[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EK0AM22CHFR2EBXJMS2F1Y":3,"skill-same:01M6EK0AM22CHFR2EBXJMS2F1Y":132},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":84,"repositoryHtmlUrl":85,"repositoryHomepageUrl":86,"ownerHtmlUrl":87,"ownerBlogUrl":6,"ownerDescription":88,"updatedAt":89,"install":90,"resources":103},"01M6EK0AM22CHFR2EBXJMS2F1Y","api-mitmproxy",null,"Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP\u002F1, HTTP\u002F2, HTTP\u002F3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP\u002FHTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"api mitmproxy","mitmproxy","api","api security testing","communications","org","scripts","app","websockets","mobile","export","testing","analysis","tls","owasp","analyzing","capabilities","debugging","security","cli","2026-11-10 10:12:30",false,"---\nname: api-mitmproxy\ndescription: >\n  Interactive HTTPS proxy for API security testing with traffic interception, modification, and\n  replay capabilities. Supports HTTP\u002F1, HTTP\u002F2, HTTP\u002F3, WebSockets, and TLS-protected protocols.\n  Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when:\n  (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP\u002FHTTPS requests\n  and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4)\n  Debugging mobile app or thick client API communications, (5) Automating API security tests with\n  Python scripts, (6) Exporting traffic in HAR format for analysis.\nversion: 0.1.0\nmaintainer: SirAppSec\ncategory: appsec\ntags: [api-testing, proxy, https, intercepting-proxy, traffic-analysis, mitmproxy, har-export, websockets]\nframeworks: [OWASP]\ndependencies:\n  python: \">=3.9\"\n  tools: [mitmproxy, mitmweb, mitmdump]\nreferences:\n  - https:\u002F\u002Fmitmproxy.org\u002F\n  - https:\u002F\u002Fdocs.mitmproxy.org\u002F\n---\n\n# mitmproxy API Security Testing\n\n## Overview\n\nmitmproxy is an interactive, TLS-capable intercepting HTTP proxy for penetration testers and developers. It enables real-time inspection, modification, and replay of HTTP\u002FHTTPS traffic including APIs, mobile apps, and thick clients. With support for HTTP\u002F1, HTTP\u002F2, HTTP\u002F3, and WebSockets, mitmproxy provides comprehensive coverage for modern API security testing.\n\n## Interfaces\n\n**mitmproxy** - Interactive console interface with keyboard navigation\n**mitmweb** - Web-based GUI for visual traffic inspection\n**mitmdump** - Command-line tool for automated traffic capture and scripting\n\n## Quick Start\n\nInstall and run mitmproxy:\n\n```bash\n# Install via pip\npip install mitmproxy\n\n# Start interactive console proxy\nmitmproxy\n\n# Start web interface (default: http:\u002F\u002F127.0.0.1:8081)\nmitmweb\n\n# Start command-line proxy with output\nmitmdump -w traffic.flow\n```\n\nConfigure client to use proxy (default: localhost:8080)\n\n## Core Workflows\n\n### Workflow 1: Interactive API Traffic Inspection\n\nFor manual API security testing and analysis:\n\n1. Start mitmproxy or mitmweb:\n   ```bash\n   # Console interface\n   mitmproxy --mode regular --listen-host 0.0.0.0 --listen-port 8080\n\n   # Or web interface\n   mitmweb --mode regular --listen-host 0.0.0.0 --listen-port 8080\n   ```\n2. Configure target application to use proxy (HTTP: localhost:8080)\n3. Install mitmproxy CA certificate on client device\n4. Trigger API requests from the application\n5. Intercept and inspect requests\u002Fresponses in mitmproxy\n6. Modify requests to test:\n   - Authentication bypass attempts\n   - Authorization flaws (IDOR, privilege escalation)\n   - Input validation (SQLi, XSS, command injection)\n   - Business logic vulnerabilities\n7. Save flows for documentation and reporting\n\n### Workflow 2: Mobile App API Security Testing\n\nProgress:\n[ ] 1. Install mitmproxy CA certificate on mobile device\n[ ] 2. Configure device WiFi to use mitmproxy as proxy\n[ ] 3. Start mitmweb for visual traffic inspection\n[ ] 4. Launch mobile app and exercise all features\n[ ] 5. Review API endpoints, authentication mechanisms, data flows\n[ ] 6. Test for common API vulnerabilities (OWASP API Top 10)\n[ ] 7. Export traffic as HAR for further analysis\n[ ] 8. Document findings with request\u002Fresponse examples\n\nWork through each step systematically. Check off completed items.