hetty VS mitmproxy

FWIW: I'm building something in Go (https://github.com/dstotijn/hetty). But it's pretty early stage and not even near the featureset that mitmproxy or Burp Suite has. Also I wouldn't dare say it's more efficient (yet!). But Go has been great so far to build it.

As mentioned elsewhere: (dev friendly) extensibility/add-ons with Go will be an interesting challenge. Haven't looked into it yet.

dstotijn/hetty (Go): Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.

Actually, reading the issue I think the IBM request is a lot more reasonable than this tweet makes it seem.[1] The issue is essentially that a mitmproxy dependency has a CVE, mitmproy updated the dependency (in March), but hasn't made a stable release yet with this update, and IBM guy is asking "when do you plan to tag a release? Do you have a timeline for this?"

Notably it's NOT asking for a fix; "when will you fix it?" is not accurate as there is nothing to be fixed. It's just asking "when do you plan to make a new release with this dependency update?"

[1]: https://github.com/mitmproxy/mitmproxy/issues/6051

https://github.com/mitmproxy/mitmproxy/issues/6051#issuecomm...

update

mhils: "@FrugalGuy has just sent me genuine apology, which I truly appreciate. Please be nice and assume good intentions. :heart: "

https://github.com/mitmproxy/mitmproxy/issues/6051#issuecomm...

You can programatically extract XHR request URLs: https://github.com/wkeeling/selenium-wire#intercepting-requests-and-responses It uses https://github.com/mitmproxy/mitmproxy which you could also script.

Once you uninstalled mitmproxy go to https://mitmproxy.org

In /etc/hosts file you put only IP addresses and hostnames, i.e. 127.0.0.1 cdn.cloudflare.steamstatic.com. Then you have to set up a web server on localhost port 80 and put your image at http://localhost/steamcommunity/public/images/apps/753/1d0167575d746dadea7706685c0f3c01c8aeb6d8.jpg as well as other files from https://cdn.cloudflare.steamstatic.com. You also have to keep the URLs updated when they change upstream. It's not worth it. Better use a local proxy server like mitmproxy or requestly.