mitmproxy / mitmproxy/mitmproxy
Allow arbitrary replay concurrency (client_replay_concurrency other than 1 and -1)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 45.1k
- Forks
- 4.7k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 16
Description
Problem Description
From the docs:
"Client-side replay
Client-side replay does what it says on the tin: you provide a previously saved HTTP conversation, and mitmproxy replays the client requests one by one. Note that mitmproxy serialises the requests, waiting for a response from the server before starting the next request."
I didnt find any way to change this behaviour and simply send out all replays concurrently (or with a limit like 10 concurrent replays). Im building a universal pentest proxy script for mitmproxy and would like to have a fuzzer addon, which replays requests with a number of payloads from a wordlist. This works great but is significantly slower than other tools because there is only one concurrent replayed request at a time. Here is a snippet of my code:
for word in fuzz_list:
counter += 1
modified_flow = flow.copy()
# path
modified_flow.request.path = modified_flow.request.path.replace("FUZZ", word)
# headers
for header_name in modified_flow.request.headers:
modified_flow.request.headers[header_name] = modified_flow.request.headers[header_name].replace("FUZZ", word)
# request body
if modified_flow.request.content:
modified_flow.request.content = modified_flow.request.content.decode().replace("FUZZ", word).encode()
ctx.master.commands.call("replay.client", [modified_flow])
Proposal
I would like to have an option to send all replayed flows in parallel, preferably with a number of concurrent requests/replays allowed (0 being unlimited).
Alternatives
I tried using requests/httpx/urllib3 and some other frameworks but they all have their own problems, especially when you need full control over payload encoding, special characters in uncommon places etc. mitmproxy does this much better, as it simply creates an exact copy of my request send with burp (mitmproxy as upstream proxy).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the client replay behavior described in the issue and the ctx.master.commands.call("replay.client", [modified_flow]) entry point. Define how client_replay_concurrency should handle values other than 1 and -1, including the proposed 0-unlimited behavior, then verify that replayed flows can run concurrently while preserving mitmproxy's request handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100