\n\n### Workflow 3: Automated API Traffic Recording\n\nFor capturing and analyzing API traffic at scale:\n\n1. Start mitmdump with flow capture:\n   ```bash\n   mitmdump -w api-traffic.flow --mode regular\n   ```\n2. Run automated tests or manual app interaction\n3. Stop mitmdump (Ctrl+C) to save flows\n4. Replay captured traffic:\n   ```bash\n   # Replay to server\n   mitmdump -nc -r api-traffic.flow\n\n   # Replay with modifications via script\n   mitmdump -s replay-script.py -r api-traffic.flow\n   ```\n5. Export to HAR format for analysis:\n   ```bash\n   # Using Python API\n   python3 -c \"from mitmproxy.io import FlowReader; from mitmproxy.tools.dump import DumpMaster;\n   import sys; [print(flow.request.url) for flow in FlowReader(open('api-traffic.flow', 'rb')).stream()]\"\n   ```\n\n### Workflow 4: Python Scripting for API Testing\n\nFor automated security testing with custom logic:\n\n1. Create Python addon script (`api-test.py`):\n   ```python\n   from mitmproxy import http\n\n   class APISecurityTester:\n       def request(self, flow: http.HTTPFlow) -> None:\n           # Modify requests on-the-fly\n           if \"api.example.com\" in flow.request.pretty_url:\n               # Test for authorization bypass\n               flow.request.headers[\"X-User-ID\"] = \"1\"\n\n       def response(self, flow: http.HTTPFlow) -> None:\n           # Analyze responses\n           if flow.response.status_code == 200:\n               if \"admin\" in flow.response.text:\n                   print(f\"[!] Potential privilege escalation: {flow.request.url}\")\n\n   addons = [APISecurityTester()]\n   ```\n2. Run mitmproxy with script:\n   ```bash\n   mitmproxy -s api-test.py\n   # Or for automation\n   mitmdump -s api-test.py -w results.flow\n   ```\n3. Review automated findings and captured traffic\n4. Export results for reporting\n\n### Workflow 5: SSL\u002FTLS Certificate Pinning Bypass\n\nFor testing mobile apps with certificate pinning:\n\n1. Install mitmproxy CA certificate on device\n2. Use certificate unpinning tools or framework modifications:\n   - Android: Frida script for SSL unpinning\n   - iOS: SSL Kill Switch or similar tools\n3. Configure app traffic through mitmproxy\n4. Alternatively, use reverse proxy mode:\n   ```bash\n   mitmproxy --mode reverse:https:\u002F\u002Fapi.example.com --listen-host 0.0.0.0 --listen-port 443\n   ```\n5. Modify \u002Fetc\u002Fhosts to redirect API domain to mitmproxy\n6. Intercept and analyze traffic normally\n\n## Operating Modes\n\nmitmproxy supports multiple deployment modes:\n\n**Regular Proxy Mode** (default):\n```bash\nmitmproxy --mode regular --listen-port 8080\n```\nClient configures proxy settings explicitly.\n\n**Transparent Proxy Mode** (invisible to client):\n```bash\nmitmproxy --mode transparent --listen-port 8080\n```\nRequires iptables\u002Fpf rules to redirect traffic.\n\n**Reverse Proxy Mode** (sits in front of server):\n```bash\nmitmproxy --mode reverse:https:\u002F\u002Fapi.example.com --listen-port 443\n```\nmitmproxy acts as the server endpoint.\n\n**Upstream Proxy Mode** (chain proxies):\n```bash\nmitmproxy --mode upstream:http:\u002F\u002Fcorporate-proxy:8080\n```\nRoutes traffic through another proxy.\n\n## Certificate Installation\n\nInstall mitmproxy CA certificate for HTTPS interception:\n\n**Browser\u002FDesktop:**\n1. Start mitmproxy and configure proxy settings\n2. Visit http:\u002F\u002Fmitm.it\n3. Download certificate for your platform\n4. Install in system\u002Fbrowser certificate store\n\n**Android:**\n1. Push certificate to device: `adb push ~\u002F.mitmproxy\u002Fmitmproxy-ca-cert.cer \u002Fsdcard\u002F`\n2. Settings → Security → Install from SD card\n3. Select mitmproxy certificate\n\n**iOS:**\n1. Email certificate or host on web server\n2. Install profile on device\n3. Settings → General → About → Certificate Trust Settings\n4. Enable trust for mitmproxy certificate\n\n## Common Patterns\n\n### Pattern 1: API Authentication Testing\n\nTest authentication mechanisms and token handling:\n\n```python\n# auth-test.py\nfrom mitmproxy import http\n\nclass AuthTester:\n    def __init__(self):\n        self.tokens = []\n\n    def request(self, flow: http.HTTPFlow):\n        # Capture auth tokens\n        if \"authorization\" in flow.request.headers:\n            token = flow.request.headers[\"authorization\"]\n            if token not in self.tokens:\n                self.tokens.append(token)\n                print(f\"[+] Captured token: {token[:20]}...