b..2247d5f9 100644 --- a/release/.gitignore +++ b/release/.gitignore @@ -1,9 +1,2 @@ -.DS_Store -MANIFEST -*.py[cdo] -*.swp -*.swo - /build /dist -/mitmproxy_rtool.egg-info \ No newline at end of file diff --git a/release/mitmdump.spec b/release/mitmdump.spec index 967f5e58..2e164083 100644 --- a/release/mitmdump.spec +++ b/release/mitmdump.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/mitmdump'], +a = Analysis(['../mitmproxy/bin/mitmdump'], binaries=None, datas=collect_data_files("mitmproxy.onboarding"), hiddenimports=[], diff --git a/release/mitmproxy.spec b/release/mitmproxy.spec index 6356b0a6..ff42b1f3 100644 --- a/release/mitmproxy.spec +++ b/release/mitmproxy.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/mitmproxy'], +a = Analysis(['../mitmproxy/bin/mitmproxy'], binaries=None, datas=collect_data_files("mitmproxy.onboarding"), hiddenimports=[], diff --git a/release/mitmweb.spec b/release/mitmweb.spec index e3e634fa..e64940c4 100644 --- a/release/mitmweb.spec +++ b/release/mitmweb.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/mitmweb'], +a = Analysis(['../mitmproxy/bin/mitmweb'], binaries=None, datas=collect_data_files("mitmproxy"), hiddenimports=[], diff --git a/release/pathoc.spec b/release/pathoc.spec index 707d21de..e694794e 100644 --- a/release/pathoc.spec +++ b/release/pathoc.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../pathod/pathoc'], +a = Analysis(['../pathod/bin/pathoc'], binaries=None, datas=None, hiddenimports=['_cffi_backend'], diff --git a/release/pathod.spec b/release/pathod.spec index 4e515ac9..a0ccbaf0 100644 --- a/release/pathod.spec +++ b/release/pathod.spec @@ -2,9 +2,9 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../pathod/pathod'], +a = Analysis(['../pathod/bin/pathod'], binaries=None, - datas=collect_data_files("libpathod"), + datas=collect_data_files("pathod"), hiddenimports=['_cffi_backend'], hookspath=None, runtime_hooks=None, diff --git a/release/rtool.py b/release/rtool.py old mode 100644 new mode 100755 index 936e64c8..5d411b35 --- a/release/rtool.py +++ b/release/rtool.py @@ -250,7 +250,7 @@ def bdist(ctx, use_existing_wheels, pyinstaller_version): "--clean", "--workpath", PYINSTALLER_TEMP, "--distpath", PYINSTALLER_DIST, - # This is PyInstaller, so setting a + # This is PyInstaller, so setting a # different log level obviously breaks it :-) # "--log-level", "WARN", spec -- cgit v1.2.3 From 36e070ee25ab09ecb9b38dd7f2c5cd8de0073c10 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Thu, 18 Feb 2016 10:15:59 +1300 Subject: Pull bin to the top, move pathod examples to examples dir --- bin/mitmdump | 3 +++ bin/mitmproxy | 3 +++ bin/mitmweb | 4 ++++ bin/pathoc | 6 ++++++ bin/pathod | 6 ++++++ examples/pathod/libpathod_pathoc.py | 7 +++++++ examples/pathod/test_context.py | 23 ++++++++++++++++++++++ examples/pathod/test_setup.py | 31 +++++++++++++++++++++++++++++ examples/pathod/test_setupall.py | 39 +++++++++++++++++++++++++++++++++++++ mitmproxy/bin/mitmdump | 3 --- mitmproxy/bin/mitmproxy | 3 --- mitmproxy/bin/mitmweb | 4 ---- pathod/bin/pathoc | 6 ------ pathod/bin/pathod | 6 ------ pathod/examples/libpathod_pathoc.py | 7 ------- pathod/examples/test_context.py | 23 ---------------------- pathod/examples/test_setup.py | 31 ----------------------------- pathod/examples/test_setupall.py | 39 ------------------------------------- release/mitmdump.spec | 2 +- release/mitmproxy.spec | 2 +- release/mitmweb.spec | 2 +- release/pathoc.spec | 2 +- release/pathod.spec | 2 +- 23 files changed, 127 insertions(+), 127 deletions(-) create mode 100644 bin/mitmdump create mode 100755 bin/mitmproxy create mode 100755 bin/mitmweb create mode 100755 bin/pathoc create mode 100755 bin/pathod create mode 100644 examples/pathod/libpathod_pathoc.py create mode 100644 examples/pathod/test_context.py create mode 100644 examples/pathod/test_setup.py create mode 100644 examples/pathod/test_setupall.py delete mode 100644 mitmproxy/bin/mitmdump delete mode 100755 mitmproxy/bin/mitmproxy delete mode 100755 mitmproxy/bin/mitmweb delete mode 100755 pathod/bin/pathoc delete mode 100755 pathod/bin/pathod delete mode 100644 pathod/examples/libpathod_pathoc.py delete mode 100644 pathod/examples/test_context.py delete mode 100644 pathod/examples/test_setup.py delete mode 100644 pathod/examples/test_setupall.py diff --git a/bin/mitmdump b/bin/mitmdump new file mode 100644 index 00000000..2483be4f --- /dev/null +++ b/bin/mitmdump @@ -0,0 +1,3 @@ +#!