Implementation of python+mitmproxy packet capture

What is mitmproxy

Mitmproxy is a Proxy used for MITM, and MITM is a Man-in-the-middle attack. Unlike package grabber tools such as fiddler, charles or wireshark, mitmproxy can not only crawl request responses to help developers view and analyze, but also perform secondary development through custom python scripts.

Install

pip installation

pip install mitmproxy
# verifymitmproxy --version

Installation certificate

Open the system proxy and set the system proxy to 127.0.0.1:8080 (mitmproxy default proxy) or 192.:8080 (native IP, used for LAN)

cmd enter mitmproxy, browser access /, download certificate to install.

Code installation (automation)

Set up system proxy (win)

import ctypes
import winreg


def set_proxy(enable_proxy, proxy_address="http://127.0.0.1:8080"):
    try:
        # Proxy server address and port        proxy_server = proxy_address

        # Open Registry key        key_path = r"Software\Microsoft\Windows\CurrentVersion\Internet Settings"
        key = (winreg.HKEY_CURRENT_USER, key_path, 0, winreg.KEY_SET_VALUE)

        # Set up a proxy server        if enable_proxy:
            (key, "ProxyServer", 0, winreg.REG_SZ, proxy_server)
            (key, "ProxyEnable", 0, winreg.REG_DWORD, 1)
        else:
            # Close the proxy            (key, "ProxyEnable", 0, winreg.REG_DWORD, 0)

        # Refresh proxy settings        INTERNET_OPTION_REFRESH = 37
        INTERNET_OPTION_SETTINGS_CHANGED = 39
        internet_set_option = 
        internet_set_option(0, INTERNET_OPTION_REFRESH, 0, 0)
        internet_set_option(0, INTERNET_OPTION_SETTINGS_CHANGED, 0, 0)

        # Close the registry key        (key)
        print("System Agent Setup Successfully!")
    except Exception as e:
        print(f"Failed to set up the system proxy: {e}")


if __name__ == "__main__":
    # Set up a proxy (enable a proxy)    set_proxy(enable_proxy=True, proxy_address="http://127.0.0.1:8080")
    # Set up a proxy (close the proxy)    # set_proxy(enable_proxy=False)

Installation certificate (-addstore root)

import subprocess
import platform


def is_mitmproxy_cert_installed():
    try:
        # Use PowerShell to check whether the certificate exists        res = subprocess.check_output(['powershell',
                                       'Get-ChildItem -Path Cert:\CurrentUser\Root | Where-Object {$_.Subject -like "*mitmproxy*"}'])
        if res:
            return True
        return False
    except  as e:
        return False


def install_mitmproxy_certificate(cert_path):
    system_platform = ()
    if system_platform == "Windows":
        # Use the certutil command in Windows system        try:
            res = (["", "-addstore", "root", cert_path], check=True, capture_output=True,
                                 text=True)
            print(res)
            print("The Mitmproxy certificate has been successfully installed into the root certificate store.")
        except  as e:
            print(f"InstallMitmproxyCertificate failed: {e}")


if __name__ == "__main__":
    if is_mitmproxy_cert_installed():
        print("Mitmproxy certificate installed")
    else:
        print("Mitmproxy certificate not installed")
        # Replace with the actual certificate path        certificate_path = r""
        install_mitmproxy_certificate(certificate_path)

# ""

run

Can be usedmitmproxy、mitmdump、mitmwebAny of these three commands

mitmproxy(Only in the command line window) After the command is started, a command line interface will be provided, and the user can see the requests that occur in real time, filter the requests through the commands to view the request data.
mitmwebAfter the command is started, a web interface will be provided, so that the user can see the requests that occur in real time, and filter the requests through GUI interaction to view the request data.
mitmdumpAfter the command is started, there is no interface, combined with custom scripts, working silently

Code start

Method one

import os

import set_proxy

if __name__ == '__main__':
    try:
        set_proxy(enable_proxy=True, proxy_address="http://127.0.0.1:8080")
        ("mitmweb")
        # ("mitmdump -s .\my_script.py")
    except KeyboardInterrupt:
        set_proxy(enable_proxy=False)

Method 2

import asyncio
import os

from mitmproxy import options
from  import DumpMaster


import set_proxy
import my_script


async def start_mitmproxy():
    opts = (listen_host='0.0.0.0', listen_port=8080)
    master = DumpMaster(opts)
    (my_script)
    await ()


if __name__ == '__main__':
    try:
        set_proxy(enable_proxy=True, proxy_address="http://127.0.0.1:8080")
        (start_mitmproxy())
    except KeyboardInterrupt:
        set_proxy(enable_proxy=False)

script

Need to develop according to requirements

Check the official documentation:/stable/
Script example:/mitmproxy/mitmproxy/tree/master/examples

Method 1: Write a py file, which defines several hook functions (can be checked for /stable/api/)

Mainly request and response modify request response, etc.

import logging
import 

num = 0
 
def request(flow: ):
    global num
    num = num + 1
    print("We've seen %d flows" % num)

Method 2: Write a py file that defines a list of variable addons plug-in. addons is an array, and each element is a class instance. These classes have several methods, which implement some hook events provided by mitmproxy.

import logging


class Counter:
    def __init__(self):
         = 0

    def request(self, flow):
         =  + 1
        ("We've seen %d flows" % )


addons = [Counter()]

For more examples, go to github to view script examples.

Here is a record of a reorder URL acquisition: you can get it directly with requests or use ("location")

This is the end of this article about the implementation of python+mitmproxy packet capture. For more related content of python mitmproxy packet capture, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!