\")\n\n        # Test for missing authentication\n        if \"api.example.com\" in flow.request.url:\n            flow.request.headers.pop(\"authorization\", None)\n            print(f\"[*] Testing unauthenticated: {flow.request.path}\")\n\naddons = [AuthTester()]\n```\n\n### Pattern 2: API Parameter Fuzzing\n\nFuzz API parameters for injection vulnerabilities:\n\n```python\n# fuzz-params.py\nfrom mitmproxy import http\n\nclass ParamFuzzer:\n    def request(self, flow: http.HTTPFlow):\n        if flow.request.method == \"POST\" and \"api.example.com\" in flow.request.url:\n            # Clone and modify request\n            original_body = flow.request.text\n            payloads = [\"' OR '1'='1\", \"\u003Cscript>alert(1)\u003C\u002Fscript>\", \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"]\n\n            for payload in payloads:\n                # Modify parameters and test\n                # (Implementation depends on content-type)\n                print(f\"[*] Testing payload: {payload}\")\n\naddons = [ParamFuzzer()]\n```\n\n### Pattern 3: GraphQL API Testing\n\nInspect and test GraphQL APIs:\n\n```python\n# graphql-test.py\nfrom mitmproxy import http\nimport json\n\nclass GraphQLTester:\n    def request(self, flow: http.HTTPFlow):\n        if \"\u002Fgraphql\" in flow.request.path:\n            try:\n                data = json.loads(flow.request.text)\n                query = data.get(\"query\", \"\")\n                print(f\"[+] GraphQL Query:\\n{query}\")\n\n                # Test for introspection\n                if \"__schema\" not in query:\n                    introspection = {\"query\": \"{__schema{types{name}}}\"}\n                    print(f\"[*] Testing introspection\")\n            except:\n                pass\n\naddons = [GraphQLTester()]\n```\n\n### Pattern 4: HAR Export for Analysis\n\nExport traffic as HTTP Archive for analysis:\n\n```bash\n# Export flows to HAR format\nmitmdump -s export-har.py -r captured-traffic.flow\n\n# export-har.py\nfrom mitmproxy import http, ctx\nimport json\n\nclass HARExporter:\n    def done(self):\n        har_entries = []\n        # Build HAR structure\n        # (Simplified - use mitmproxy's built-in HAR addon)\n        ctx.log.info(f\"Exported {len(har_entries)} entries\")\n\naddons = [HARExporter()]\n```\n\nOr use built-in addon:\n```bash\nmitmdump --set hardump=.\u002Ftraffic.har\n```\n\n## Security Considerations\n\n- **Sensitive Data Handling**: Captured traffic may contain credentials, tokens, PII. Encrypt and secure stored flows. Never commit flow files to version control\n- **Access Control**: Restrict access to mitmproxy instance. Use authentication for mitmweb (--web-user\u002F--web-password flags)\n- **Audit Logging**: Log all intercepted traffic and modifications for security auditing and compliance\n- **Compliance**: Ensure proper authorization before intercepting production traffic. Comply with GDPR, PCI-DSS for sensitive data\n- **Safe Defaults**: Use isolated testing environments. Avoid intercepting production traffic without explicit authorization\n\n## Integration Points\n\n### Penetration Testing Workflow\n\n1. Reconnaissance: Identify API endpoints via mitmproxy\n2. Authentication testing: Capture and analyze auth tokens\n3. Authorization testing: Modify user IDs, roles, permissions\n4. Input validation: Inject payloads to test for vulnerabilities\n5. Business logic: Test workflows for logical flaws\n6. Export findings as HAR for reporting\n\n### CI\u002FCD Integration\n\nRun automated API security tests:\n\n```bash\n# Run mitmdump with test script in CI\nmitmdump -s api-security-tests.py --anticache -w test-results.flow &\nPROXY_PID=$!