Mitmproxy tampering with returned data

Preface

• mitmproxy It's a very powerful bag grabbing tool , You can also tamper with data , Act as a middleman . Support use python The script completes some custom operations on traffic .
• There are the following 3 Medium mode can start mitmproxy：
  • mitmproxy It's an interactive 、 Support SSL/TLS The interception agent of , have HTTP/1、HTTP/2 and WebSockets Console interface .
  • mitmweb yes mitmproxy be based on web The interface of .
  • mitmdump yes mitmproxy The command line version of .
• This article USES the mitmweb Complete data tampering .

actual combat

Install the corresponding certificate

• Install the certificate first .
  
• After clicking , Will enter http://mitm.it/, Be careful ： This page must use mitmproxy The agent can enter the correct page . The correct page is shown in the figure below .
  

Intercept

• Let's get familiar with the operation interface first .
  

• The main function is to intercept the input box , For example, I want to block the interface shown in the figure below .
  

• I want it to return hello world.

This web page should be used in advance mitmproxy Agent for . I used it SwitchyOmega

• I will first enter the input box in the intercepted input box baidu.
• When I make a request ,mitmproxy It's stopped , As shown in the figure below .
  
• I do not modify the request , Just click Resume, Now there is the return value , As shown in the figure below .

Modify the returned data

• Click on Edit Modify the returned data ,Done complete , As shown in the figure below .
  
• Continue clicking Resume, Then view the web page . Modification successful , As shown in the figure below .
  

Summary

• mitmproxy It can be used on many platforms , Very powerful , I only use a few features here . The details can be seen https://docs.mitmproxy.org/stable/overview-features/.
• I wrote one before Bypass anti debugging fuck-debugger, Now think about it mitmproxy It can also achieve the effect .

mitmproxy You can get https The data of , Doesn't mean it puts https It's broken , Because the premise is that the certificate must be installed on the monitored machine in advance .