I’ve used it to diagnose (and work around) webhook problems between third-party applications that are supposedly compatible.

One that sticks out in my mind is trying to receive Slack webhooks in Mattermost. I was unaware of Slack’s new BlockKit message format until I saw what was being sent. Then I wrote a simple python script to transform the payload, all within mitmproxy. It’s not the most efficient long term solution, but the fact I could diagnose and resolve the issue with a single tool, all within a few hours of first discovering it, was very satisfying.

Here’s the result for anyone interested (warning: it’sa quick hack, not a polished/maintained project)

https://github.com/thinkmassive/mattermost-webhook-slack-pro...

Edit: this doesn’t use TLS at all. I understand that’s probably the primary use case for the tool, but I thought this was a cool example of other ways it can be useful too.

Scripting flow manipulations in mitmproxy is easy. There are a lot of great examples to learn from which help. The filter syntax is expressive and simplifies writing code to mangle flows. I've done body conversion [0], weird types of authorization testing, manipulated system update packages on the fly, all sorts of bizarre things. Auto-reloading scripts on change is such a time saver. If you want a python-based programmable HTTPS proxy for testing I have not found anything better.

[0]: https://carvesystems.com/news/proxying-wbxml-services/

We have a product that depends on data received from external web services. We often want to test certain conditions in the data (specific results, error scenarios, etc), and it's difficult or impossible to guarantee these conditions when we call out to our external services. We use mitmproxy to intercept and manipulate the responses we get.

Even if we don't need to manipulate the data, it's a very useful tool for watching requests go back and forth.

We have a super diverse userbase, so this is a fun question! Some pointers:

Development:

- Debug your own apps/devices (which do not come with Chrome Devtools).

- Simple Python scripts to replace/inject website content. (https://docs.mitmproxy.org/stable/addons-overview/)

- Capture a web page/API and then replay the responses offline. (https://docs.mitmproxy.org/stable/overview-features/#server-...).

- Replay requests for testing. (https://docs.mitmproxy.org/stable/overview-features/#client-...)

Privacy:

- Figure out what your Covid app is sending out (https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-...)

- Look at how evil IoT devices for pets are (https://www.nytimes.com/2018/12/11/realestate/spying-on-the-...)

- Generally find more evil stuff (https://mitmproxy.org/publications/)

Security:

- Reverse-engineering custom binary protocols is never fun, but with mitmproxy you can at least write custom contentviews to dissect stuff. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...)

- Fiddle with generic TLS-protected TCP streams. (https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad...)

- Dump TLS master secrets for WireShark. (https://docs.mitmproxy.org/stable/howto-wireshark-tls/)

I wrote a krunkerio aimbot that unpacks the msgpack-over-websocket packets and injects the calculated mouse movements into the stream.

The biggest problem was the server only syncing the player position every second or so which means my middleware has can only provide exact calculations when I stand still. Solving this would require reading the process memory but that is exactly what I wanted to avoid :/

I've introduced mitmproxy in my team and we use it quite often for flows' inspection and manipulation while testing a desktop app. Can't count cases where a quick look into a proxy made debugging a lot easier, because we were able to point at unexpected requests / responses.

Thank you for your work, @mhils & the team. Enjoy your moments of glory on HN :)

I use it to download music from my music streaming subscription to my son's iPod. None of the files have any tags or metadata so it's was an interesting challenge to get everything tagged.