mitmproxy — authorized HTTP(S) intercept for labs you control

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

mitmproxy (mitmproxy.org) is an interactive HTTP(S) intercept proxy. Cite 12.3.0 (2026-10-22 UTC). License is MIT. Use it only on clients and networks you are authorized to instrument.

On this page

Snapshot

FieldValue
LicenseMIT
Latest checked12.3.0 (2026-10-22 UTC)
JobAuthorized HTTP/1, HTTP/2, WebSocket intercept + scripting
PeersFrida, Objection

Allowed framing

  • Debugging your app's HTTPS against a lab proxy with a lab-installed CA.
  • Teaching TLS intercept concepts on disposable VMs/emulators you control.
  • Exporting flows (HAR/etc.) from authorized captures for offline review.

Scope we will not cover

  • No unauthorized MITM of third-party users or networks.
  • No credential-harvesting / phishing proxy cookbooks.
  • No “weaponize compromised public CAs against strangers” recipes — treat 12.3 security notes as upstream advisories, not attack tutorials.

Beginner path (authorized only)

  1. Install 12.3.0 from official downloads or pip into an isolated lab environment.
  2. Install mitmproxy's local CA only into trust stores you administer.
  3. Point your test client at the proxy; confirm flows in mitmweb/mitmproxy before scripting.
  4. Keep flow dumps as case material; scrub secrets before sharing.
  5. For in-app SSL pinning on mobile you own, escalate to authorized Frida/Objection paths — not silent third-party bypass guides here.
Which to pick
  • Use mitmproxy 12.3.0 for authorized lab HTTPS intercept.
  • Prefer Frida/Objection for in-process mobile instrumentation.
  • Refuse unauthorized MITM and credential-theft framing.

For legal, authorized and educational use only.

FAQ

What is mitmproxy?

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy (console mitmproxy, mitmdump, mitmweb) for HTTP/1, HTTP/2 and WebSockets — intended for debugging and authorized lab inspection.

Which version is cited?

12.3.0 (published 2026-10-22 UTC on GitHub/PyPI; “eMudhra Edition” notes). Pin 12.3.0 unless your lab deliberately freezes an earlier 12.2.x line (checked 2026-10-24).

What license applies?

MIT License (PyPI / project; checked 2026-10-24).

Frida/Objection or mitmproxy?

Prefer Frida / Objection for in-process instrumentation on authorized devices. Prefer mitmproxy when the question is HTTP(S) flows through a proxy you control on lab clients that trust your local CA.

Does this teach unauthorized MITM of other people's traffic?

No. Only intercept clients/devices you own or have written authorization to instrument. BinBench will not supply credential-theft, silent third-party MITM or CA-abuse cookbooks.

Sources