\n\n# Run API tests through proxy\nexport HTTP_PROXY=http:\u002F\u002Flocalhost:8080\nexport HTTPS_PROXY=http:\u002F\u002Flocalhost:8080\npytest tests\u002Fapi_tests.py\n\n# Stop proxy and analyze results\nkill $PROXY_PID\npython3 analyze-results.py test-results.flow\n```\n\n### Mobile App Security Testing\n\nStandard workflow for iOS\u002FAndroid apps:\n1. Configure device to use mitmproxy\n2. Install CA certificate\n3. Bypass SSL pinning if needed\n4. Exercise app functionality\n5. Analyze API security (OWASP Mobile Top 10)\n6. Document API vulnerabilities\n\n## Advanced Features\n\n### Traffic Filtering\n\nFilter displayed traffic by expression:\n\n```bash\n# Show only API calls\nmitmproxy --view-filter '~d api.example.com'\n\n# Show only POST requests\nmitmproxy --view-filter '~m POST'\n\n# Show responses with specific status\nmitmproxy --view-filter '~c 401'\n\n# Combine filters\nmitmproxy --view-filter '~d api.example.com & ~m POST'\n```\n\n### Request\u002FResponse Modification\n\nModify traffic using built-in mappers:\n\n```bash\n# Replace request headers\nmitmproxy --modify-headers '\u002F~u example\u002FAuthorization\u002FBearer fake-token'\n\n# Replace response body\nmitmproxy --modify-body '\u002F~s & ~b \"error\"\u002Fsuccess'\n```\n\n### WebSocket Interception\n\nIntercept and modify WebSocket traffic:\n\n```python\n# websocket-test.py\nfrom mitmproxy import websocket\n\nclass WebSocketTester:\n    def websocket_message(self, flow):\n        message = flow.messages[-1]\n        print(f\"[+] WebSocket: {message.content[:100]}\")\n\n        # Modify messages\n        if message.from_client:\n            message.content = message.content.replace(b\"user\", b\"admin\")\n\naddons = [WebSocketTester()]\n```\n\n## Troubleshooting\n\n### Issue: SSL Certificate Errors\n\n**Solution**: Ensure mitmproxy CA certificate is properly installed and trusted:\n```bash\n# Verify certificate location\nls ~\u002F.mitmproxy\u002F\n\n# Regenerate certificates if needed\nrm -rf ~\u002F.mitmproxy\u002F\nmitmproxy  # Regenerates on startup\n```\n\n### Issue: Mobile App Not Sending Traffic Through Proxy\n\n**Solution**:\n- Verify WiFi proxy configuration\n- Check firewall rules aren't blocking proxy port\n- Ensure mitmproxy is listening on correct interface (0.0.0.0)\n- Test with browser first to verify proxy works\n\n### Issue: Certificate Pinning Blocking Interception\n\n**Solution**: Use SSL unpinning tools:\n```bash\n# Android with Frida\nfrida -U -l universal-android-ssl-pinning-bypass.js -f com.example.app\n\n# Or modify app to disable pinning (development builds)\n```\n\n### Issue: Cannot Intercept HTTP\u002F2 or HTTP\u002F3\n\n**Solution**: mitmproxy supports HTTP\u002F2 by default. For HTTP\u002F3:\n```bash\n# Enable HTTP\u002F3 support (experimental)\nmitmproxy --set http3=true\n```\n\n## OWASP API Security Top 10 Testing\n\nUse mitmproxy to test for OWASP API Security Top 10 vulnerabilities:\n\n- **API1: Broken Object Level Authorization** - Modify object IDs in requests\n- **API2: Broken Authentication** - Test token validation, session management\n- **API3: Broken Object Property Level Authorization** - Test for mass assignment\n- **API4: Unrestricted Resource Consumption** - Test rate limiting, pagination\n- **API5: Broken Function Level Authorization** - Modify roles, escalate privileges\n- **API6: Unrestricted Access to Sensitive Business Flows** - Test business logic\n- **API7: Server Side Request Forgery** - Inject URLs in parameters\n- **API8: Security Misconfiguration** - Check headers, CORS, error messages\n- **API9: Improper Inventory Management** - Enumerate undocumented endpoints\n- **API10: Unsafe Consumption of APIs** - Test third-party API integrations\n\n## References\n\n- [mitmproxy Documentation](https:\u002F\u002Fdocs.mitmproxy.org\u002F)\n- [mitmproxy GitHub](https:\u002F\u002Fgithub.com\u002Fmitmproxy\u002Fmitmproxy)\n- [OWASP API Security Top 10](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security\u002F)\n- [mitmproxy Addon Examples](https:\u002F\u002Fgithub.com\u002Fmitmproxy\u002Fmitmproxy\u002Ftree\u002Fmain\u002Fexamples)\n","# mitmproxy API Security Testing\n\n## Overview\n\nmitmproxy is an interactive, TLS-capable intercepting HTTP proxy for penetration testers and developers. It enables real-time inspection, modification, and replay of HTTP\u002FHTTPS traffic including APIs, mobile apps, and thick clients. With support for HTTP\u002F1, HTTP\u002F2, HTTP\u002F3, and WebSockets, mitmproxy provides comprehensive coverage for modern API security testing.