mirror of
https://github.com/Grasscutters/mitmproxy.git
synced 2024-11-23 00:01:36 +00:00
Update docs to reflect current shortcut keys for features which have been moved into the options menu.
This commit is contained in:
parent
d2ae6b630e
commit
3346daa65a
@ -18,18 +18,18 @@ If you want to ignore traffic from mitmproxy's processing because of large respo
|
||||
<th width="20%">command-line</th> <td>--ignore regex</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>I</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>I</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
mitmproxy allows you to specify a regex which is matched against a <code>host:port</code> string (e.g. "example.com:443")
|
||||
to determine hosts that should be excluded.
|
||||
to determine hosts that should be excluded.
|
||||
|
||||
There are two important quirks to consider:
|
||||
|
||||
- **In transparent mode, the ignore pattern is matched against the IP.** While we usually infer the hostname from the
|
||||
- **In transparent mode, the ignore pattern is matched against the IP.** While we usually infer the hostname from the
|
||||
Host header if the --host argument is passed to mitmproxy, we do not have access to this information before the SSL
|
||||
handshake.
|
||||
- In regular mode, explicit HTTP requests are never ignored.[^explicithttp] The ignore pattern is applied on CONNECT
|
||||
@ -40,9 +40,9 @@ There are two important quirks to consider:
|
||||
|
||||
If you just want to ignore one specific domain, there's usually a bulletproof method to do so:
|
||||
|
||||
1. Run mitmproxy or mitmdump in verbose mode (-v) and observe the host:port information in the serverconnect
|
||||
1. Run mitmproxy or mitmdump in verbose mode (-v) and observe the host:port information in the serverconnect
|
||||
messages. mitmproxy will filter on these.
|
||||
2. Take the host:port string, surround it with ^ and $, escape all dots (. becomes \\.)
|
||||
2. Take the host:port string, surround it with ^ and $, escape all dots (. becomes \\.)
|
||||
and use this as your ignore pattern:
|
||||
|
||||
<pre class="terminal">
|
||||
@ -60,16 +60,16 @@ $ mitmproxy --ignore ^example\.com:443$
|
||||
Here are some other examples for ignore patterns:
|
||||
<pre>
|
||||
# Exempt traffic from the iOS App Store (the regex is lax, but usually just works):
|
||||
--ignore apple.com:443
|
||||
--ignore apple.com:443
|
||||
# "Correct" version without false-positives:
|
||||
--ignore '^(.+\.)?apple\.com:443$'
|
||||
|
||||
|
||||
# Ignore example.com, but not its subdomains:
|
||||
--ignore '^example.com:'
|
||||
|
||||
# Ignore everything but example.com and mitmproxy.org:
|
||||
--ignore '^(?!example\.com)(?!mitmproxy\.org)'
|
||||
|
||||
|
||||
# Transparent mode:
|
||||
--ignore 17\.178\.96\.59:443
|
||||
# IP address range:
|
||||
|
@ -9,14 +9,14 @@ replace hook is triggered on server response, the replacement is only run on
|
||||
the Response object leaving the Request intact. You control whether the hook
|
||||
triggers on the request, response or both using the filter pattern. If you need
|
||||
finer-grained control than this, it's simple to create a script using the
|
||||
replacement API on Flow components.
|
||||
replacement API on Flow components.
|
||||
|
||||
Replacement hooks are extremely handy in interactive testing of applications.
|
||||
For instance you can use a replace hook to replace the text "XSS" with a
|
||||
complicated XSS exploit, and then "inject" the exploit simply by interacting
|
||||
with the application through the browser. When used with tools like Firebug and
|
||||
mitmproxy's own interception abilities, replacement hooks can be an amazingly
|
||||
flexible and powerful feature.
|
||||
flexible and powerful feature.
|
||||
|
||||
|
||||
## On the command-line
|
||||
@ -52,9 +52,9 @@ times.
|
||||
|
||||
## Interactively
|
||||
|
||||
The _R_ shortcut key in mitmproxy lets you add and edit replacement hooks using
|
||||
a built-in editor. The context-sensitive help (_h_) has complete usage
|
||||
information.
|
||||
The _R_ shortcut key in the mitmproxy options menu (_o_) lets you add and edit
|
||||
replacement hooks using a built-in editor. The context-sensitive help (_?_) has
|
||||
complete usage information.
|
||||
|
||||
<table class="table">
|
||||
<tbody>
|
||||
@ -68,7 +68,7 @@ information.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>R</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>R</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -12,7 +12,7 @@ command-line, or through an interactive editor in mitmproxy.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>H</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>H</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -9,7 +9,7 @@ using a browser. After authentication, you can request authenticated resources
|
||||
through mitmproxy as if they were unauthenticated, because mitmproxy will
|
||||
automatically add the session tracking cookie to requests. Among other things,
|
||||
this lets you script interactions with authenticated resources (using tools
|
||||
like wget or curl) without having to worry about authentication.
|
||||
like wget or curl) without having to worry about authentication.
|
||||
|
||||
Sticky cookies are especially powerful when used in conjunction with [client
|
||||
replay](@!urlTo("clientreplay.html")!@) - you can record the authentication
|
||||
@ -27,7 +27,7 @@ with the secured resources.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>t</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>t</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -39,7 +39,7 @@ The sticky auth option is analogous to the sticky cookie option, in that HTTP
|
||||
__Authorization__ headers are simply replayed to the server once they have been
|
||||
seen. This is enough to allow you to access a server resource using HTTP Basic
|
||||
authentication through the proxy. Note that __mitmproxy__ doesn't (yet) support
|
||||
replay of HTTP Digest authentication.
|
||||
replay of HTTP Digest authentication.
|
||||
|
||||
<table class="table">
|
||||
<tbody>
|
||||
@ -52,7 +52,7 @@ replay of HTTP Digest authentication.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>u</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>A</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -17,7 +17,7 @@ If you are not interested in the raw TCP messages, you should use the ignore dom
|
||||
<th width="20%">command-line</th> <td>--tcp HOST</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>T</b></td>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>T</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -17,5 +17,8 @@ Upstream cert sniffing is on by default, and can optionally be turned off.
|
||||
<tr>
|
||||
<th width="20%">command-line</th> <td>--no-upstream-cert</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>mitmproxy shortcut</th> <td><b>o</b> then <b>U</b></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -60,7 +60,7 @@ At the moment, the Grid Editor is used in four parts of mitmproxy:
|
||||
- Editing request or response headers (_e_ for edit, then _h_ for headers in flow view)
|
||||
- Editing a query string (_e_ for edit, then _q_ for query in flow view)
|
||||
- Editing a URL-encoded form (_e_ for edit, then _f_ for form in flow view)
|
||||
- Editing replacement patterns (_R_ globally)
|
||||
- Editing replacement patterns (_o_ for options, then _R_ for Replacement Patterns)
|
||||
|
||||
If there is is no data, an empty editor will be started to let you add some.
|
||||
Here is the editor showing the headers from a request:
|
||||
|
Loading…
Reference in New Issue
Block a user