How to use the command mitmdump (with examples)

Mitmdump is a command-line tool that allows users to view, record, and programmatically transform HTTP traffic. It serves as the command-line counterpart to mitmproxy, providing similar functionalities. With mitmdump, users can start a proxy, save output to a file, filter saved traffic files, and replay saved traffic files.

Use case 1: Start a proxy and save all output to a file

Code:

mitmdump -w path/to/file

Motivation: This use case is useful when users want to capture and save all HTTP traffic passing through a proxy. By saving the output to a file, users can later analyze the traffic or use it for testing purposes.

Explanation:

• mitmdump: The command itself that launches the mitmdump tool.
• -w path/to/file: This flag specifies the path and file name where the output will be saved. Users should replace path/to/file with the desired location and filename.

Example output: The output of this command will be saved in the specified file, path/to/file, containing all the captured HTTP traffic.

Use case 2: Filter a saved traffic file to just POST requests

Code:

mitmdump -nr input_filename -w output_filename "~m post"

Motivation: Filtering traffic files to specific request types can be helpful to focus on specific aspects of the traffic. In this example, we filter to only capture POST requests for further analysis or testing.

Explanation:

• mitmdump: The command itself that launches the mitmdump tool.
• -nr input_filename: This flag specifies the input traffic file to be filtered. Users should replace input_filename with the actual file name.
• -w output_filename: This flag specifies the output file name where the filtered traffic will be saved. Users should replace output_filename with the desired output file name.
• "~m post": This filter expression, enclosed in double quotes, enables only the capture of POST requests. Other filter expressions can be used to capture different types of requests.

Example output: The output of this command will be a filtered traffic file containing only POST requests, saved in the specified output_filename.

Use case 3: Replay a saved traffic file

Code:

mitmdump -nc path/to/file

Motivation: Replaying a saved traffic file allows users to mimic previous captured traffic, which is useful for testing or reproducing specific scenarios.

Explanation:

• mitmdump: The command itself that launches the mitmdump tool.
• -nc path/to/file: This flag specifies the path and filename of the saved traffic file that will be replayed. Users should replace path/to/file with the actual file name.

Example output: With this command, the saved traffic file located at path/to/file will be replayed, simulating the captured requests and responses.

Conclusion:

Mitmdump is a powerful command-line tool for capturing, filtering, and replaying HTTP traffic. By following the provided use cases, users can effectively utilize mitmdump to analyze, transform, and reproduce network traffic for various purposes.