\n\n## Interfaces\n\n**mitmproxy** - Interactive console interface with keyboard navigation\n**mitmweb** - Web-based GUI for visual traffic inspection\n**mitmdump** - Command-line tool for automated traffic capture and scripting\n\n## Quick Start\n\nInstall and run mitmproxy:\n\n```bash\n# Install via pip\npip install mitmproxy\n\n# Start interactive console proxy\nmitmproxy\n\n# Start web interface (default: http:\u002F\u002F127.0.0.1:8081)\nmitmweb\n\n# Start command-line proxy with output\nmitmdump -w traffic.flow\n```\n\nConfigure client to use proxy (default: localhost:8080)\n\n## Core Workflows\n\n### Workflow 1: Interactive API Traffic Inspection\n\nFor manual API security testing and analysis:\n\n1. Start mitmproxy or mitmweb:\n   ```bash\n   # Console interface\n   mitmproxy --mode regular --listen-host 0.0.0.0 --listen-port 8080\n\n   # Or web interface\n   mitmweb --mode regular --listen-host 0.0.0.0 --listen-port 8080\n   ```\n2. Configure target application to use proxy (HTTP: localhost:8080)\n3. Install mitmproxy CA certificate on client device\n4. Trigger API requests from the application\n5. Intercept and inspect requests\u002Fresponses in mitmproxy\n6. Modify requests to test:\n   - Authentication bypass attempts\n   - Authorization flaws (IDOR, privilege escalation)\n   - Input validation (SQLi, XSS, command injection)\n   - Business logic vulnerabilities\n7. Save flows for documentation and reporting\n\n### Workflow 2: Mobile App API Security Testing\n\nProgress:\n[ ] 1. Install mitmproxy CA certificate on mobile device\n[ ] 2. Configure device WiFi to use mitmproxy as proxy\n[ ] 3. Start mitmweb for visual traffic inspection\n[ ] 4. Launch mobile app and exercise all features\n[ ] 5. Review API endpoints, authentication mechanisms, data flows\n[ ] 6. Test for common API vulnerabilities (OWASP API Top 10)\n[ ] 7. Export traffic as HAR for further analysis\n[ ] 8. Document findings with request\u002Fresponse examples\n\nWork through each step systematically. Check off completed items.\n\n### Workflow 3: Automated API Traffic Recording\n\nFor capturing and analyzing API traffic at scale:\n\n1. Start mitmdump with flow capture:\n   ```bash\n   mitmdump -w api-traffic.flow --mode regular\n   ```\n2. Run automated tests or manual app interaction\n3. Stop mitmdump (Ctrl+C) to save flows\n4. Replay captured traffic:\n   ```bash\n   # Replay to server\n   mitmdump -nc -r api-traffic.flow\n\n   # Replay with modifications via script\n   mitmdump -s replay-script.py -r api-traffic.flow\n   ```\n5. Export to HAR format for analysis:\n   ```bash\n   # Using Python API\n   python3 -c \"from mitmproxy.io import FlowReader; from mitmproxy.tools.dump import DumpMaster;\n   import sys; [print(flow.request.url) for flow in FlowReader(open('api-traffic.flow', 'rb')).stream()]\"\n   ```\n\n### Workflow 4: Python Scripting for API Testing\n\nFor automated security testing with custom logic:\n\n1. Create Python addon script (`api-test.py`):\n   ```python\n   from mitmproxy import http\n\n   class APISecurityTester:\n       def request(self, flow: http.HTTPFlow) -> None:\n           # Modify requests on-the-fly\n           if \"api.example.com\" in flow.request.pretty_url:\n               # Test for authorization bypass\n               flow.request.headers[\"X-User-ID\"] = \"1\"\n\n       def response(self, flow: http.HTTPFlow) -> None:\n           # Analyze responses\n           if flow.response.status_code == 200:\n               if \"admin\" in flow.response.text:\n                   print(f\"[!] Potential privilege escalation: {flow.request.url}\")\n\n   addons = [APISecurityTester()]\n   ```\n2. Run mitmproxy with script:\n   ```bash\n   mitmproxy -s api-test.py\n   # Or for automation\n   mitmdump -s api-test.py -w results.flow\n   ```\n3. Review automated findings and captured traffic\n4. Export results for reporting\n\n### Workflow 5: SSL\u002FTLS Certificate Pinning Bypass\n\nFor testing mobile apps with certificate pinning:\n\n1. Install mitmproxy CA certificate on device\n2. Use certificate unpinning tools or framework modifications:\n   - Android: Frida script for SSL unpinning\n   - iOS: SSL Kill Switch or similar tools\n3. Configure app traffic through mitmproxy\n4. Alternatively, use reverse proxy mode:\n   ```bash\n   mitmproxy --mode reverse:https:\u002F\u002Fapi.example.com --listen-host 0.0.0.0 --listen-port 443\n   ```\n5. Modify \u002Fetc\u002Fhosts to redirect API domain to mitmproxy\n6. Intercept and analyze traffic normally\n\n## Operating Modes\n\nmitmproxy supports multiple deployment modes:\n\n**Regular Proxy Mode** (default):\n```bash\nmitmproxy --mode regular --listen-port 8080\n```\nClient configures proxy settings explicitly.