/usr/bin/env python +from mitmproxy.main import mitmdump +mitmdump() diff --git a/bin/mitmproxy b/bin/mitmproxy new file mode 100755 index 00000000..a3d7615d --- /dev/null +++ b/bin/mitmproxy @@ -0,0 +1,3 @@ +#!/usr/bin/env python +from mitmproxy.main import mitmproxy +mitmproxy() diff --git a/bin/mitmweb b/bin/mitmweb new file mode 100755 index 00000000..14188a33 --- /dev/null +++ b/bin/mitmweb @@ -0,0 +1,4 @@ +#!/usr/bin/env python +from mitmproxy.main import mitmweb + +mitmweb() diff --git a/bin/pathoc b/bin/pathoc new file mode 100755 index 00000000..ab62d631 --- /dev/null +++ b/bin/pathoc @@ -0,0 +1,6 @@ +#!/usr/bin/env python + +from pathod import pathoc_cmdline as cmdline + +if __name__ == "__main__": + cmdline.go_pathoc() diff --git a/bin/pathod b/bin/pathod new file mode 100755 index 00000000..af0c118b --- /dev/null +++ b/bin/pathod @@ -0,0 +1,6 @@ +#!/usr/bin/env python + +from pathod import pathod_cmdline as cmdline + +if __name__ == "__main__": + cmdline.go_pathod() diff --git a/examples/pathod/libpathod_pathoc.py b/examples/pathod/libpathod_pathoc.py new file mode 100644 index 00000000..587c0e4c --- /dev/null +++ b/examples/pathod/libpathod_pathoc.py @@ -0,0 +1,7 @@ +#!/usr/bin/env python +from pathod import pathoc + +p = pathoc.Pathoc(("google.com", 80)) +p.connect() +print p.request("get:/") +print p.request("get:/foo") diff --git a/examples/pathod/test_context.py b/examples/pathod/test_context.py new file mode 100644 index 00000000..8db4331f --- /dev/null +++ b/examples/pathod/test_context.py @@ -0,0 +1,23 @@ +import requests +from pathod import test + + +def test_simple(): + """ + Testing the requests module with + a pathod context manager. + """ + # Start pathod in a separate thread + with test.Daemon() as d: + # Get a URL for a pathod spec + url = d.p("200:b@100") + # ... and request it + r = requests.put(url) + + # Check the returned data + assert r.status_code == 200 + assert len(r.content) == 100 + + # Check pathod's internal log + log = d.last_log()["request"] + assert log["method"] == "PUT" diff --git a/examples/pathod/test_setup.py b/examples/pathod/test_setup.py new file mode 100644 index 00000000..5dbc456d --- /dev/null +++ b/examples/pathod/test_setup.py @@ -0,0 +1,31 @@ +import requests +from pathod import test + + +class Test: + + """ + Testing the requests module with + a pathod instance started for + each test. + """ + + def setup(self): + self.d = test.Daemon() + + def teardown(self): + self.d.shutdown() + + def test_simple(self): + # Get a URL for a pathod spec + url = self.d.p("200:b@100") + # ... and request it + r = requests.put(url) + + # Check the returned data + assert r.status_code == 200 + assert len(r.content) == 100 + + # Check pathod's internal log + log = self.d.last_log()["request"] + assert log["method"] == "PUT" diff --git a/examples/pathod/test_setupall.py b/examples/pathod/test_setupall.py new file mode 100644 index 00000000..cb84b7b2 --- /dev/null +++ b/examples/pathod/test_setupall.py @@ -0,0 +1,39 @@ +import requests +from pathod import test + + +class Test: + + """ + Testing the requests module with + a single pathod instance started + for the test suite. + """ + @classmethod + def setup_class(cls): + cls.d = test.Daemon() + + @classmethod + def teardown_class(cls): + cls.d.shutdown() + + def setup(self): + # Clear the pathod logs between tests + self.d.clear_log() + + def test_simple(self): + # Get a URL for a pathod spec + url = self.d.p("200:b@100") + # ... and request it + r = requests.put(url) + + # Check the returned data + assert r.status_code == 200 + assert len(r.content) == 100 + + # Check pathod's