News for hackers. Stuff that matters.
Re:Show HN: Mitmproxy 1.0 released, now with a web interface by janvdberg on Monday December 26, 2016 @01:57PM (#13259309)
Looks cool! How does this compare to Burp Suite? I am specifically looking for something more lightweight.
Re:Show HN: Mitmproxy 1.0 released, now with a web interface by capt8bit on Monday December 26, 2016 @02:06PM (#13259341)
I have used mitmproxy for performing web application pentest for years.

If you want something to create/intercept/edit/tamper/replay requests, this is your tool. If you want to script any of those things, this is still your tool.

However, burp comes with a lot of bells and whistles that don't make a lot of sense to build in to mitmproxy, but you can script yourself. For example, there is no intruder, spider, or scanner tool. But, they have an easy to use interface to write scripts that will be run on every request you make, or individual requests.

Or, you can just pass all mitmproxy traffic out to burp and get the best of both worlds.

Re:Show HN: Mitmproxy 1.0 released, now with a web interface by SCHiM on Monday December 26, 2016 @04:27PM (#13259846)
I found burps active scanning feature in the pro version insanely valuable. So far it has found blind SQL injections, numerous xss vulns, command injection and even XXE. I think it's very hard to script such a comprehensive feature into mitmproxy (that is burp pro with collaborator servers).

Still if you're comparing the free version of burp with mitmproxy they do seem very similar. I wouldn't know for sure since I've never used mitmproxy.

Re:Show HN: Mitmproxy 1.0 released, now with a web interface by tptacek on Monday December 26, 2016 @05:50PM (#13260202)
I wouldn't bother with the free version of Burp. If that's where you're at, use Fiddler or mitmproxy.

For software developers doing routine integration-test security checks, I think there's probably a lot of value in the scanner. For professional testers, though, I think the scanner does more harm than good: if it's routinely spotting things you don't spot manually, you should revise your technique.

Re:Show HN: Mitmproxy 1.0 released, now with a web interface by tptacek on Monday December 26, 2016 @02:04PM (#13259337)
It's getting there, and if you hate Burp's Java UI and mostly use Burp solely to capture and manually edit requests, it might be an acceptable substitute.

I don't think pathoc/pathos are really close to what the Burp "Intruder" fuzzer does (and I'm not in love with Intruder either). A lot of people also rely on Burp's spider, for which there's no mitmproxy analog. Obviously, there's Burp's scanner, but I think scanners are a bad idea and wouldn't count this against mitmproxy.

Re:Show HN: Mitmproxy 1.0 released, now with a web interface by mkagenius on Monday December 26, 2016 @03:07PM (#13259537)
> are really close to what the Burp "Intruder" fuzzer does (and I'm not in love with Intruder either).

Have you achieved any good results with the intruder? if yes, an example would be awesome. (Personally I have never used Burp)

Re:Show HN: Mitmproxy 1.0 released, now with a web interface by tptacek on Monday December 26, 2016 @03:35PM (#13259652)
Burp is the industry standard web pentesting tool, so that's a bit like asking if a writer has ever obtained good results from Microsoft Word.
Re:Show HN: Mitmproxy 1.0 released, now with a web interface by mkagenius on Tuesday December 27, 2016 @01:34AM (#13261643)
I was asking about intruder in specific. I am not doubting the capabilities of Burp.