\n\n**Transparent Proxy Mode** (invisible to client):\n```bash\nmitmproxy --mode transparent --listen-port 8080\n```\nRequires iptables\u002Fpf rules to redirect traffic.\n\n**Reverse Proxy Mode** (sits in front of server):\n```bash\nmitmproxy --mode reverse:https:\u002F\u002Fapi.example.com --listen-port 443\n```\nmitmproxy acts as the server endpoint.\n\n**Upstream Proxy Mode** (chain proxies):\n```bash\nmitmproxy --mode upstream:http:\u002F\u002Fcorporate-proxy:8080\n```\nRoutes traffic through another proxy.\n\n## Certificate Installation\n\nInstall mitmproxy CA certificate for HTTPS interception:\n\n**Browser\u002FDesktop:**\n1. Start mitmproxy and configure proxy settings\n2. Visit http:\u002F\u002Fmitm.it\n3. Download certificate for your platform\n4. Install in system\u002Fbrowser certificate store\n\n**Android:**\n1. Push certificate to device: `adb push ~\u002F.mitmproxy\u002Fmitmproxy-ca-cert.cer \u002Fsdcard\u002F`\n2. Settings → Security → Install from SD card\n3. Select mitmproxy certificate\n\n**iOS:**\n1. Email certificate or host on web server\n2. Install profile on device\n3. Settings → General → About → Certificate Trust Settings\n4. Enable trust for mitmproxy certificate\n\n## Common Patterns\n\n### Pattern 1: API Authentication Testing\n\nTest authentication mechanisms and token handling:\n\n```python\n# auth-test.py\nfrom mitmproxy import http\n\nclass AuthTester:\n    def __init__(self):\n        self.tokens = []\n\n    def request(self, flow: http.HTTPFlow):\n        # Capture auth tokens\n        if \"authorization\" in flow.request.headers:\n            token = flow.request.headers[\"authorization\"]\n            if token not in self.tokens:\n                self.tokens.append(token)\n                print(f\"[+] Captured token: {token[:20]}...\")\n\n        # Test for missing authentication\n        if \"api.example.com\" in flow.request.url:\n            flow.request.headers.pop(\"authorization\", None)\n            print(f\"[*] Testing unauthenticated: {flow.request.path}\")\n\naddons = [AuthTester()]\n```\n\n### Pattern 2: API Parameter Fuzzing\n\nFuzz API parameters for injection vulnerabilities:\n\n```python\n# fuzz-params.py\nfrom mitmproxy import http\n\nclass ParamFuzzer:\n    def request(self, flow: http.HTTPFlow):\n        if flow.request.method == \"POST\" and \"api.example.com\" in flow.request.url:\n            # Clone and modify request\n            original_body = flow.request.text\n            payloads = [\"' OR '1'='1\", \"\u003Cscript>alert(1)\u003C\u002Fscript>\", \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"]\n\n            for payload in payloads:\n                # Modify parameters and test\n                # (Implementation depends on content-type)\n                print(f\"[*] Testing payload: {payload}\")\n\naddons = [ParamFuzzer()]\n```\n\n### Pattern 3: GraphQL API Testing\n\nInspect and test GraphQL APIs:\n\n```python\n# graphql-test.py\nfrom mitmproxy import http\nimport json\n\nclass GraphQLTester:\n    def request(self, flow: http.HTTPFlow):\n        if \"\u002Fgraphql\" in flow.request.path:\n            try:\n                data = json.loads(flow.request.text)\n                query = data.get(\"query\", \"\")\n                print(f\"[+] GraphQL Query:\\n{query}\")\n\n                # Test for introspection\n                if \"__schema\" not in query:\n                    introspection = {\"query\": \"{__schema{types{name}}}\"}\n                    print(f\"[*] Testing introspection\")\n            except:\n                pass\n\naddons = [GraphQLTester()]\n```\n\n### Pattern 4: HAR Export for Analysis\n\nExport traffic as HTTP Archive for analysis:\n\n```bash\n# Export flows to HAR format\nmitmdump -s export-har.py -r captured-traffic.flow\n\n# export-har.py\nfrom mitmproxy import http, ctx\nimport json\n\nclass HARExporter:\n    def done(self):\n        har_entries = []\n        # Build HAR structure\n        # (Simplified - use mitmproxy's built-in HAR addon)\n        ctx.log.info(f\"Exported {len(har_entries)} entries\")\n\naddons = [HARExporter()]\n```\n\nOr use built-in addon:\n```bash\nmitmdump --set hardump=.