I just discovered mitmproxy and find it cool. Thanks for coming up with it.
A request: it is possible to run mitmdump on raw network data (pcap format) already captured by tcpdump or wireshark?
I work with networked embedded linux devices which cannot run python but can run tcpdump. I would use tcpdump to capture network data from the device, then copy it over to my work PC, run mitmdump to extract out the http/https transactions, and examine/replay the transactions using mitmproxy.
> I just discovered mitmproxy and find it cool. Thanks for coming up with it.
> A request: it is possible to run mitmdump on raw network data (pcap format) already captured by tcpdump or wireshark?
> I work with networked embedded linux devices which cannot run python but can run tcpdump. I would use tcpdump to capture network data from the device, then copy it over to my work PC, run mitmdump to extract out the http/https transactions, and examine/replay the transactions using mitmproxy.
> Would this be possible?
In theory, it would be possible to follow the TCP streams in the pcap dump, extract the requests and responses, and then reconstruct the matching mitmproxy objects. This would be a huge job, though, and I suspect that this is a very rare use-case. At the moment, though, you're out of luck - sorry!
Excerpts from Aldo Cortesi's message of Fri Feb 10 17:09:12 +1300 2012:
> HI Kam-Yung,
> > I just discovered mitmproxy and find it cool. Thanks for coming up with it.
> > A request: it is possible to run mitmdump on raw network data (pcap format) already captured by tcpdump or wireshark?
> > I work with networked embedded linux devices which cannot run python but can run tcpdump. I would use tcpdump to capture network data from the device, then copy it over to my work PC, run mitmdump to extract out the http/https transactions, and examine/replay the transactions using mitmproxy.
> > Would this be possible?
> In theory, it would be possible to follow the TCP streams in the pcap dump, extract the requests and responses, and then reconstruct the matching mitmproxy objects. This would be a huge job, though, and I suspect that this is a very rare use-case. At the moment, though, you're out of luck - sorry!
As an alternative, perhaps you could put a transparent squid proxy in your network, and persuade that to use mitmproxy for upstream requests?
-jim -- Jim Cheetham, Information Security, University of Otago, Dunedin, N.Z. ✉ jim.cheet...@otago.ac.nz ☏ +64 3 470 4670 ☏ m +64 21 227 0015 ⚷ OpenPGP: B50F BE3B D49B 3A8A 9CC3 8966 9374 82CD C982 0605 ✔ NZ BeSTGRID RAO ✔ CAcert.org Assurer