internal log + log = self.d.last_log()["request"] + assert log["method"] == "PUT" + + def test_two(self): + assert not self.d.log() diff --git a/mitmproxy/bin/mitmdump b/mitmproxy/bin/mitmdump deleted file mode 100644 index 2483be4f..00000000 --- a/mitmproxy/bin/mitmdump +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env python -from mitmproxy.main import mitmdump -mitmdump() diff --git a/mitmproxy/bin/mitmproxy b/mitmproxy/bin/mitmproxy deleted file mode 100755 index a3d7615d..00000000 --- a/mitmproxy/bin/mitmproxy +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env python -from mitmproxy.main import mitmproxy -mitmproxy() diff --git a/mitmproxy/bin/mitmweb b/mitmproxy/bin/mitmweb deleted file mode 100755 index 14188a33..00000000 --- a/mitmproxy/bin/mitmweb +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env python -from mitmproxy.main import mitmweb - -mitmweb() diff --git a/pathod/bin/pathoc b/pathod/bin/pathoc deleted file mode 100755 index ab62d631..00000000 --- a/pathod/bin/pathoc +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env python - -from pathod import pathoc_cmdline as cmdline - -if __name__ == "__main__": - cmdline.go_pathoc() diff --git a/pathod/bin/pathod b/pathod/bin/pathod deleted file mode 100755 index af0c118b..00000000 --- a/pathod/bin/pathod +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env python - -from pathod import pathod_cmdline as cmdline - -if __name__ == "__main__": - cmdline.go_pathod() diff --git a/pathod/examples/libpathod_pathoc.py b/pathod/examples/libpathod_pathoc.py deleted file mode 100644 index 587c0e4c..00000000 --- a/pathod/examples/libpathod_pathoc.py +++ /dev/null @@ -1,7 +0,0 @@ -#!/usr/bin/env python -from pathod import pathoc - -p = pathoc.Pathoc(("google.com", 80)) -p.connect() -print p.request("get:/") -print p.request("get:/foo") diff --git a/pathod/examples/test_context.py b/pathod/examples/test_context.py deleted file mode 100644 index 8db4331f..00000000 --- a/pathod/examples/test_context.py +++ /dev/null @@ -1,23 +0,0 @@ -import requests -from pathod import test - - -def test_simple(): - """ - Testing the requests module with - a pathod context manager. - """ - # Start pathod in a separate thread - with test.Daemon() as d: - # Get a URL for a pathod spec - url = d.p("200:b@100") - # ... and request it - r = requests.put(url) - - # Check the returned data - assert r.status_code == 200 - assert len(r.content) == 100 - - # Check pathod's internal log - log = d.last_log()["request"] - assert log["method"] == "PUT" diff --git a/pathod/examples/test_setup.py b/pathod/examples/test_setup.py deleted file mode 100644 index 5dbc456d..00000000 --- a/pathod/examples/test_setup.py +++ /dev/null @@ -1,31 +0,0 @@ -import requests -from pathod import test - - -class Test: - - """ - Testing the requests module with - a pathod instance started for - each test. - """ - - def setup(self): - self.d = test.Daemon() - - def teardown(self): - self.d.shutdown() - - def test_simple(self): - # Get a URL for a pathod spec - url = self.d.p("200:b@100") - # ... and request it - r = requests.put(url) - - # Check the returned data - assert r.status_code == 200 - assert len(r.content) == 100 - - # Check pathod's internal log - log = self.d.last_log()["request"] - assert log["method"] == "PUT" diff --git a/pathod/examples/test_setupall.py b/pathod/examples/test_setupall.py deleted file mode 100644 index cb84b7b2..00000000 --- a/pathod/examples/test_setupall.py +++ /dev/null @@ -1,39 +0,0 @@ -import requests -from pathod import test - - -class Test: - - """ - Testing the requests module with - a single pathod instance started - for the test suite. - """ - @classmethod - def setup_class(cls): - cls.d = test.Daemon() - - @classmethod - def teardown_class(cls): - cls.d.shutdown() - - def setup(self): - # Clear the pathod logs between tests - self.d.clear_log() - - def test_simple(self): - # Get a URL for a pathod spec - url = self.d.p("200:b@100") - # ... and request it - r = requests.put(url) - - # Check the returned data - assert r.status_code == 200 - assert len(r.content) == 100 - - # Check pathod's internal log - log = self.d.last_log()["request"] - assert log["method"] == "PUT" - - def test_two(self): - assert not self.d.log() diff --git a/release/mitmdump.spec b/release/mitmdump.spec index 2e164083..034d6fcc 100644 --- a/release/mitmdump.spec +++ b/release/mitmdump.