\u002Ftraffic.har\n```\n\n## Security Considerations\n\n- **Sensitive Data Handling**: Captured traffic may contain credentials, tokens, PII. Encrypt and secure stored flows. Never commit flow files to version control\n- **Access Control**: Restrict access to mitmproxy instance. Use authentication for mitmweb (--web-user\u002F--web-password flags)\n- **Audit Logging**: Log all intercepted traffic and modifications for security auditing and compliance\n- **Compliance**: Ensure proper authorization before intercepting production traffic. Comply with GDPR, PCI-DSS for sensitive data\n- **Safe Defaults**: Use isolated testing environments. Avoid intercepting production traffic without explicit authorization\n\n## Integration Points\n\n### Penetration Testing Workflow\n\n1. Reconnaissance: Identify API endpoints via mitmproxy\n2. Authentication testing: Capture and analyze auth tokens\n3. Authorization testing: Modify user IDs, roles, permissions\n4. Input validation: Inject payloads to test for vulnerabilities\n5. Business logic: Test workflows for logical flaws\n6. Export findings as HAR for reporting\n\n### CI\u002FCD Integration\n\nRun automated API security tests:\n\n```bash\n# Run mitmdump with test script in CI\nmitmdump -s api-security-tests.py --anticache -w test-results.flow &\nPROXY_PID=$!\n\n# Run API tests through proxy\nexport HTTP_PROXY=http:\u002F\u002Flocalhost:8080\nexport HTTPS_PROXY=http:\u002F\u002Flocalhost:8080\npytest tests\u002Fapi_tests.py\n\n# Stop proxy and analyze results\nkill $PROXY_PID\npython3 analyze-results.py test-results.flow\n```\n\n### Mobile App Security Testing\n\nStandard workflow for iOS\u002FAndroid apps:\n1. Configure device to use mitmproxy\n2. Install CA certificate\n3. Bypass SSL pinning if needed\n4. Exercise app functionality\n5. Analyze API security (OWASP Mobile Top 10)\n6. Document API vulnerabilities\n\n## Advanced Features\n\n### Traffic Filtering\n\nFilter displayed traffic by expression:\n\n```bash\n# Show only API calls\nmitmproxy --view-filter '~d api.example.com'\n\n# Show only POST requests\nmitmproxy --view-filter '~m POST'\n\n# Show responses with specific status\nmitmproxy --view-filter '~c 401'\n\n# Combine filters\nmitmproxy --view-filter '~d api.example.com & ~m POST'\n```\n\n### Request\u002FResponse Modification\n\nModify traffic using built-in mappers:\n\n```bash\n# Replace request headers\nmitmproxy --modify-headers '\u002F~u example\u002FAuthorization\u002FBearer fake-token'\n\n# Replace response body\nmitmproxy --modify-body '\u002F~s & ~b \"error\"\u002Fsuccess'\n```\n\n### WebSocket Interception\n\nIntercept and modify WebSocket traffic:\n\n```python\n# websocket-test.py\nfrom mitmproxy import websocket\n\nclass WebSocketTester:\n    def websocket_message(self, flow):\n        message = flow.messages[-1]\n        print(f\"[+] WebSocket: {message.content[:100]}\")\n\n        # Modify messages\n        if message.from_client:\n            message.content = message.content.replace(b\"user\", b\"admin\")\n\naddons = [WebSocketTester()]\n```\n\n## Troubleshooting\n\n### Issue: SSL Certificate Errors\n\n**Solution**: Ensure mitmproxy CA certificate is properly installed and trusted:\n```bash\n# Verify certificate location\nls ~\u002F.mitmproxy\u002F\n\n# Regenerate certificates if needed\nrm -rf ~\u002F.mitmproxy\u002F\nmitmproxy  # Regenerates on startup\n```\n\n### Issue: Mobile App Not Sending Traffic Through Proxy\n\n**Solution**:\n- Verify WiFi proxy configuration\n- Check firewall rules aren't blocking proxy port\n- Ensure mitmproxy is listening on correct interface (0.0.0.0)\n- Test with browser first to verify proxy works\n\n### Issue: Certificate Pinning Blocking Interception\n\n**Solution**: Use SSL unpinning tools:\n```bash\n# Android with Frida\nfrida -U -l universal-android-ssl-pinning-bypass.js -f com.example.app\n\n# Or modify app to disable pinning (development builds)\n```\n\n### Issue: Cannot Intercept HTTP\u002F2 or HTTP\u002F3\n\n**Solution**: mitmproxy supports HTTP\u002F2 by default. For HTTP\u002F3:\n```bash\n# Enable HTTP\u002F3 support (experimental)\nmitmproxy --set http3=true\n```\n\n## OWASP API Security Top 10 Testing\n\nUse mitmproxy to test for OWASP API Security Top 10 vulnerabilities:\n\n- **API1: Broken Object Level Authorization** - Modify object IDs in requests\n- **API2: Broken Authentication** - Test token validation, session management\n- **API3: Broken Object Property Level Authorization** - Test for mass assignment\n- **API4: Unrestricted Resource Consumption** - Test rate limiting, pagination\n- **API5: Broken Function Level Authorization** - Modify roles, escalate