Опишете задачата
Към всички skills

api-mitmproxy

aiskillstore · Разработка

Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Interce

Оригинален текст · няма потвърден превод на български
Платформи: ClaudeНиво: НапредналоВ индекса: 04.03.2026 г.Обновен в GitHub: 04.03.2026 г.

Теми: api-testing · proxy · https · intercepting-proxy · traffic-analysis

Първо прочетете инструкцията.

Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.

Оригинален SKILL.md
GitHub хранилище
Звезди на репото
428
Лиценз
Не е посочен. Проверете в репозитория.
Последна проверка на записа
Няма посочена дата

Добавете в своя инструмент.

Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.

npx skills add aiskillstore/marketplace

Страницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.

Откъс от SKILL.md

Началото на файла на автора, без превод.

mitmproxy API Security Testing

Overview

mitmproxy is an interactive, TLS-capable intercepting HTTP proxy for penetration testers and developers. It enables real-time inspection, modification, and replay of HTTP/HTTPS traffic including APIs, mobile apps, and thick clients. With support for HTTP/1, HTTP/2, HTTP/3, and WebSockets, mitmproxy provides comprehensive coverage for modern API security testing.

Interfaces

mitmproxy - Interactive console interface with keyboard navigation mitmweb - Web-based GUI for visual traffic inspection mitmdump - Command-line tool for automated traffic capture and scripting

Quick Start

Install and run mitmproxy:

# Install via pip
pip install mitmproxy

# Start interactive console proxy
mitmproxy

# Start web interface (default: http://127.0.0.1:8081)
mitmweb

# Start command-line proxy with output
mitmdump -w traffic.flow

Configure client to use proxy (default: localhost:8080)

Core Workflows

Workflow 1: Interactive API Traffic Inspection

For manual API security testing and analysis:

  1. Start mitmproxy or mitmweb: 
    # Console interface
mitmproxy --mode regular --listen-host 0.0.0.0 --listen-port 8080

# Or web interface
mitmweb --mode regular --listen-host 0.0.0.0 --listen-port 8080
  2. Configure target application to use proxy (HTTP: localhost:8080)
  3. Install mitmproxy CA certificate on client device
  4. Trigger API requests from the application
  5. Intercept and inspect requests/responses in mitmproxy
  6. Modify requests to test:
    • Authentication bypass attempts
    • Authorization flaws (IDOR, privilege escalation)
    • Input validation (SQLi, XSS, command injection)
    • Business logic vulnerabilities
  7. Save flows for documentation and reporting

Workflow 2: Mobile App API Security Testing

Progress: [ ] 1. Install mitmproxy CA certificate on mobile device [ ] 2. Configure device WiFi to use mitmproxy as proxy [ ] 3. Start mitmweb for visual traffic inspection [ ] 4. Launch mobile app and exercise all features [ ] 5. Review API endpoints, authentication mechanisms, data flows [ ] 6. Test for common API vulnerabilities (OWASP API Top 10) [ ] 7. Export traffic as HAR for further analysis [ ] 8. Document findings with request/response examples

Work through each step systematically. Check off completed items.

Workflow 3: Automated API Traffic Recording

For capturing and analyzing API traffic at scale:

Целият SKILL.md в GitHub