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/bin/mitmdump'], +a = Analysis(['../bin/mitmdump'], binaries=None, datas=collect_data_files("mitmproxy.onboarding"), hiddenimports=[], diff --git a/release/mitmproxy.spec b/release/mitmproxy.spec index ff42b1f3..08e71f73 100644 --- a/release/mitmproxy.spec +++ b/release/mitmproxy.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/bin/mitmproxy'], +a = Analysis(['../bin/mitmproxy'], binaries=None, datas=collect_data_files("mitmproxy.onboarding"), hiddenimports=[], diff --git a/release/mitmweb.spec b/release/mitmweb.spec index e64940c4..257d3e33 100644 --- a/release/mitmweb.spec +++ b/release/mitmweb.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../mitmproxy/bin/mitmweb'], +a = Analysis(['../bin/mitmweb'], binaries=None, datas=collect_data_files("mitmproxy"), hiddenimports=[], diff --git a/release/pathoc.spec b/release/pathoc.spec index e694794e..69c96727 100644 --- a/release/pathoc.spec +++ b/release/pathoc.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../pathod/bin/pathoc'], +a = Analysis(['../bin/pathoc'], binaries=None, datas=None, hiddenimports=['_cffi_backend'], diff --git a/release/pathod.spec b/release/pathod.spec index a0ccbaf0..6eabad5e 100644 --- a/release/pathod.spec +++ b/release/pathod.spec @@ -2,7 +2,7 @@ from PyInstaller.utils.hooks import collect_data_files -a = Analysis(['../pathod/bin/pathod'], +a = Analysis(['../bin/pathod'], binaries=None, datas=collect_data_files("pathod"), hiddenimports=['_cffi_backend'], -- cgit v1.2.3 From 33438827379680546089c2694d424f6bfea083c9 Mon Sep 17 00:00:00 2001 From: Thiago Arrais Date: Wed, 17 Feb 2016 18:33:07 -0300 Subject: Fix help 'P' can also be used on the request screen! --- mitmproxy/mitmproxy/console/flowview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mitmproxy/mitmproxy/console/flowview.py b/mitmproxy/mitmproxy/console/flowview.py index f490732e..f74ab140 100644 --- a/mitmproxy/mitmproxy/console/flowview.py +++ b/mitmproxy/mitmproxy/console/flowview.py @@ -69,7 +69,7 @@ def _mkhelp(): ), ("M", "change default body display mode"), ("p", "previous flow"), - ("P", "copy response(content/headers) to clipboard"), + ("P", "copy request/response (content/headers) to clipboard"), ("r", "replay request"), ("V", "revert changes to request"), ("v", "view body in external viewer"), -- cgit v1.2.3 From b6e5e50c24c735a38705408b164f0b239db509cf Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Thu, 18 Feb 2016 10:40:16 +1300 Subject: Make fuzzing run again --- test/mitmproxy/fuzzing/.env | 10 ++++------ test/mitmproxy/fuzzing/straight_stream_patterns | 1 - 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/test/mitmproxy/fuzzing/.env b/test/mitmproxy/fuzzing/.env index 82ae6a8d..8923b8ae 100644 --- a/test/mitmproxy/fuzzing/.env +++ b/test/mitmproxy/fuzzing/.env @@ -1,6 +1,4 @@ - -MITMDUMP=../../mitmdump -PATHOD=../../../pathod/pathod -PATHOC=../../../pathod/pathoc -FUZZ_SETTINGS=-remTt 1 -n 0 - +MITMDUMP=mitmdump +PATHOD=pathod +PATHOC=pathoc +FUZZ_SETTINGS="-remTt 1 -n 0" diff --git a/test/mitmproxy/fuzzing/straight_stream_patterns b/test/mitmproxy/fuzzing/straight_stream_patterns index 93a066e6..235f2cc3 100644 --- a/test/mitmproxy/fuzzing/straight_stream_patterns +++ b/test/mitmproxy/fuzzing/straight_stream_patterns @@ -9,7 +9,6 @@ get:'http://localhost:9999/p/':s'200:b"foo":ir,"\n"' get:'http://localhost:9999/p/':s'200:b"foo":ir,"a"' get:'http://localhost:9999/p/':s'200:b"foo":ir,"9"' get:'http://localhost:9999/p/':s'200:b"foo":ir,":"' -get:'http://localhost:9999/p/':s"200:b'foo':ir,'\"'" get:'http://localhost:9999/p/':s'200:b"foo":ir,"-"' get:'http://localhost:9999/p/':s'200:b"foo":dr' -- cgit v1.2.3