privileges\n- **API6: Unrestricted Access to Sensitive Business Flows** - Test business logic\n- **API7: Server Side Request Forgery** - Inject URLs in parameters\n- **API8: Security Misconfiguration** - Check headers, CORS, error messages\n- **API9: Improper Inventory Management** - Enumerate undocumented endpoints\n- **API10: Unsafe Consumption of APIs** - Test third-party API integrations\n\n## References\n\n- [mitmproxy Documentation](https:\u002F\u002Fdocs.mitmproxy.org\u002F)\n- [mitmproxy GitHub](https:\u002F\u002Fgithub.com\u002Fmitmproxy\u002Fmitmproxy)\n- [OWASP API Security Top 10](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security\u002F)\n- [mitmproxy Addon Examples](https:\u002F\u002Fgithub.com\u002Fmitmproxy\u002Fmitmproxy\u002Ftree\u002Fmain\u002Fexamples)\n",{"name":5,"tags":60,"version":67,"category":68,"frameworks":69,"maintainer":71,"references":72,"description":75,"dependencies":76},[61,62,63,64,65,36,66,43],"api-testing","proxy","https","intercepting-proxy","traffic-analysis","har-export","0.1.0","appsec",[70],"OWASP","SirAppSec",[73,74],"https:\u002F\u002Fmitmproxy.org\u002F","https:\u002F\u002Fdocs.mitmproxy.org\u002F","Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP\u002F1, HTTP\u002F2, HTTP\u002F3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP\u002FHTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.\n",{"tools":77,"python":80},[36,78,79],"mitmweb","mitmdump",">=3.9","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":91,"prompt":101,"zipAvailable":102},[92,95,98],{"tool":93,"command":94},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill api-mitmproxy",{"tool":96,"command":97},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill api-mitmproxy",{"tool":99,"command":100},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill api-mitmproxy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002FSKILL.md",true,[104,110,114,120,124,128],{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"assets\u002Fci-config-template.yml","ASSET","资产文件",11105,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002Fassets\u002Fci-config-template.yml",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"assets\u002Frule-template.yaml",11044,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002Fassets\u002Frule-template.yaml",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"README.md","REFERENCE","参考文档",161,"https:\u002F\u002Fgithub.com\u002Fai-agent-manager\u002Fagent-manager\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fvalid-bundle\u002Ftest-skill\u002FREADME.md",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002FEXAMPLE.md",15672,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002Freferences\u002FEXAMPLE.md",{"path":125,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002FWORKFLOW_CHECKLIST.md",8390,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002Freferences\u002FWORKFLOW_CHECKLIST.md",{"path":129,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":130,"sourceHtmlUrl":131},"skill-report.json",11773,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fapi-mitmproxy\u002Fskill-report.json",[133,143,153,162,168,175],{"skillNo":134,"name":135,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":55},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[138],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[140,141,142],"model","model hierarchy","model hierarchy skill",{"skillNo":144,"name":145,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":55},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[148],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[150,151,152],"MCP","zoom","zoom mcp",{"skillNo":154,"name":155,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":55},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[159,160,161,151],"sdk","zoom apps sdk","apps",{"skillNo":163,"name":164,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":55},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[164],{"skillNo":169,"name":170,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":174,"publishedAt":55},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[173],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[170],{"skillNo":176,"name":43,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":55},"01M6FKJ21WFCDGTJQ2Q91T9DVW","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[43]]